Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 01:54

General

  • Target

    file.exe

  • Size

    136KB

  • MD5

    1bc8dd1a5e08a1dcaeefb1a03f5c71eb

  • SHA1

    9fbb0b46be6b7b0d60841f6c4d6940cdd1b4b08e

  • SHA256

    30845b56fd4b84afa4212a7c5130b4ee2c07924524c357ea21d4b79ef21fd2f5

  • SHA512

    5e8d3d808445684b08ec6e4b15d1a701c40bc80fb7d878695970a73f06fd318f6a812c7254dd7d61f74c1c36a0a989894dc80234374d9fc914142adcd9f6bc40

  • SSDEEP

    1536:Y3HKFCXebMDnye3MtblERG2DnWQZWSqaiWz5AAm7FcNLuAfyEDyIEpovc29OhSc4:iHKCXeC3VdZWS5ijAm7FcUMyIrjksE

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .lkhy

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.38:46185

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 13 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2212
  • C:\Users\Admin\AppData\Local\Temp\15D5.exe
    C:\Users\Admin\AppData\Local\Temp\15D5.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\15D5.exe
      C:\Users\Admin\AppData\Local\Temp\15D5.exe
      2⤵
      • DcRat
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\5953d43e-fb0a-4ac4-8520-990531719594" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1876
      • C:\Users\Admin\AppData\Local\Temp\15D5.exe
        "C:\Users\Admin\AppData\Local\Temp\15D5.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Users\Admin\AppData\Local\Temp\15D5.exe
          "C:\Users\Admin\AppData\Local\Temp\15D5.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:1688
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 568
            5⤵
            • Program crash
            PID:2284
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1688 -ip 1688
    1⤵
      PID:3736
    • C:\Users\Admin\AppData\Local\Temp\2547.exe
      C:\Users\Admin\AppData\Local\Temp\2547.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2996
      • C:\Users\Admin\AppData\Local\Temp\78B7.exe
        C:\Users\Admin\AppData\Local\Temp\78B7.exe
        1⤵
        • Executes dropped EXE
        PID:1184
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7C81.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
          2⤵
            PID:2324
        • C:\Users\Admin\AppData\Local\Temp\8F7D.exe
          C:\Users\Admin\AppData\Local\Temp\8F7D.exe
          1⤵
          • Executes dropped EXE
          PID:4184
        • C:\Users\Admin\AppData\Local\Temp\9654.exe
          C:\Users\Admin\AppData\Local\Temp\9654.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1732
          • C:\Users\Admin\AppData\Local\Temp\9654.exe
            "C:\Users\Admin\AppData\Local\Temp\9654.exe"
            2⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1316
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:988
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2324
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:4268
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:3572
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:552
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:740
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:712
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                4⤵
                • DcRat
                • Creates scheduled task(s)
                PID:4908
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                4⤵
                  PID:4180
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:228
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2444
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  4⤵
                  • Executes dropped EXE
                  PID:4676
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:3328
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:1568
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    5⤵
                      PID:4984
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        6⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1240
            • C:\Windows\windefender.exe
              C:\Windows\windefender.exe
              1⤵
              • Executes dropped EXE
              PID:372

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\15D5.exe

              Filesize

              713KB

              MD5

              9d9114ab84aa79f8a22356d35ce7fd66

              SHA1

              80ace18221477538d8219bd0495e79875c334fa7

              SHA256

              05cff8cebc34d942d16d5fe3eae68ceb3420e96264819f8dd3fd6bb28028e514

              SHA512

              ba12481c78ab484781fb3466f28140f653230fa8b947a3afe4327621195de259258587c143f4e79a2dc5658439216b9fa11b337ec4c7794d910ce1262c915968

