Analysis

  • max time kernel
    111s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 02:59

General

  • Target

    cc28d7f2d6934af40e9f5ca9acc40179cd2688271ec778556aabfd2638a943e6.exe

  • Size

    161KB

  • MD5

    6b08812a6837ef81f21ddd7dc04aadcb

  • SHA1

    ef9acb2bd522fd21e7ee1bdfd1c6ac6522ee5952

  • SHA256

    cc28d7f2d6934af40e9f5ca9acc40179cd2688271ec778556aabfd2638a943e6

  • SHA512

    51534f2963b483c91eca6bdd8aa04cd2441d9c24dc6da276c057c3137714510a4ddda9a25845890748887f096cc31889093c3389c8219e0a90911d166c2e3e7d

  • SSDEEP

    3072:6iZpyDaHgA6pqu3oHS8rys0iCXlRTmmXR8su4:6qpyMMpWyKpURf

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Detect ZGRat V1 3 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 8 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 6 IoCs
  • Detects executables Discord URL observed in first stage droppers 6 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 6 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 6 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 6 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc28d7f2d6934af40e9f5ca9acc40179cd2688271ec778556aabfd2638a943e6.exe
    "C:\Users\Admin\AppData\Local\Temp\cc28d7f2d6934af40e9f5ca9acc40179cd2688271ec778556aabfd2638a943e6.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1608
  • C:\Users\Admin\AppData\Local\Temp\20B2.exe
    C:\Users\Admin\AppData\Local\Temp\20B2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\20B2.exe
      C:\Users\Admin\AppData\Local\Temp\20B2.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\f096597c-4b64-48a9-83bc-064b7e4e91d5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1408
      • C:\Users\Admin\AppData\Local\Temp\20B2.exe
        "C:\Users\Admin\AppData\Local\Temp\20B2.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4192
        • C:\Users\Admin\AppData\Local\Temp\20B2.exe
          "C:\Users\Admin\AppData\Local\Temp\20B2.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:3996
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 220
            5⤵
            • Program crash
            PID:2556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3996 -ip 3996
    1⤵
      PID:5060
    • C:\Users\Admin\AppData\Local\Temp\F827.exe
      C:\Users\Admin\AppData\Local\Temp\F827.exe
      1⤵
      • Executes dropped EXE
      PID:4244
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FDA7.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:868
      • C:\Users\Admin\AppData\Local\Temp\EDE.exe
        C:\Users\Admin\AppData\Local\Temp\EDE.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:400
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2144
        • C:\Users\Admin\AppData\Local\Temp\EDE.exe
          "C:\Users\Admin\AppData\Local\Temp\EDE.exe"
          2⤵
            PID:1912
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:1232
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                3⤵
                  PID:368
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    PID:464
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                    PID:1656
              • C:\Users\Admin\AppData\Local\Temp\2804.exe
                C:\Users\Admin\AppData\Local\Temp\2804.exe
                1⤵
                • Executes dropped EXE
                PID:1636
              • C:\Users\Admin\AppData\Local\Temp\5976.exe
                C:\Users\Admin\AppData\Local\Temp\5976.exe
                1⤵
                  PID:956
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                    2⤵
                      PID:2604
                  • C:\Users\Admin\AppData\Local\Temp\D926.exe
                    C:\Users\Admin\AppData\Local\Temp\D926.exe
                    1⤵
                      PID:748

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\20B2.exe

                      Filesize

                      709KB

                      MD5

                      b4496d2224777403415440dfe5f13a86

                      SHA1

                      5c175589db78cce01a9730eb85e2898bdafe2a5a

                      SHA256

                      d3d8cacad2d64836340d846fe35f30eb06a02131ff64c2fb0fa8071065058548

                      SHA512

                      0bc9d8844df1fc09815b6226186f095dfe2630b0070999a840a07e458b104d03b2fbb969a56e6d62756fc11e7eecc9d25c3cc4a9a2b7d58ba1d9de1cc60d9158

                    • C:\Users\Admin\AppData\Local\Temp\2804.exe

                      Filesize

                      11.8MB

                      MD5

                      450039a02217c53bd983eaf1fd34505a

                      SHA1

                      930ed58a2f58ca7bf3e39aaee43fb541f1c6eeda

                      SHA256

                      d2eacbc922f248856b860aa7c31476ae4123f97e82cf69760ef216d9dca321f0

                      SHA512

                      cf37a82ea7b64f4633ac82c73feff3f829dda279a7caeac32a4cde7b0f82a43b37f67e620677a87d2eccc0eee6f8d68d0175a086487b2174b4f30b66aa4fb080

