Analysis

  • max time kernel
    106s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 03:00

General

  • Target

    ce46c89555525a74ecc82cd2291e6f93427558887c18923eaca699be08a090de.exe

  • Size

    161KB

  • MD5

    bc1d715110d34c705944635aa9d31ea7

  • SHA1

    61fe5b0107489bd36600dae217c3ef6863bfde23

  • SHA256

    ce46c89555525a74ecc82cd2291e6f93427558887c18923eaca699be08a090de

  • SHA512

    d651965d279f22f5f3f57b7d5e4a356f12e67e3a77fa25389bd9abb260bbcd87d7607f89bfa6cccf67c92f97dc9923b171dcd889b5479dad3728ce4ea6b9d824

  • SSDEEP

    3072:QiZUCzGvz/JqhqOeM3JohWsGZ1bRCXfS:Q6UCy/JdgpDZd0

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Detect ZGRat V1 3 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 9 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 7 IoCs
  • Detects executables Discord URL observed in first stage droppers 7 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 7 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 7 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce46c89555525a74ecc82cd2291e6f93427558887c18923eaca699be08a090de.exe
    "C:\Users\Admin\AppData\Local\Temp\ce46c89555525a74ecc82cd2291e6f93427558887c18923eaca699be08a090de.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4588
  • C:\Users\Admin\AppData\Local\Temp\E56E.exe
    C:\Users\Admin\AppData\Local\Temp\E56E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\E56E.exe
      C:\Users\Admin\AppData\Local\Temp\E56E.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\4293000e-4e43-4c2d-a04c-6ae7c45d2264" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1096
      • C:\Users\Admin\AppData\Local\Temp\E56E.exe
        "C:\Users\Admin\AppData\Local\Temp\E56E.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\AppData\Local\Temp\E56E.exe
          "C:\Users\Admin\AppData\Local\Temp\E56E.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:2132
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 568
            5⤵
            • Program crash
            PID:4676
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2132 -ip 2132
    1⤵
      PID:4860
    • C:\Users\Admin\AppData\Local\Temp\BBF9.exe
      C:\Users\Admin\AppData\Local\Temp\BBF9.exe
      1⤵
      • Executes dropped EXE
      PID:1560
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF75.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:5100
      • C:\Users\Admin\AppData\Local\Temp\C755.exe
        C:\Users\Admin\AppData\Local\Temp\C755.exe
        1⤵
        • Executes dropped EXE
        PID:3252
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          2⤵
            PID:2536
          • C:\Users\Admin\AppData\Local\Temp\C755.exe
            "C:\Users\Admin\AppData\Local\Temp\C755.exe"
            2⤵
              PID:2268
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                3⤵
                  PID:1572
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  3⤵
                    PID:4412
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      PID:560
              • C:\Users\Admin\AppData\Local\Temp\E1E3.exe
                C:\Users\Admin\AppData\Local\Temp\E1E3.exe
                1⤵
                • Executes dropped EXE
                PID:3880
              • C:\Users\Admin\AppData\Local\Temp\1EDE.exe
                C:\Users\Admin\AppData\Local\Temp\1EDE.exe
                1⤵
                  PID:2972
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                    2⤵
                      PID:3700
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 428
                        3⤵
                        • Program crash
                        PID:3796
                  • C:\Users\Admin\AppData\Local\Temp\439D.exe
                    C:\Users\Admin\AppData\Local\Temp\439D.exe
                    1⤵
                      PID:4560
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k move Jeffrey Jeffrey.bat & Jeffrey.bat & exit
                        2⤵
                          PID:3224
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1560
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4656
                          • C:\Windows\SysWOW64\dialer.exe
                            "C:\Windows\system32\dialer.exe"
                            1⤵
                              PID:2272
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3700 -ip 3700
                              1⤵
                                PID:4392

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\1EDE.exe

                                Filesize

                                3.2MB

                                MD5

                                4bdddca26964ebf7db04944823b76b22

                                SHA1

                                fc74dd75953341f476feebf6f4e15aed9a38ab12

                                SHA256

                                44db6c5c0c1c681a0a46a14aad0a9338298c1df198160858a633add2ad20acf4

                                SHA512

                                d6833140d952ec5d50bc5ae84e0dac602894deec77c52017ec27bd1ba523269f55ba013c276ae92bdb98aaee07d3528f4868c84dcda6b79dd4aebdf693701d57