            • C:\Users\Admin\AppData\Local\Temp\2547.exe

              Filesize

              483KB

              MD5

              820bc0398778528a79c639a9c1d9fceb

              SHA1

              b4d6633456ecfd1488c267abad140d3f765166c3

              SHA256

              ac847ca2a4f39ced778cb7724ee175e1c8130f6d0edf8eb75d495d02225ecab6

              SHA512

              0fb054b5f08759bda57e2106963f3e8c99b5104ba41588d0b6041047710526551ee8037804e3d989f867d46f6230c5dec8b96fc18491b13139ceb60c9b624b85

            • C:\Users\Admin\AppData\Local\Temp\78B7.exe

              Filesize

              5.6MB

              MD5

              479342d62078aaf31881972c7574f6f2

              SHA1

              382fa9a95746ca6199e7dfb9ae2bd035f4000fb4

              SHA256

              a6b59e0a275b5314935a3f812a5ba7dd5d5cc9524d3a6efdeb3a103eea386f6d

              SHA512

              0e74e3e0b993968220e712ffd94a76c00d35f0452494d62b3f6780c80cc0cae2e9982978830c54bed3a57d17a5a84abbdc4c0cbb5961afcae785048ac4ac47da

            • C:\Users\Admin\AppData\Local\Temp\7C81.bat

              Filesize

              77B

              MD5

              55cc761bf3429324e5a0095cab002113

              SHA1

              2cc1ef4542a4e92d4158ab3978425d517fafd16d

              SHA256

              d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

              SHA512

              33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

            • C:\Users\Admin\AppData\Local\Temp\8F7D.exe

              Filesize

              1.9MB

              MD5

              b2b4879290de8e43ccbcd92b507de1cd

              SHA1

              de32697442f04035415d6c89d3398f778ed50bf2

              SHA256

              3800084470a4fde43467a91cba0e08399f7bdf70b0f03af2f99c282b18f1aa49

              SHA512

              179ffc5976e0a9a033816863cbb71ca0b8bc513e3f93a0da9773da1b7b5f3109d1442623f13482dd2a5632694262d5497e10c434149eb267ed028318c45a0bf1

            • C:\Users\Admin\AppData\Local\Temp\9654.exe

              Filesize

              4.1MB

              MD5

              02918300e22e657baba70691b738ce12

              SHA1

              1fbfb963370dfceb62b270d348c6b35ca03b4715

              SHA256

              2a411824ee17b6546edb1d5d8144bf49d4e58c51b7a4c98fcec51198f7032cad

              SHA512

              af63db2688208bcb06bd441f74d97d61e9451554f30cc616b7222d1085c8d84109d02359021d163de86f4753090500810efac38adda9cb8713a856d0d19a0747

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sc03ktd2.xr1.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

              Filesize

              281KB

              MD5

              d98e33b66343e7c96158444127a117f6

              SHA1

              bb716c5509a2bf345c6c1152f6e3e1452d39d50d

              SHA256

              5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

              SHA512

              705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              3d086a433708053f9bf9523e1d87a4e8

              SHA1

              b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

              SHA256

              6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

              SHA512

              931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              dba357be8e0f06523ea7b61e82c493fb

              SHA1

              fc53ced112265400c55b5cc3ec2e754da2ac3e65

              SHA256

              87fe43113219e209c492e1c6fa6c96acfa285b5a0f32890e27a08baf4428b46a

              SHA512

              9a67c44ad7b1bed0d52cdbf5b3257715e2920b63d55aebcc76ca0e109af62d5fd70613408777a0d086c35b2c26ca842d0e06d9cc39fb11235a25b75bb1f27047

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              9cf279f9935690199eeebf2481a07f17

              SHA1

              01ff7d722b85db63031a85be91f856ae5c4ec6fe

              SHA256

              d439a9d998d6812efb7ef67cf5cdce4aa550614f67e65680640fda1096df0cfb

              SHA512

              5c66c5064f9075e8f185b87b02cb4f8295f0d30889869ec53ec407d67d1deb9ef633632ac7ada69c14516cb19f6d8ed8a0659bd24dc6a8bb71ddffa70bb14b78

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              21cdb267361712025b39a62ff7e37bd6