                    • C:\Users\Admin\AppData\Local\Temp\2804.exe

                      Filesize

                      11.2MB

                      MD5

                      4735a3ac68ec42c1c11a9da4995c2180

                      SHA1

                      bae8992b04298bdbe4493a3bd4af7bd8ec21df14

                      SHA256

                      c9cfea7d0004b96ce180d794bfd0e5f2930e4ac8d0a417e785816c2205e45d4f

                      SHA512

                      787e3d7bf4c8119bbf4b091d704854106251fbb579d912533cdd7b7404a36adeee0d0cc2e912fe162c41f331824ab7e04eb6689db150844b72afd1b0f3af2abb

                    • C:\Users\Admin\AppData\Local\Temp\5976.exe

                      Filesize

                      1.9MB

                      MD5

                      ac071ac86725eed386b62923d6ef575c

                      SHA1

                      671c44aa53cfb7dac93b616c0ba100aadaf8960a

                      SHA256

                      e0798f8698f42ce4ea28790432187910834816a589bf73e72ab2eb5cf10cabb7

                      SHA512

                      4f91d406e9a9d0d38b9b601a8259b523a681dfad318e5f6ebd4b136ea42f945f3a940e4dba12e46351b9630717207040c6f064a4d7f43ea6712a7ec5af0c7dce

                    • C:\Users\Admin\AppData\Local\Temp\5976.exe

                      Filesize

                      1.8MB

                      MD5

                      41fd57cd82f051d417151de9a8a77ab3

                      SHA1

                      a6e3ad8645ee9985529c72111923a4331007c1d2

                      SHA256

                      838f373d47ca0d141d9140d3e1a8d3cf9a127d8a3b72eea2bbf81e2e397b5fb9

                      SHA512

                      002808d1922789c49dfc72bb4f1a689bda8af9f1031ec8debde8cac37a51a5fe5c38eeb42459a84cdf264e592189fec9b7fba389f55c68f50019e0d18dbe1a05

                    • C:\Users\Admin\AppData\Local\Temp\EDE.exe

                      Filesize

                      4.1MB

                      MD5

                      f0d232748eafdbd8b5785b8103608ccf

                      SHA1

                      4791b04755963ebfa65616a8ad12b9e38ad1ea0e

                      SHA256

                      1eeda2fcb2595e3d68ea8a5ff31f553630a2c80ca7fb77d3251adf34f244610b

                      SHA512

                      e1b63727162cb5d4910cc26306a52d5aae8d5f10280c4f9fe0aac57d0e8ed41ccf2462c935e3fa270467d7887fb12535c9db6861d972e024fe838fabbc61675a

                    • C:\Users\Admin\AppData\Local\Temp\EDE.exe

                      Filesize

                      4.1MB

                      MD5

                      1047d7617f162d488920965b0a8b876c

                      SHA1

                      059afd73ca2f9b7c358979a6f1cc99c5424281a2

                      SHA256

                      58b5bdc3cd4730734032dcc2dde7452889e6b6a12f3ae61e142df1121551859c

                      SHA512

                      698483dca1f3dc3a3056b041a7c70e1609d86dcc4dc9751b04a67810be19c999235372d1a07d5806459f51d513deab91524c6fccd83b554afc331914690b74ac

                    • C:\Users\Admin\AppData\Local\Temp\F827.exe

                      Filesize

                      1.8MB

                      MD5

                      f4c95e8b32a74bdbcd80c93303500a02

                      SHA1

                      5829be3e40b0acebacfbcff159fb45b276ade18d

                      SHA256

                      8c7203c100d21d8999b550842fa9781e7880a8f280b2e7e1a3f06d4dda1f445c

                      SHA512

                      57fc6efe23fa5cf22e591c93937ea56032b6dcef5a76d01008acdfc850bc4d68d301ee549979645da89e0d29b12a7fc5d059b0b2da1af94bce8e06c6f7a9c9ae

                    • C:\Users\Admin\AppData\Local\Temp\F827.exe

                      Filesize

                      3.8MB

                      MD5

                      64d4166bb79888a6ee896a501721bf07

                      SHA1

                      732272b92adfa014413ca5399f0ecd8468241f7b

                      SHA256

                      d5c75cd09e1cb7dd4719bd090d01a54495ead059414327add91beb2b1760c7d6

                      SHA512

                      9f77a869bc664a8189371d6ef28853a0b4ced424e5cfaca0884a53f7b4ada0c88c181487ccef4da73473ad1cb11ca78da2aa8e131fb772148e1e5a74b4c484d0

                    • C:\Users\Admin\AppData\Local\Temp\FDA7.bat

                      Filesize

                      77B

                      MD5

                      55cc761bf3429324e5a0095cab002113

                      SHA1

                      2cc1ef4542a4e92d4158ab3978425d517fafd16d

                      SHA256

                      d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                      SHA512

