gozi | 866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a

Analysis

max time kernel
150s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
30-05-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easfawefawfas.exe
Size

12KB
MD5

2813b6e3ed4bd6b14c53e3dffcdff21d
SHA1

5ac7c7a3dadde70f94810c608a2eb275f14b7bde
SHA256

866c0294731f195b0b9efa4f9b7cac352e8de5121f63a458a75efed3a625d24a
SHA512

ff2454992a5fbe5c8cfab149ebd5edaa089ab4f25b88a47c5da0348575a72f1de372c8e762f74f284070a7a2e1209202ca755b4c08dd99799ac5bb9a598e0a24
SSDEEP

192:LsNqFnJvOXdub8t6QP+TXVKTl1hAKje2Ecp0Gun8JZcxZQF:LsNvuI6QIKTHhA8rt0nnicxo

Score

10^/10

gozi banker isfb spyware stealer trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Executes dropped EXE 1 IoCs

Processes:

s2kp3rpm.exe

pid process

4824 s2kp3rpm.exe
Loads dropped DLL 1 IoCs

Processes:

easfawefawfas.exe

pid process

2124 easfawefawfas.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

6 discord.com
8 discord.com
9 discord.com
1 raw.githubusercontent.com
3 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3324 schtasks.exe

pid	process
4824	s2kp3rpm.exe

flow	ioc
6	discord.com
8	discord.com
9	discord.com
1	raw.githubusercontent.com
3	raw.githubusercontent.com

pid	process
3324	schtasks.exe

Modifies registry class 7 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\consoleitaly1826.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\ms-settings\shell\open	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

easfawefawfas.exes2kp3rpm.exe

pid	process
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
4824	s2kp3rpm.exe
4824	s2kp3rpm.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe
2124	easfawefawfas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

easfawefawfas.exes2kp3rpm.exe

description pid process

Token: SeDebugPrivilege 2124 easfawefawfas.exe
Token: SeDebugPrivilege 4824 s2kp3rpm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

easfawefawfas.exe

pid process

2124 easfawefawfas.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3296 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2124	easfawefawfas.exe
Token: SeDebugPrivilege	4824	s2kp3rpm.exe

pid	process
3296	Explorer.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

easfawefawfas.execmd.exeComputerDefaults.exewscript.execmd.exes2kp3rpm.exe

description	pid	process	target process
PID 2124 wrote to memory of 4428	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 4428	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 4428	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 2092	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 2092	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 2092	2124	easfawefawfas.exe	reg.exe
PID 2124 wrote to memory of 3204	2124	easfawefawfas.exe	cmd.exe
PID 2124 wrote to memory of 3204	2124	easfawefawfas.exe	cmd.exe
PID 2124 wrote to memory of 3204	2124	easfawefawfas.exe	cmd.exe
PID 3204 wrote to memory of 2968	3204	cmd.exe	ComputerDefaults.exe
PID 3204 wrote to memory of 2968	3204	cmd.exe	ComputerDefaults.exe
PID 3204 wrote to memory of 2968	3204	cmd.exe	ComputerDefaults.exe
PID 2968 wrote to memory of 4352	2968	ComputerDefaults.exe	wscript.exe
PID 2968 wrote to memory of 4352	2968	ComputerDefaults.exe	wscript.exe
PID 2968 wrote to memory of 4352	2968	ComputerDefaults.exe	wscript.exe
PID 4352 wrote to memory of 1568	4352	wscript.exe	cmd.exe
PID 4352 wrote to memory of 1568	4352	wscript.exe	cmd.exe
PID 4352 wrote to memory of 1568	4352	wscript.exe	cmd.exe
PID 2124 wrote to memory of 956	2124	easfawefawfas.exe	cmd.exe
PID 2124 wrote to memory of 956	2124	easfawefawfas.exe	cmd.exe
PID 2124 wrote to memory of 956	2124	easfawefawfas.exe	cmd.exe
PID 956 wrote to memory of 3324	956	cmd.exe	schtasks.exe
PID 956 wrote to memory of 3324	956	cmd.exe	schtasks.exe
PID 956 wrote to memory of 3324	956	cmd.exe	schtasks.exe
PID 2124 wrote to memory of 4824	2124	easfawefawfas.exe	s2kp3rpm.exe
PID 2124 wrote to memory of 4824	2124	easfawefawfas.exe	s2kp3rpm.exe
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE
PID 4824 wrote to memory of 3296	4824	s2kp3rpm.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3296
- C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe
  "C:\Users\Admin\AppData\Local\Temp\easfawefawfas.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs" /f
    3⤵
    - Modifies registry class
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
    3⤵
    - Modifies registry class
    PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C computerdefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      computerdefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\SysWOW64\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC ONLOGON /TN AVGUpdateService_gKwwuP9Gdga87vtVr050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\gKwwuP9Gdga87vtVr050MX.exe" /RL HIGHEST /IT
      4⤵
      Creates scheduled task(s)
      PID:3324
- - C:\Users\Admin\AppData\Local\Temp\s2kp3rpm.exe
    "C:\Users\Admin\AppData\Local\Temp\s2kp3rpm.exe" explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\402ba88b45bc47da937774a71d718bf8