                              • C:\Users\Admin\AppData\Local\Temp\1EDE.exe

                                Filesize

                                3.3MB

                                MD5

                                305b03b1affc757d7d694ac1aefa4d7a

                                SHA1

                                8ef5d1b8d96e689e6441ed2dc837df2539728ec4

                                SHA256

                                bc68d05161bca03f8fc6598927984cc2aecc35c8702b205ff46ab33ab8928bb9

                                SHA512

                                49905711ad6031bc714053f0841d71df38dcd8ed2e78f385bc45e1d54a4ff32020efb29f332d3d994ff3fdf6d63e05bacbac76832f5ef651850d1bf1bebfde1c

                              • C:\Users\Admin\AppData\Local\Temp\439D.exe

                                Filesize

                                448KB

                                MD5

                                941922de71ef0175259f4afc6739de4a

                                SHA1

                                9e87a6f8bc0d1a3801fe4764803baa0183b0bb59

                                SHA256

                                381537e181d9c0236af7120b5956a26734b81dfa13454d0de60adc2347f1b38d

                                SHA512

                                a83b3cdda1f8f7f1e86f99f27ae483c0d2d50eec707b69825ec53af0070eaafa880e79a3d62cc488d0e9d3caf898b9ff7e3248552f9e8250932d2a651b6e841c

                              • C:\Users\Admin\AppData\Local\Temp\439D.exe

                                Filesize

                                3.4MB

                                MD5

                                e252be2be6afb746895d560da2699210

                                SHA1

                                05f58f7aba19f5d328c53852d23a71e5366143bb

                                SHA256

                                87d0479906dbddae464d3da737681cfb5ec5b477670ad80e0e6dbe44c8d3c3e1

                                SHA512

                                b40c8d29c8e2aeed5bce282a8dc8e5cfdb27269be6bfd0e7b5df363a1539568227036578760aa7a18d11dfb1cb9ea9edcedf68fbbac6a14f2df1f2701d72cfa6

                              • C:\Users\Admin\AppData\Local\Temp\BBF9.exe

                                Filesize

                                6.7MB

                                MD5

                                74cf066c5c492eb825b36550b1e38326

                                SHA1

                                8f211213fbd6905b5e44bf2af07e481832198a7f

                                SHA256

                                24201da166b3e59a7a2b79f24881222c41e35f26642dd757fcc51ec47c9404e4

                                SHA512

                                24ad3ebb70332741959b13be504ec2b3baee9668bb3a8e8ae314432ac2e084ad11c03f4abfba6f7557273cddb1b3d2e2361c71246f3fd7fccabae218dd8b2e91

                              • C:\Users\Admin\AppData\Local\Temp\BF75.bat

                                Filesize

                                77B

                                MD5

                                55cc761bf3429324e5a0095cab002113

                                SHA1

                                2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                SHA256

                                d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                SHA512

                                33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                              • C:\Users\Admin\AppData\Local\Temp\C755.exe

                                Filesize

                                4.1MB

                                MD5

                                1047d7617f162d488920965b0a8b876c

                                SHA1

                                059afd73ca2f9b7c358979a6f1cc99c5424281a2

                                SHA256

                                58b5bdc3cd4730734032dcc2dde7452889e6b6a12f3ae61e142df1121551859c

                                SHA512

                                698483dca1f3dc3a3056b041a7c70e1609d86dcc4dc9751b04a67810be19c999235372d1a07d5806459f51d513deab91524c6fccd83b554afc331914690b74ac

                              • C:\Users\Admin\AppData\Local\Temp\C755.exe

                                Filesize

                                1.9MB

                                MD5

                                556785c0390c81c38e08e889cfd0485d

                                SHA1

                                3b9962afde889041276ff430548ff02989ec9c6b

                                SHA256

                                1b3bb7aa1e3ec19768b56999110cb50ea42fd19f8304cbb6c5fb320acb1c092e

                                SHA512

                                bb36c058a39c7cdb81f06a308dd521d2e8846c17f56c33c4f7d91636523cc74e61cad0f33915aee15bc6b091bececa3fad19233b98c7d363271bbd7eef777a59