                      33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                    • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

                      Filesize

                      742KB

                      MD5

                      544cd51a596619b78e9b54b70088307d

                      SHA1

                      4769ddd2dbc1dc44b758964ed0bd231b85880b65

                      SHA256

                      dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                      SHA512

                      f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bybfl1le.340.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      3d086a433708053f9bf9523e1d87a4e8

                      SHA1

                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                      SHA256

                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                      SHA512

                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      8a52ee0c318f634098f62182691cac7f

                      SHA1

                      04c9d0e4ceb08ffa6e90bc8f5c8dd8a394ee85eb

                      SHA256

                      a1a001c1ca40eaa3a00cb5d39e94faf4e7a706cbc7bf535222776c0244b0633d

                      SHA512

                      e0c1b03c7bd6163f5f068043594d454c8e557b9ba57d0823d8d8175a1f2c4305315b6068b09d09d5fde4fe86601d007a177b4dcaaf0aeb7184ee171ae2e42be4

                    • memory/400-101-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/400-95-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/400-94-0x00000000043A0000-0x0000000004C8B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/400-167-0x00000000043A0000-0x0000000004C8B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/400-162-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/400-164-0x0000000003F90000-0x0000000004397000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/400-93-0x0000000003F90000-0x0000000004397000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/956-150-0x0000000005C10000-0x0000000005C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/956-146-0x0000000074170000-0x0000000074920000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/956-148-0x0000000000C20000-0x0000000001374000-memory.dmp

                      Filesize

                      7.3MB

                    • memory/956-149-0x0000000005C30000-0x0000000005CCC000-memory.dmp

                      Filesize

                      624KB

                    • memory/1180-17-0x0000000003BF0000-0x0000000003C89000-memory.dmp

                      Filesize

                      612KB

                    • memory/1180-18-0x0000000003C90000-0x0000000003DAB000-memory.dmp

                      Filesize

                      1.1MB

                    • memory/1232-188-0x00000000709F0000-0x0000000070D44000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1232-198-0x0000000007610000-0x00000000076B3000-memory.dmp

                      Filesize

                      652KB

                    • memory/1232-187-0x00000000749F0000-0x0000000074A3C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1232-186-0x0000000002E40000-0x0000000002E50000-memory.dmp

                      Filesize

                      64KB

                    • memory/1232-180-0x0000000005DF0000-0x0000000006144000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1232-172-0x0000000074170000-0x0000000074920000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1232-174-0x0000000002E40000-0x0000000002E50000-memory.dmp

                      Filesize

                      64KB

                    • memory/1232-173-0x0000000002E40000-0x0000000002E50000-memory.dmp

                      Filesize

                      64KB

                    • memory/1608-5-0x0000000000400000-0x0000000001F00000-memory.dmp

                      Filesize

                      27.0MB

                    • memory/1608-1-0x0000000002110000-0x0000000002210000-memory.dmp

                      Filesize

                      1024KB

                    • memory/1608-3-0x0000000000400000-0x0000000001F00000-memory.dmp

                      Filesize

                      27.0MB

                    • memory/1608-2-0x00000000020A0000-0x00000000020AB000-memory.dmp

                      Filesize

                      44KB

                    • memory/1636-170-0x00007FF6CE720000-0x00007FF6CF382000-memory.dmp

                      Filesize

                      12.4MB

                    • memory/1636-127-0x00007FF6CE720000-0x00007FF6CF382000-memory.dmp

                      Filesize

                      12.4MB

                    • memory/1636-163-0x00007FF6CE720000-0x00007FF6CF382000-memory.dmp

                      Filesize

                      12.4MB

                    • memory/1636-202-0x00007FF6CE720000-0x00007FF6CF382000-memory.dmp

                      Filesize

                      12.4MB

                    • memory/1912-171-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/1912-169-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/1912-168-0x0000000004190000-0x0000000004589000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1912-203-0x0000000000400000-0x00000000022EF000-memory.dmp

                      Filesize

                      30.9MB

                    • memory/2144-157-0x0000000007530000-0x0000000007538000-memory.dmp

                      Filesize

                      32KB

                    • memory/2144-147-0x0000000007370000-0x0000000007413000-memory.dmp

                      Filesize

                      652KB

                    • memory/2144-160-0x0000000074170000-0x0000000074920000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2144-156-0x00000000075E0000-0x00000000075FA000-memory.dmp