              SHA1

              19ccb9d3493f28bb90eb23b910a9192f1eae9bcb

              SHA256

              c245dd216df5d2c3e7d8efaf2acf861e4a6ab14b18db636e5fba7625981f5c3c

              SHA512

              a6ed02856073fba55c92d25e7304ccdfa75c04518ed8b287dce15b6122a966023c2ce80255f814076c10dc729625544c81eb0453cf254ab46d211202fac9b4bb

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              11da6d8442d6e41faef6661377513c48

              SHA1

              8e6cc9eef89fde9af49543df0406e8a0760e6dca

              SHA256

              eb3502178f9523fe5188da545923cf9352018bafba61c43090de1654af40bbb1

              SHA512

              6874113fb2f4f4ec8e38d93315af0c820d3bc805cab448d662b2110eb166ab9385293091a92f8a7257ae63ee85b7a2148121dfde03187f2fb5c72dd6272faa0f

            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              19KB

              MD5

              780f6c5e1520f58801fc8b9cee78ae5f

              SHA1

              e82ef0d221abb5666efedda28fd283ff244e372e

              SHA256

              507f943ba3862a583bffd0086019bae54a01cdb4a0ad74171b98a2843c45cce4

              SHA512

              258e8d76ab3814f3de31be30cfa4175b1b70d9065ed5e1d4047700f29f908aa53cebb862b12f5bc079444a82ca03236b4e8b8ba54ab8769c1f5e9f67db15a662

            • C:\Windows\windefender.exe

              Filesize

              2.0MB

              MD5

              8e67f58837092385dcf01e8a2b4f5783

              SHA1

              012c49cfd8c5d06795a6f67ea2baf2a082cf8625

              SHA256

              166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

              SHA512

              40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

            • memory/652-34-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/652-22-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/652-21-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/652-20-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/652-18-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/740-342-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/740-376-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/740-386-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/860-37-0x00000000048F0000-0x0000000004986000-memory.dmp

              Filesize

              600KB

            • memory/988-178-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1184-106-0x0000000002F30000-0x0000000002F62000-memory.dmp