                              • C:\Users\Admin\AppData\Local\Temp\C755.exe

                                Filesize

                                768KB

                                MD5

                                bb197f6eb72e40010025d12ac608ddea

                                SHA1

                                4868b3b545c5caf616af500b6ec529670b0ad24e

                                SHA256

                                1cd1197d6b185a20815b956ccd8823365337b3bdd4cb31c2d98b15cf5d85b42d

                                SHA512

                                ced47870f023791544a0307cbf1389dcb70beee247e37c3ee6b41b31a52b872d3118953f79df688fb6bbb5622d99a31a42308e2ef3f82a2cfc34cbe4c64092ff

                              • C:\Users\Admin\AppData\Local\Temp\E1E3.exe

                                Filesize

                                4.4MB

                                MD5

                                88e2be2a31fa1edbf72d57f197bbeb99

                                SHA1

                                1dadb395d1265a1b7d576c82da9164a07be0f76c

                                SHA256

                                80074ca72e0f554cb8a2dcd0d6998af2f5e3f4915f7fd7afb3ef085210c9f22c

                                SHA512

                                6194ae59bdb357279bc16a2abde5f2c548c215496609fea3cbae1e9ac3be5dbbf5e3009436ddd866fbefd50d8612a0a4dfc3109cdb7c121f66e2e33b7b8a62e7

                              • C:\Users\Admin\AppData\Local\Temp\E1E3.exe

                                Filesize

                                3.9MB

                                MD5

                                e7d666062e3b9ab2df33f7e5d47e4193

                                SHA1

                                45ade9ed13efabdf0fd3251e249809421b8cfa20

                                SHA256

                                744a01db8c79463e2825b8641312febfb3728a2fc431a04ee9c0ccdc42bfaf3b

                                SHA512

                                4d302f31b423da76e98560f3f173ff2cd067c3cbd9695b26a0974d710b23dac104e80439c89c800a2cb6904b031b8ef57261bf9b82457fda39c98f96a49127cd

                              • C:\Users\Admin\AppData\Local\Temp\E56E.exe

                                Filesize

                                709KB

                                MD5

                                b4496d2224777403415440dfe5f13a86

                                SHA1

                                5c175589db78cce01a9730eb85e2898bdafe2a5a

                                SHA256

                                d3d8cacad2d64836340d846fe35f30eb06a02131ff64c2fb0fa8071065058548

                                SHA512

                                0bc9d8844df1fc09815b6226186f095dfe2630b0070999a840a07e458b104d03b2fbb969a56e6d62756fc11e7eecc9d25c3cc4a9a2b7d58ba1d9de1cc60d9158

                              • C:\Users\Admin\AppData\Local\Temp\Jeffrey

                                Filesize

                                15KB

                                MD5

                                e121db542d18a526f078c32fd2583af5

                                SHA1

                                69e677442ccb6d6fe1d2a3029cf44aac473f5f55

                                SHA256

                                fcaf08c62c974ca0fb7537213a7867ab0f9fb41e52dde118b758b7ea05f63ca2

                                SHA512

                                9d8c2bd284a624b68a2fafd93445648f69ffd47374f1d3cfd1857d2951bbc2a6cbe971fdb5e10d5f513dbb5188d59ee8e5715c86e3a1bf23e6df7feec960bebe

                              • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

                                Filesize

                                742KB

                                MD5

                                544cd51a596619b78e9b54b70088307d

                                SHA1

                                4769ddd2dbc1dc44b758964ed0bd231b85880b65

                                SHA256

                                dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

                                SHA512

                                f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21zpgefu.l5o.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • memory/1548-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1548-24-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1548-34-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1548-22-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1548-20-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1560-88-0x0000000003360000-0x0000000003A1B000-memory.dmp

                                Filesize

                                6.7MB

                              • memory/1560-79-0x0000000003150000-0x0000000003151000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-57-0x0000000003030000-0x0000000003031000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-58-0x0000000003040000-0x0000000003041000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-60-0x0000000003050000-0x0000000003051000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-59-0x00000000002F0000-0x0000000000EE3000-memory.dmp

                                Filesize

                                11.9MB

                              • memory/1560-54-0x00000000002F0000-0x0000000000EE3000-memory.dmp

                                Filesize

                                11.9MB

                              • memory/1560-61-0x0000000003060000-0x0000000003061000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-62-0x0000000003070000-0x0000000003071000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-65-0x0000000003090000-0x0000000003091000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-66-0x00000000030A0000-0x00000000030A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-70-0x00000000030C0000-0x00000000030C1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-55-0x0000000001370000-0x0000000001371000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-93-0x00000000002F0000-0x0000000000EE3000-memory.dmp