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\622fc803f81f415d89631879dc6b2592

Filesize
78KB

MD5
8bd62e9587c5ce91d7aeb228d1dc6e15

SHA1
eeea4947184719c8420208f100d0b0d7dc15a162

SHA256
e7b3fb5699f8937ceccb513e3b9279b2d873a07555e223704567672c48a13d8a

SHA512
422d9417ec49e32325c80fc92265715fd1cfaaae7cf49e816f6320441fbf35239a1bdf2e5990aa59530281779cdbc0b3df10e6c2cf1ee884d1150a53fc901762

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c553c92224744839b25c412c75801ac2

Filesize
8KB

MD5
79fce06a6df43322bcd79f8d87e6bafa

SHA1
e316b493127387954148674442ef9b4a4d3bd3fd

SHA256
a2ba96eb4a75792785f997318a8928479336fb9643863af629eeb42f8f6c448a

SHA512
2a3b2fad7633b45295a0854dfffbf9c275a7d0b7ed85252e2cf126e42c278f08a4e3523a535b56313eb1499aef44e5ae0193c0ff95bcc37a09e95d826a347b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\consoleitaly1826.vbs

Filesize
171B

MD5
a34267102c21aff46aecc85598924544

SHA1
77268af47c6a4b9c6be7f7487b2c9b233d49d435

SHA256
eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

SHA512
5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\s2kp3rpm.exe

Filesize
124KB

MD5
e898826598a138f86f2aa80c0830707a

SHA1
1e912a5671f7786cc077f83146a0484e5a78729c

SHA256
df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

SHA512
6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1B7GHIZ90\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1B7GHIZ90\LOG

Filesize
329B

MD5
85a99259686d896afdfb3bebcecc8508

SHA1
502c74806024e6788b8bd2bfa471f158332ad759

SHA256
37c53ef335e42c2b4f6c2ea37b17ff6a0e9a7124c08b9e4355e91c06a2657a97

SHA512
864e35e0fca35c98e1be2c3538f1d83fb1a475d478af184c6d254ae0ddaac84c07021046c5b50761521339d21b36357a2737d7e447120083171f2daddc9e1aae

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1B7GHIZ90\LOG.old

Filesize
291B

MD5
bd33e6b6f9353a8da1abbb253502ab36

SHA1
620f7401a3b48e97902ef5450d68809bc65f1471

SHA256
089f5e67ed2e1a8bff2212db81700bcff57f5c03edfa7f77dc501f6c40dc577f

SHA512
72b3304a127f282de8938326237cf5b2de820c29110dd29289080933989455df919aa930deb384a0bfb60a22f67ff6268cc54e55f0aa9531d8115d5e87d07477

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1B7GHIZ90\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1JDYY48F2\pz5zwzp5.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Filesize
32KB

MD5
b7c14ec6110fa820ca6b65f5aec85911

SHA1
608eeb7488042453c9ca40f7e1398fc1a270f3f4

SHA256
fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb

SHA512
d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a1JDYY48F2\pz5zwzp5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Filesize
48KB

MD5
848e5ff5563663fd2af1aee57ed16df3

SHA1
1165c673b006747f5a3e23f831c14ebd600fd334

SHA256
58721962f8dec245a359148571d90555c8cf66e381e930f192c9297e4efd1d6f

SHA512
1ce4379a848acd13e56cf924b8379f6f43df87406b92855222b24d2a5a62a3bb669d18e1b387b298283d0a14967093551349dee3c6334db718bdd61b98acd68d