                      Filesize

                      104KB

                    • memory/2144-155-0x00000000074F0000-0x0000000007504000-memory.dmp

                      Filesize

                      80KB

                    • memory/2144-154-0x00000000074E0000-0x00000000074EE000-memory.dmp

                      Filesize

                      56KB

                    • memory/2144-153-0x00000000074A0000-0x00000000074B1000-memory.dmp

                      Filesize

                      68KB

                    • memory/2144-152-0x0000000007540000-0x00000000075D6000-memory.dmp

                      Filesize

                      600KB

                    • memory/2144-151-0x0000000007460000-0x000000000746A000-memory.dmp

                      Filesize

                      40KB

                    • memory/2144-131-0x00000000749F0000-0x0000000074A3C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2144-134-0x000000007EFD0000-0x000000007EFE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2144-145-0x0000000007310000-0x000000000732E000-memory.dmp

                      Filesize

                      120KB

                    • memory/2144-135-0x00000000704C0000-0x0000000070814000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2144-102-0x0000000002450000-0x0000000002486000-memory.dmp

                      Filesize

                      216KB

                    • memory/2144-129-0x0000000007330000-0x0000000007362000-memory.dmp

                      Filesize

                      200KB

                    • memory/2144-104-0x0000000074170000-0x0000000074920000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/2144-103-0x0000000005040000-0x0000000005668000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/2144-105-0x0000000002930000-0x0000000002940000-memory.dmp

                      Filesize

                      64KB

                    • memory/2144-106-0x0000000002930000-0x0000000002940000-memory.dmp

                      Filesize

                      64KB

                    • memory/2144-107-0x0000000004EF0000-0x0000000004F12000-memory.dmp

                      Filesize

                      136KB

                    • memory/2144-108-0x00000000056E0000-0x0000000005746000-memory.dmp

                      Filesize

                      408KB

                    • memory/2144-109-0x0000000005750000-0x00000000057B6000-memory.dmp

                      Filesize

                      408KB

                    • memory/2144-126-0x0000000007180000-0x000000000719A000-memory.dmp

                      Filesize

                      104KB

                    • memory/2144-119-0x0000000005920000-0x0000000005C74000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2144-120-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

                      Filesize

                      120KB

                    • memory/2144-121-0x00000000062D0000-0x000000000631C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2144-122-0x0000000006DC0000-0x0000000006E04000-memory.dmp

                      Filesize

                      272KB

                    • memory/2144-123-0x0000000002930000-0x0000000002940000-memory.dmp

                      Filesize

                      64KB

                    • memory/2144-124-0x0000000006ED0000-0x0000000006F46000-memory.dmp

                      Filesize

                      472KB

                    • memory/2144-125-0x0000000007800000-0x0000000007E7A000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/2604-234-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/2604-229-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/3424-4-0x0000000000A80000-0x0000000000A96000-memory.dmp

                      Filesize

                      88KB

                    • memory/3648-21-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3648-33-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3648-22-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3648-19-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3648-23-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3996-40-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3996-42-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/3996-39-0x0000000000400000-0x0000000000537000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4192-36-0x00000000021F0000-0x0000000002287000-memory.dmp

                      Filesize

                      604KB

                    • memory/4244-71-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-84-0x0000000003040000-0x0000000003072000-memory.dmp

                      Filesize

                      200KB

                    • memory/4244-76-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-55-0x0000000000170000-0x0000000000D63000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4244-70-0x0000000002F90000-0x0000000002F91000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-86-0x0000000003040000-0x0000000003072000-memory.dmp

                      Filesize

                      200KB

                    • memory/4244-87-0x0000000003040000-0x0000000003072000-memory.dmp

                      Filesize

                      200KB

                    • memory/4244-69-0x0000000002F80000-0x0000000002F81000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-53-0x0000000001250000-0x0000000001251000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-67-0x0000000002F60000-0x0000000002F61000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-96-0x0000000000170000-0x0000000000D63000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4244-75-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-73-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-74-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-72-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-78-0x0000000003010000-0x0000000003011000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-54-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-77-0x0000000003000000-0x0000000003001000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-85-0x0000000003040000-0x0000000003072000-memory.dmp

                      Filesize

                      200KB

                    • memory/4244-68-0x0000000002F70000-0x0000000002F71000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-66-0x0000000002F50000-0x0000000002F51000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-65-0x0000000002F40000-0x0000000002F41000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-64-0x0000000002F30000-0x0000000002F31000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-63-0x0000000002F10000-0x0000000002F11000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-59-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-62-0x0000000002F00000-0x0000000002F01000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-61-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-60-0x0000000000170000-0x0000000000D63000-memory.dmp

                      Filesize

                      11.9MB

                    • memory/4244-58-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-79-0x0000000003020000-0x0000000003021000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-57-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-56-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4244-83-0x00000000031D0000-0x0000000003210000-memory.dmp

                      Filesize

                      256KB

                    • memory/4244-80-0x0000000003030000-0x0000000003031000-memory.dmp

                      Filesize

                      4KB