                                Filesize

                                11.9MB

                              • memory/1560-72-0x00000000030E0000-0x00000000030E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-71-0x00000000030D0000-0x00000000030D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-64-0x0000000003080000-0x0000000003081000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-74-0x0000000003100000-0x0000000003101000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-73-0x00000000030F0000-0x00000000030F1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-75-0x0000000003110000-0x0000000003111000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-76-0x0000000003120000-0x0000000003121000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-77-0x0000000003130000-0x0000000003131000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-78-0x0000000003140000-0x0000000003141000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-56-0x0000000003020000-0x0000000003021000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-80-0x0000000003160000-0x0000000003161000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-81-0x0000000003170000-0x0000000003171000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-82-0x0000000003180000-0x0000000003181000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-83-0x0000000003190000-0x0000000003191000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-84-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-85-0x00000000031B0000-0x00000000031B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1560-89-0x00000000031C0000-0x00000000031F2000-memory.dmp

                                Filesize

                                200KB

                              • memory/1560-92-0x00000000031C0000-0x00000000031F2000-memory.dmp

                                Filesize

                                200KB

                              • memory/1560-90-0x00000000031C0000-0x00000000031F2000-memory.dmp

                                Filesize

                                200KB

                              • memory/1560-91-0x00000000031C0000-0x00000000031F2000-memory.dmp

                                Filesize

                                200KB

                              • memory/1572-238-0x0000000005310000-0x0000000005320000-memory.dmp

                                Filesize

                                64KB

                              • memory/1572-239-0x0000000005310000-0x0000000005320000-memory.dmp

                                Filesize

                                64KB

                              • memory/1572-232-0x0000000006080000-0x00000000063D4000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/1572-249-0x0000000005310000-0x0000000005320000-memory.dmp

                                Filesize

                                64KB

                              • memory/1572-250-0x000000007FB40000-0x000000007FB50000-memory.dmp

                                Filesize

                                64KB

                              • memory/1572-237-0x0000000074430000-0x0000000074BE0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1572-244-0x0000000006840000-0x000000000688C000-memory.dmp

                                Filesize

                                304KB

                              • memory/2132-40-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2132-43-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2132-41-0x0000000000400000-0x0000000000537000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2268-186-0x0000000003F60000-0x000000000435C000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2268-247-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/2268-223-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/2268-226-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/2536-104-0x0000000005A80000-0x00000000060A8000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/2536-157-0x0000000008070000-0x0000000008084000-memory.dmp

                                Filesize

                                80KB

                              • memory/2536-119-0x0000000006550000-0x00000000065B6000-memory.dmp

                                Filesize

                                408KB

                              • memory/2536-120-0x00000000065C0000-0x0000000006914000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/2536-122-0x0000000006990000-0x00000000069DC000-memory.dmp

                                Filesize

                                304KB

                              • memory/2536-121-0x00000000064E0000-0x00000000064FE000-memory.dmp

                                Filesize

                                120KB

                              • memory/2536-123-0x0000000006EA0000-0x0000000006EE4000-memory.dmp

                                Filesize

                                272KB

                              • memory/2536-103-0x0000000003320000-0x0000000003356000-memory.dmp

                                Filesize

                                216KB

                              • memory/2536-125-0x0000000003380000-0x0000000003390000-memory.dmp

                                Filesize

                                64KB

                              • memory/2536-126-0x0000000007C70000-0x0000000007CE6000-memory.dmp

                                Filesize

                                472KB

                              • memory/2536-127-0x0000000008370000-0x00000000089EA000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/2536-128-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

                                Filesize

                                104KB

                              • memory/2536-131-0x00000000702D0000-0x000000007031C000-memory.dmp

                                Filesize

                                304KB

                              • memory/2536-132-0x0000000070450000-0x00000000707A4000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/2536-130-0x0000000007EB0000-0x0000000007EE2000-memory.dmp

                                Filesize

                                200KB

                              • memory/2536-105-0x0000000074430000-0x0000000074BE0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2536-143-0x0000000007EF0000-0x0000000007F93000-memory.dmp

