Overview

overview

10

Static

static

3

69d761d941...3a.exe

windows7-x64

10

69d761d941...3a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 19:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69d761d941e1a7a4721e267e91167b3a.exe

  • Size

    170KB

  • MD5

    69d761d941e1a7a4721e267e91167b3a

  • SHA1

    7e83135738bdd132a8c9da031b4794852cfc9f8b

  • SHA256

    c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

  • SHA512

    4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295

  • SSDEEP

    3072:lLWPQWxrjDjU6G+JLfeEXcUesyx0RcAJ+qVeYg:lLWPvjU6TFhXBes/c

Score
10/10
djvumarsstealersmokeloaderzgratdefaultpub1backdoordiscoveryevasionpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .ldhy

  • offline_id

    pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw

rsa_pubkey.plain

Extracted

Family

marsstealer

Botnet

Default

Signatures

  • Detect ZGRat V1 20 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    evasion
  • Downloads MZ/PE file
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • .NET Reactor proctector 11 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe
    "C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1784
  • C:\Users\Admin\AppData\Local\Temp\C60F.exe
    C:\Users\Admin\AppData\Local\Temp\C60F.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2240
  • C:\Users\Admin\AppData\Local\Temp\DAF0.exe
    C:\Users\Admin\AppData\Local\Temp\DAF0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\DAF0.exe
      C:\Users\Admin\AppData\Local\Temp\DAF0.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\8a693bba-b6d2-4101-a9c8-94cbc8138233" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1524
      • C:\Users\Admin\AppData\Local\Temp\DAF0.exe
        "C:\Users\Admin\AppData\Local\Temp\DAF0.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\Users\Admin\AppData\Local\Temp\DAF0.exe
          "C:\Users\Admin\AppData\Local\Temp\DAF0.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:1720
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 568
            5⤵
            • Program crash
            PID:4432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
    1⤵
      PID:2140
    • C:\Users\Admin\AppData\Local\Temp\6E86.exe
      C:\Users\Admin\AppData\Local\Temp\6E86.exe
      1⤵
      • Executes dropped EXE
      PID:4980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 372
        2⤵
        • Program crash
        PID:4852
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1112
        2⤵
        • Program crash
        PID:2696
    • C:\Users\Admin\AppData\Local\Temp\828C.exe
      C:\Users\Admin\AppData\Local\Temp\828C.exe
      1⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:448
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
        2⤵
        • Executes dropped EXE
        PID:1600
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1224
        2⤵
        • Program crash
        PID:4076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4980 -ip 4980
      1⤵
        PID:1060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4980 -ip 4980
        1⤵
          PID:1064
        • C:\Users\Admin\AppData\Local\Temp\89E0.exe
          C:\Users\Admin\AppData\Local\Temp\89E0.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4384
        • C:\Users\Admin\AppData\Local\Temp\8ED3.exe
          C:\Users\Admin\AppData\Local\Temp\8ED3.exe
          1⤵
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4028
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3880
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
              3⤵
              • Creates scheduled task(s)
              PID:3348
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA36F.tmp.bat""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5060
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              3⤵
              • Delays execution with timeout.exe
              PID:3192
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              "C:\Users\Admin\AppData\Roaming\svchost.exe"
              3⤵
              • UAC bypass
              • Windows security bypass
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Maps connected drives based on registry
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3204
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2496
              • C:\Windows\SysWOW64\ping.exe
                "C:\Windows\SYSWOW64\ping.exe"
                4⤵
                • Loads dropped DLL
                • Runs ping.exe
                PID:3376
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 908
                  5⤵
                  • Program crash
                  PID:4852
              • C:\Windows\SysWOW64\calc.exe
                "C:\Windows\SYSWOW64\calc.exe"
                4⤵
                  PID:1204
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3376 -ip 3376
            1⤵
              PID:3444
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 448 -ip 448
              1⤵
                PID:4260

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              File and Directory Permissions Modification

              1
              T1222

              Impair Defenses

              3
              T1562

              Disable or Modify Tools

              3
              T1562.001

              Modify Registry

              5
              T1112

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Unsecured Credentials

              2
              T1552

              Credentials In Files

              2
              T1552.001

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              8
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              6
              T1082

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              2
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\mozglue.dll
                Filesize

                133KB

                MD5

                8f73c08a9660691143661bf7332c3c27

                SHA1

                37fa65dd737c50fda710fdbde89e51374d0c204a

                SHA256

                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                SHA512

                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                1.2MB

                MD5

                bfac4e3c5908856ba17d41edcd455a51

                SHA1

                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                SHA256

                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                SHA512

                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\6E86.exe
                Filesize

                6.0MB

                MD5

                95e59305ad61119cf15ee95562bd05ba

                SHA1

                0f0059cda9609c46105cf022f609c407f3718e04

                SHA256

                dd87f94c961b9612bbd65761bee6ed15318d63652f262e2c425bd177a2341a19

                SHA512

                5fbcfe79162460080e0c3944df747835f0b8f2cdb35b038eb69eadf2eb85a209f7d5432a328d0f0eeafba036012f48793e3c08d94531b98a12a498bcf3b00ad2