              Filesize

              200KB

            • memory/1184-92-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

              Filesize

              4KB

            • memory/1184-107-0x0000000000CA0000-0x0000000001777000-memory.dmp

              Filesize

              10.8MB

            • memory/1184-105-0x0000000002F30000-0x0000000002F62000-memory.dmp

              Filesize

              200KB

            • memory/1184-104-0x0000000002F30000-0x0000000002F62000-memory.dmp

              Filesize

              200KB

            • memory/1184-70-0x0000000000CA0000-0x0000000001777000-memory.dmp

              Filesize

              10.8MB

            • memory/1184-103-0x0000000002F30000-0x0000000002F62000-memory.dmp

              Filesize

              200KB

            • memory/1184-80-0x0000000000C80000-0x0000000000C81000-memory.dmp

              Filesize

              4KB

            • memory/1184-79-0x0000000000700000-0x0000000000701000-memory.dmp

              Filesize

              4KB

            • memory/1184-81-0x0000000000C90000-0x0000000000C91000-memory.dmp

              Filesize

              4KB

            • memory/1184-83-0x0000000000CA0000-0x0000000001777000-memory.dmp

              Filesize

              10.8MB

            • memory/1184-84-0x0000000002E30000-0x0000000002E31000-memory.dmp

              Filesize

              4KB

            • memory/1184-82-0x0000000002E20000-0x0000000002E21000-memory.dmp

              Filesize

              4KB

            • memory/1184-87-0x0000000002E70000-0x0000000002E71000-memory.dmp

              Filesize

              4KB

            • memory/1184-86-0x0000000002E50000-0x0000000002E51000-memory.dmp

              Filesize

              4KB

            • memory/1184-85-0x0000000002E40000-0x0000000002E41000-memory.dmp

              Filesize

              4KB

            • memory/1184-88-0x0000000002E80000-0x0000000002E81000-memory.dmp

              Filesize

              4KB

            • memory/1184-91-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

              Filesize

              4KB

            • memory/1184-89-0x0000000002E90000-0x0000000002E91000-memory.dmp

              Filesize

              4KB

            • memory/1184-102-0x0000000003090000-0x0000000003190000-memory.dmp

              Filesize

              1024KB

            • memory/1184-90-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

              Filesize

              4KB

            • memory/1184-93-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

              Filesize

              4KB

            • memory/1184-95-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

              Filesize

              4KB

            • memory/1184-94-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

              Filesize

              4KB

            • memory/1184-96-0x0000000002F00000-0x0000000002F01000-memory.dmp

              Filesize

              4KB

            • memory/1184-97-0x0000000002F10000-0x0000000002F11000-memory.dmp

              Filesize

              4KB

            • memory/1184-98-0x0000000002F20000-0x0000000002F21000-memory.dmp

              Filesize

              4KB

            • memory/1184-99-0x0000000000CA0000-0x0000000001777000-memory.dmp

              Filesize

              10.8MB

            • memory/1316-175-0x0000000004D80000-0x0000000005185000-memory.dmp

              Filesize

              4.0MB

            • memory/1316-274-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/1316-243-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/1316-206-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/1316-177-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/1568-384-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

            • memory/1688-43-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/1688-41-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/1688-40-0x0000000000400000-0x0000000000537000-memory.dmp