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a8E8UMBIXV\LOG

Filesize
331B

MD5
d7d6a19d00ce9c3876520f6966894459

SHA1
1b00873d0ee8b9cb24b6d9c43560255ec028105b

SHA256
042fb5371cfb2364adb0aaec1f883a6f335749ea7ec639332754fbdce707ad05

SHA512
c0571a1ed8f8045b3637d3d960edeabde4f1edb8caeb0962edaded1ea3764b3ebfc5db1d2398c1aae6e22c581fc0a200133ee1f9f3d1a6306f7d6386d4c7492b

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a8E8UMBIXV\LOG.old

Filesize
293B

MD5
94d446482af890a625c6219c276b2de9

SHA1
1a8dad85fd435db43dc3cbb37d3ee49e9154f4d1

SHA256
8b6083b5b593df2258ac8552691b56442ede2086fc61ca36f50118f0d00ef5a4

SHA512
e770d5e545bd26e1ac3d621db86036c6c235079ae559815730d4a81877a9de0c6b5bb57009703c7f7d3ca7e9ccb56d0e805988ad8aaa851bda7f3eceaba14bcc

Download Submit
memory/2124-13-0x00000000126B0000-0x0000000013352000-memory.dmp

Filesize
12.6MB

Download
memory/2124-187-0x0000000009040000-0x0000000009090000-memory.dmp

Filesize
320KB

Download
memory/2124-1-0x0000000000BF0000-0x0000000000BFC000-memory.dmp

Filesize
48KB

Download
memory/2124-210-0x00000000097A0000-0x00000000097AA000-memory.dmp

Filesize
40KB

Download
memory/2124-2-0x0000000004B70000-0x0000000004B8A000-memory.dmp

Filesize
104KB

Download
memory/2124-39-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/2124-41-0x000000000A2D0000-0x000000000A336000-memory.dmp

Filesize
408KB

Download
memory/2124-40-0x000000000A150000-0x000000000A15A000-memory.dmp

Filesize
40KB

Download
memory/2124-3-0x0000000000D20000-0x0000000000D2A000-memory.dmp

Filesize
40KB

Download
memory/2124-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Filesize
4KB

Download
memory/2124-93-0x000000000A2A0000-0x000000000A2AC000-memory.dmp

Filesize
48KB

Download
memory/2124-94-0x000000000A2C0000-0x000000000A2C8000-memory.dmp

Filesize
32KB

Download
memory/2124-12-0x000000000A920000-0x000000000B520000-memory.dmp

Filesize
12.0MB

Download
memory/2124-11-0x0000000074AD0000-0x0000000075281000-memory.dmp

Filesize
7.7MB

Download
memory/2124-10-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Filesize
4KB

Download
memory/2124-6-0x0000000074AD0000-0x0000000075281000-memory.dmp

Filesize
7.7MB

Download
memory/2124-5-0x0000000005330000-0x00000000058D6000-memory.dmp

Filesize
5.6MB

Download
memory/2124-4-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/2124-182-0x0000000008DA0000-0x0000000008E52000-memory.dmp

Filesize
712KB

Download
memory/2124-183-0x0000000008EC0000-0x0000000008EE2000-memory.dmp

Filesize
136KB

Download
memory/2124-184-0x0000000008F70000-0x0000000008FE6000-memory.dmp

Filesize
472KB

Download
memory/2124-185-0x0000000008F10000-0x0000000008F2E000-memory.dmp

Filesize
120KB

Download
memory/2124-195-0x00000000096F0000-0x0000000009711000-memory.dmp

Filesize
132KB

Download
memory/2124-188-0x0000000009290000-0x00000000092FA000-memory.dmp

Filesize
424KB

Download
memory/2124-189-0x0000000009300000-0x0000000009657000-memory.dmp

Filesize
3.3MB

Download
memory/2124-190-0x0000000009660000-0x00000000096AC000-memory.dmp

Filesize
304KB

Download
memory/2124-194-0x0000000009730000-0x000000000976C000-memory.dmp

Filesize
240KB

Download
memory/3296-29-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/3296-28-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/3296-33-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/3296-32-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/3296-30-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download