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\828C.exe
                Filesize

                649KB

                MD5

                35ffefa212414c2538df410e5ad3afa7

                SHA1

                e7721fbb85e400c74c7f4de95f1c27b6318caabd

                SHA256

                9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f

                SHA512

                7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\89E0.exe
                Filesize

                952KB

                MD5

                422a9c5cfa6370c93a4bd5db29c3d196

                SHA1

                caaf89e601fde4bc9dbe3c0edda8e7efa5062e17

                SHA256

                82311d6280999d5c9d368377e30b8f55abe2a3d7d98f8c074f6e40c5be7cd965

                SHA512

                2caf014595f65caa26bd7c8396f981ee452ef01fdf35dde3e9e2e950855f564e97026f71c52b9a49526f9bca68d4f5c6d4bc9ba51d4b8330e38e4b4b84214e96

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\8ED3.exe
                Filesize

                68KB

                MD5

                cd2b5a09efdac0ffbd76111f44733138

                SHA1

                6db6bc9dba96632213d1077155725f388237e268

                SHA256

                1c6b4fadf6a74e1dfacd17468bdb0743ec21a1bdf3fcd4c3f58bf727efb1c74c

                SHA512

                16fa87494baa4d65bd170d346efe082b998689d0c3488cec764170f5c0e63a7a4ad2fc51f18aa710aa8bca1ed84af99965baae692a81cead192cfa63aa37c714

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\C60F.exe
                Filesize

                170KB

                MD5

                69d761d941e1a7a4721e267e91167b3a

                SHA1

                7e83135738bdd132a8c9da031b4794852cfc9f8b

                SHA256

                c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

                SHA512

                4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\DAF0.exe
                Filesize

                699KB

                MD5

                a2b38ede1742205c46b74ce044287fb9

                SHA1

                8415a9ab51551583f3ace6916816c4474a2ffb9b

                SHA256

                324a8068a203d94f77eb773e1491ca27fd52b5a2b5b220f50d3a9b86f9d69965

                SHA512

                9fb2d5c030bedcb71132db3c019fdf7131826e48cb4c64d779bd2e853ab110d8fd384e3ed07946ee8bd055c880e17510488b6edc68421a99a76bfd57872694d4

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rv45jyfs.qlm.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\tmpA36F.tmp.bat
                Filesize

                151B

                MD5

                07c29ea3be1d6f420b360f231fcb6976

                SHA1

                ce23ecbd7d2a607ceffeaaaebdc46494a722e5e0

                SHA256

                09a6fc075d2f8d60cd8524c26982dbe5ee572df3d4f675b9f7983678958e98cf

                SHA512

                3b4401e48b0a6a4bafa2318aa597a332048d7fda334568b8c23cb9cf8a8aee8603f0dc64b7eb408bc7a01c653ea6de7243987206611d81243f0759eaa148b5e6

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                Filesize

                4KB

                MD5

                a5ce3aba68bdb438e98b1d0c70a3d95c

                SHA1

                013f5aa9057bf0b3c0c24824de9d075434501354

                SHA256

                9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

                SHA512

                7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

                Download Submit

              • memory/448-761-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/448-118-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-130-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-137-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-124-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-756-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/448-112-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-107-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-102-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-98-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-96-0x0000000004C10000-0x0000000004CB9000-memory.dmp

                Filesize

                676KB

                Download

              • memory/448-92-0x0000000004C10000-0x0000000004CBE000-memory.dmp

                Filesize

                696KB

                Download

              • memory/448-90-0x0000000004E10000-0x00000000053B4000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/448-89-0x0000000004D50000-0x0000000004D60000-memory.dmp

                Filesize

                64KB

                Download

              • memory/448-88-0x0000000004D50000-0x0000000004D60000-memory.dmp

                Filesize

                64KB

                Download

              • memory/448-87-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/448-86-0x0000000004D60000-0x0000000004E10000-memory.dmp

                Filesize

                704KB

                Download

              • memory/448-85-0x0000000000400000-0x00000000004C8000-memory.dmp

                Filesize

                800KB

                Download

              • memory/448-84-0x0000000000640000-0x0000000000705000-memory.dmp

                Filesize

                788KB

                Download

              • memory/448-83-0x0000000000730000-0x0000000000830000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/448-982-0x0000000004D50000-0x0000000004D60000-memory.dmp

                Filesize

                64KB

                Download

              • memory/448-949-0x0000000004D50000-0x0000000004D60000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1528-29-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1528-31-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1528-32-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1528-33-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1528-43-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1568-27-0x00000000047A0000-0x000000000483D000-memory.dmp

                Filesize

                628KB

                Download

              • memory/1568-28-0x0000000004990000-0x0000000004AAB000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/1720-49-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1720-52-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1720-50-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1784-2-0x0000000004920000-0x000000000492B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1784-1-0x0000000002E80000-0x0000000002F80000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/1784-3-0x0000000000400000-0x0000000002BD7000-memory.dmp