              Filesize

              1.2MB

            • memory/1732-132-0x00000000054F0000-0x0000000005556000-memory.dmp

              Filesize

              408KB

            • memory/1732-163-0x0000000007320000-0x00000000073B6000-memory.dmp

              Filesize

              600KB

            • memory/1732-171-0x0000000074360000-0x0000000074B10000-memory.dmp

              Filesize

              7.7MB

            • memory/1732-120-0x0000000004580000-0x00000000045B6000-memory.dmp

              Filesize

              216KB

            • memory/1732-121-0x0000000074360000-0x0000000074B10000-memory.dmp

              Filesize

              7.7MB

            • memory/1732-122-0x00000000024C0000-0x00000000024D0000-memory.dmp

              Filesize

              64KB

            • memory/1732-123-0x00000000024C0000-0x00000000024D0000-memory.dmp

              Filesize

              64KB

            • memory/1732-124-0x0000000004BF0000-0x0000000005218000-memory.dmp

              Filesize

              6.2MB

            • memory/1732-125-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

              Filesize

              136KB

            • memory/1732-169-0x0000000007310000-0x0000000007318000-memory.dmp

              Filesize

              32KB

            • memory/1732-126-0x0000000005410000-0x0000000005476000-memory.dmp

              Filesize

              408KB

            • memory/1732-168-0x00000000073C0000-0x00000000073DA000-memory.dmp

              Filesize

              104KB

            • memory/1732-137-0x00000000056A0000-0x00000000059F4000-memory.dmp

              Filesize

              3.3MB

            • memory/1732-138-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

              Filesize

              120KB

            • memory/1732-139-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

              Filesize

              304KB

            • memory/1732-140-0x00000000060D0000-0x0000000006114000-memory.dmp

              Filesize

              272KB

            • memory/1732-166-0x00000000072D0000-0x00000000072E4000-memory.dmp

              Filesize

              80KB

            • memory/1732-142-0x00000000024C0000-0x00000000024D0000-memory.dmp

              Filesize

              64KB

            • memory/1732-143-0x0000000006ED0000-0x0000000006F46000-memory.dmp

              Filesize

              472KB

            • memory/1732-144-0x00000000075D0000-0x0000000007C4A000-memory.dmp

              Filesize

              6.5MB

            • memory/1732-145-0x0000000006F70000-0x0000000006F8A000-memory.dmp

              Filesize

              104KB

            • memory/1732-165-0x00000000072C0000-0x00000000072CE000-memory.dmp

              Filesize

              56KB

            • memory/1732-147-0x000000007FB00000-0x000000007FB10000-memory.dmp

              Filesize

              64KB

            • memory/1732-148-0x0000000007130000-0x0000000007162000-memory.dmp

              Filesize

              200KB

            • memory/1732-149-0x0000000070200000-0x000000007024C000-memory.dmp

              Filesize

              304KB

            • memory/1732-150-0x0000000070380000-0x00000000706D4000-memory.dmp

              Filesize

              3.3MB

            • memory/1732-160-0x0000000007110000-0x000000000712E000-memory.dmp

              Filesize

              120KB

            • memory/1732-161-0x0000000007170000-0x0000000007213000-memory.dmp

              Filesize

              652KB

            • memory/1732-162-0x0000000007260000-0x000000000726A000-memory.dmp

              Filesize

              40KB

            • memory/1732-164-0x0000000007280000-0x0000000007291000-memory.dmp

              Filesize

              68KB

            • memory/2212-1-0x0000000000830000-0x0000000000930000-memory.dmp

              Filesize

              1024KB

            • memory/2212-2-0x0000000002420000-0x000000000242B000-memory.dmp

              Filesize

              44KB

            • memory/2212-3-0x0000000000400000-0x0000000000817000-memory.dmp

              Filesize

              4.1MB

            • memory/2212-5-0x0000000000400000-0x0000000000817000-memory.dmp

              Filesize

              4.1MB

            • memory/2816-146-0x0000000004E80000-0x0000000005279000-memory.dmp

              Filesize

              4.0MB

            • memory/2816-141-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/2816-167-0x0000000005280000-0x0000000005B6B000-memory.dmp

              Filesize

              8.9MB

            • memory/2816-119-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/2816-174-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/2816-117-0x0000000004E80000-0x0000000005279000-memory.dmp

              Filesize

              4.0MB

            • memory/2816-176-0x0000000000400000-0x0000000003118000-memory.dmp

              Filesize

              45.1MB

            • memory/2816-118-0x0000000005280000-0x0000000005B6B000-memory.dmp

              Filesize

              8.9MB

            • memory/2996-63-0x00000000054B0000-0x0000000005542000-memory.dmp

              Filesize

              584KB

            • memory/2996-66-0x0000000073B50000-0x0000000074300000-memory.dmp

              Filesize

              7.7MB

            • memory/2996-59-0x0000000000400000-0x0000000000454000-memory.dmp

              Filesize

              336KB

            • memory/2996-101-0x0000000073B50000-0x0000000074300000-memory.dmp

              Filesize

              7.7MB

            • memory/3040-17-0x0000000004B70000-0x0000000004C8B000-memory.dmp

              Filesize

              1.1MB

            • memory/3040-16-0x0000000004A00000-0x0000000004A9F000-memory.dmp

              Filesize

              636KB

            • memory/3280-4-0x0000000002E60000-0x0000000002E76000-memory.dmp

              Filesize

              88KB

            • memory/3624-56-0x0000000004B50000-0x0000000004B60000-memory.dmp

              Filesize

              64KB

            • memory/3624-49-0x0000000073B50000-0x0000000074300000-memory.dmp

              Filesize

              7.7MB

            • memory/3624-51-0x0000000004A40000-0x0000000004A9C000-memory.dmp

              Filesize

              368KB

            • memory/3624-52-0x0000000004B50000-0x0000000004B60000-memory.dmp

              Filesize

              64KB

            • memory/3624-55-0x0000000005110000-0x000000000516A000-memory.dmp

              Filesize

              360KB

            • memory/3624-54-0x0000000004B60000-0x0000000005104000-memory.dmp

              Filesize

              5.6MB

            • memory/3624-64-0x0000000073B50000-0x0000000074300000-memory.dmp

              Filesize

              7.7MB

            • memory/3624-62-0x0000000002520000-0x0000000004520000-memory.dmp

              Filesize

              32.0MB