                                Filesize

                                652KB

                              • memory/2536-142-0x0000000007E90000-0x0000000007EAE000-memory.dmp

                                Filesize

                                120KB

                              • memory/2536-144-0x000000007FB10000-0x000000007FB20000-memory.dmp

                                Filesize

                                64KB

                              • memory/2536-145-0x0000000007FE0000-0x0000000007FEA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2536-146-0x00000000080A0000-0x0000000008136000-memory.dmp

                                Filesize

                                600KB

                              • memory/2536-108-0x0000000005A50000-0x0000000005A72000-memory.dmp

                                Filesize

                                136KB

                              • memory/2536-107-0x0000000003380000-0x0000000003390000-memory.dmp

                                Filesize

                                64KB

                              • memory/2536-151-0x0000000008000000-0x0000000008011000-memory.dmp

                                Filesize

                                68KB

                              • memory/2536-106-0x0000000003380000-0x0000000003390000-memory.dmp

                                Filesize

                                64KB

                              • memory/2536-162-0x0000000074430000-0x0000000074BE0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2536-159-0x0000000008140000-0x0000000008148000-memory.dmp

                                Filesize

                                32KB

                              • memory/2536-158-0x0000000008160000-0x000000000817A000-memory.dmp

                                Filesize

                                104KB

                              • memory/2536-156-0x0000000008060000-0x000000000806E000-memory.dmp

                                Filesize

                                56KB

                              • memory/2536-111-0x0000000006250000-0x00000000062B6000-memory.dmp

                                Filesize

                                408KB

                              • memory/2972-154-0x00000000055D0000-0x000000000566C000-memory.dmp

                                Filesize

                                624KB

                              • memory/2972-155-0x0000000003030000-0x0000000003040000-memory.dmp

                                Filesize

                                64KB

                              • memory/2972-152-0x0000000074430000-0x0000000074BE0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2972-153-0x00000000005B0000-0x0000000000D04000-memory.dmp

                                Filesize

                                7.3MB

                              • memory/3176-18-0x0000000003AE0000-0x0000000003B80000-memory.dmp

                                Filesize

                                640KB

                              • memory/3176-19-0x0000000003CC0000-0x0000000003DDB000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/3252-100-0x0000000004350000-0x0000000004C3B000-memory.dmp

                                Filesize

                                8.9MB

                              • memory/3252-165-0x0000000003F40000-0x0000000004345000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/3252-171-0x0000000004350000-0x0000000004C3B000-memory.dmp

                                Filesize

                                8.9MB

                              • memory/3252-168-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/3252-96-0x0000000003F40000-0x0000000004345000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/3252-102-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/3252-101-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/3252-129-0x0000000000400000-0x00000000022EF000-memory.dmp

                                Filesize

                                30.9MB

                              • memory/3496-243-0x00000000005A0000-0x00000000005A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/3496-4-0x00000000024C0000-0x00000000024D6000-memory.dmp

                                Filesize

                                88KB

                              • memory/3700-277-0x0000000000400000-0x000000000046D000-memory.dmp

                                Filesize

                                436KB

                              • memory/3700-293-0x0000000003A40000-0x0000000003E40000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/3700-282-0x0000000000400000-0x000000000046D000-memory.dmp

                                Filesize

                                436KB

                              • memory/3880-124-0x00007FF636880000-0x00007FF6374E2000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/3880-225-0x00007FF636880000-0x00007FF6374E2000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/3880-164-0x00007FF636880000-0x00007FF6374E2000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/3880-246-0x00007FF636880000-0x00007FF6374E2000-memory.dmp

                                Filesize

                                12.4MB

                              • memory/3992-37-0x0000000003BB0000-0x0000000003C4E000-memory.dmp

                                Filesize

                                632KB

                              • memory/4588-1-0x00000000021A0000-0x00000000022A0000-memory.dmp

                                Filesize

                                1024KB

                              • memory/4588-2-0x0000000003C40000-0x0000000003C4B000-memory.dmp

                                Filesize

                                44KB

                              • memory/4588-3-0x0000000000400000-0x0000000001F00000-memory.dmp

                                Filesize

                                27.0MB

                              • memory/4588-5-0x0000000000400000-0x0000000001F00000-memory.dmp

                                Filesize

                                27.0MB

                              • memory/4588-8-0x0000000003C40000-0x0000000003C4B000-memory.dmp

                                Filesize

                                44KB