                Filesize

                39.8MB

                Download

              • memory/1784-5-0x0000000000400000-0x0000000002BD7000-memory.dmp

                Filesize

                39.8MB

                Download

              • memory/2240-20-0x0000000000400000-0x0000000002BD7000-memory.dmp

                Filesize

                39.8MB

                Download

              • memory/2240-17-0x0000000000400000-0x0000000002BD7000-memory.dmp

                Filesize

                39.8MB

                Download

              • memory/2240-16-0x0000000002D10000-0x0000000002E10000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/2496-770-0x0000000005740000-0x0000000005D68000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/2496-952-0x0000000002D40000-0x0000000002D50000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2496-810-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2496-799-0x0000000005630000-0x0000000005652000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2496-1025-0x0000000007D70000-0x00000000083EA000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/2496-769-0x0000000002D40000-0x0000000002D50000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2496-755-0x0000000002AE0000-0x0000000002B16000-memory.dmp

                Filesize

                216KB

                Download

              • memory/2496-774-0x0000000002D40000-0x0000000002D50000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2496-887-0x0000000006420000-0x000000000643E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2496-766-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/2496-1006-0x0000000007630000-0x00000000076D3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/2496-1001-0x0000000006A00000-0x0000000006A1E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2496-984-0x00000000075F0000-0x0000000007622000-memory.dmp

                Filesize

                200KB

                Download

              • memory/2496-986-0x0000000074FF0000-0x000000007503C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2496-826-0x0000000005E50000-0x00000000061A4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/2496-892-0x00000000069B0000-0x00000000069FC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3204-588-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/3204-747-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/3376-749-0x0000000000400000-0x000000000043D000-memory.dmp

                Filesize

                244KB

                Download

              • memory/3420-4-0x0000000002270000-0x0000000002286000-memory.dmp

                Filesize

                88KB

                Download

              • memory/3420-19-0x0000000002B50000-0x0000000002B66000-memory.dmp

                Filesize

                88KB

                Download

              • memory/3832-46-0x0000000004900000-0x00000000049A1000-memory.dmp

                Filesize

                644KB

                Download

              • memory/4028-142-0x00000000054E0000-0x0000000005572000-memory.dmp

                Filesize

                584KB

                Download

              • memory/4028-135-0x00000000053D0000-0x00000000053EA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/4028-132-0x0000000000BF0000-0x0000000000C06000-memory.dmp

                Filesize

                88KB

                Download

              • memory/4028-152-0x0000000005710000-0x0000000005720000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4028-155-0x0000000005690000-0x000000000569A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4028-219-0x0000000007E00000-0x0000000007E8E000-memory.dmp

                Filesize

                568KB

                Download

              • memory/4028-214-0x0000000007D60000-0x0000000007DFC000-memory.dmp

                Filesize

                624KB

                Download

              • memory/4028-298-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/4028-222-0x0000000007E90000-0x0000000007EF6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4028-131-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/4384-103-0x0000000005490000-0x0000000005AA8000-memory.dmp

                Filesize

                6.1MB

                Download

              • memory/4384-99-0x0000000074020000-0x00000000747D0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/4384-123-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-129-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-136-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-117-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-115-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-111-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-108-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-106-0x0000000004D80000-0x0000000004E6B000-memory.dmp

                Filesize

                940KB

                Download

              • memory/4384-104-0x0000000004FE0000-0x00000000050EA000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/4384-97-0x0000000000440000-0x0000000000532000-memory.dmp

                Filesize

                968KB

                Download

              • memory/4384-101-0x0000000004D80000-0x0000000004E70000-memory.dmp

                Filesize

                960KB

                Download

              • memory/4980-211-0x0000000000480000-0x0000000000FDB000-memory.dmp

                Filesize

                11.4MB

                Download

              • memory/4980-77-0x00000000016C0000-0x00000000016F2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-76-0x00000000016C0000-0x00000000016F2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-75-0x00000000016C0000-0x00000000016F2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-74-0x00000000016C0000-0x00000000016F2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-73-0x00000000016C0000-0x00000000016F2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/4980-72-0x0000000000480000-0x0000000000FDB000-memory.dmp

                Filesize

                11.4MB

                Download

              • memory/4980-68-0x0000000000480000-0x0000000000FDB000-memory.dmp

                Filesize

                11.4MB

                Download

              • memory/4980-66-0x00000000016B0000-0x00000000016B1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4980-62-0x0000000000480000-0x0000000000FDB000-memory.dmp

                Filesize

                11.4MB

                Download

              • memory/4980-65-0x00000000016A0000-0x00000000016A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4980-64-0x0000000001690000-0x0000000001691000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4980-63-0x0000000001680000-0x0000000001681000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4980-60-0x0000000001530000-0x0000000001531000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4980-61-0x0000000001540000-0x0000000001541000-memory.dmp

                Filesize

                4KB

                Download