Analysis

  • max time kernel
    1795s
  • max time network
    1800s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 14:40

General

  • Target

    shtorm_sb.exe

  • Size

    238KB

  • MD5

    2faf13feda202796051c439b5abd8d48

  • SHA1

    5c2d1f4be4f7dcef2f5577a15ea3f31c59ddbe8b

  • SHA256

    cde6b414622136dd14a5a025f6d8fe2313c36a347086fceb168b5dff1a6c288b

  • SHA512

    dd46a3f553ff3bf0a39b8f4132d1053ac1758b2befb8a1b096455bd7812f2bcaf29fc9dcf00ef0bb972b4c27e47cc2b347f3fe4e58bab7708be1855fd7bdf2b9

  • SSDEEP

    1536:tDeWitn1NIohnWQoJ0GSbhdp2QfV9XBqn6MHxOwz3i+7BanqY5DW1T:VePbVnhuSbvppn8ROwzrirDcT

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:13244

close-material.gl.at.ply.gg:13244

Attributes
  • Install_directory

    %AppData%

  • install_file

    svсhost.exe

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Xworm Payload 18 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\shtorm_sb.exe
    "C:\Users\Admin\AppData\Local\Temp\shtorm_sb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\shtorm_sb.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'shtorm_sb.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svсhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svсhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svсhost" /tr "C:\Users\Admin\AppData\Roaming\svсhost.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:840
    • C:\Users\Admin\AppData\Local\Temp\ycbjdh.exe
      "C:\Users\Admin\AppData\Local\Temp\ycbjdh.exe"
      2⤵
      • Executes dropped EXE
      PID:2272
    • C:\Users\Admin\AppData\Local\Temp\qvoafb.exe
      "C:\Users\Admin\AppData\Local\Temp\qvoafb.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:296
      • C:\Windows\mssessionbroker.exe
        "C:\Windows\mssessionbroker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:740
      • C:\Users\Admin\AppData\Local\Temp\(DL) Nivea-Man.exe
        "C:\Users\Admin\AppData\Local\Temp\(DL) Nivea-Man.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Users\Admin\AppData\Local\Temp\7427.tmp\(DL) Nivea-Man.exe
          "C:\Users\Admin\AppData\Local\Temp\7427.tmp\(DL) Nivea-Man.exe" -window_title "(DL) Nivea-Man" "C:\Users\Admin\AppData\Local\Temp\7427.tmp\(DL) Nivea-Man"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3044
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {A15E35D5-E14A-445F-AC3C-C470C92FAE13} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2128
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1648
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:280
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1284
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1780
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1356
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:864
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:680
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2276
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3024
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1068
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2796
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:960
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:652
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1028
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1728
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2272
    • C:\Users\Admin\AppData\Roaming\svсhost.exe
      C:\Users\Admin\AppData\Roaming\svсhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3016
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x508
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7427.tmp\(DL) Nivea-Man

    Filesize

    3.6MB

    MD5

    89fcf4c656705a2596d335313c6c2ce6

    SHA1

    1b449658ce64f51e9490678b50056c1247e8c1e6

    SHA256

    d9740cf98cd90d309f6c416de11116821e98932f5aa4e3f0caffd8deac298d97

    SHA512

    70d658a96249bec692dbbce76fb7d8c2e42a2499954402231121f1786b8c5d129d154f4e2f9058a29b107623d648ff10f8f51f690f15db90ae82a48e3a357851

  • C:\Users\Admin\AppData\Local\Temp\qvoafb.exe

    Filesize

    29.8MB

    MD5

    6e272b8474169998bc3f0ec4478e0171

    SHA1

    713ad762decb0d2e2994c79f2795fd38352b2ea6

    SHA256

    9c92031bc960410a3207e53c6223d60d2d6f08c1c6be7d2ab5581612ff478888

    SHA512

    676ee151d8b6b7fe313bb0efe60b615fc27ee065faef22d6f09fb9f26c2054cb8b0d02c0aadfb6e42ba86c3ad5c8b36429069c77eee99fe04d86b1cca1acf506

  • C:\Users\Admin\AppData\Local\Temp\ycbjdh.exe

    Filesize

    439KB

    MD5

    df2f4fe97492b1655354f2727648e083

    SHA1

    2d1835c7f35b04056a2f36412ca2ba398dcc4661

    SHA256

    7e1d01a3daa51e2a19e78890912a44fd0aa1446582531cc897771c675046f83d

    SHA512

    b53c369c7df267e0980e12dbfbea76b35069a192017bc5e8487a2500ac1e591b1a6857392bda47f57c1b2e565af1448c5f5f6cd8c4f693c780a415c701048e2c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R2OFUKY2SGCDCR6PLVS5.temp

    Filesize

    7KB

    MD5

    ada4259560f6f01796eed495958c6778

    SHA1

    b4d3d669998f23bcfd29edd86c8086924618760b

    SHA256

    b85ac37a4811a0191b73c652a5fedf10ae53aa84973577f81aa77fe07e3fa878

    SHA512

    24d7c51142158e6d38df69e97ba8c7dbbdd7ab0fe07f269d26dafcc18fae90003a627570b23354bae6891482a73217989fd91c3f399720fbc879fee4a06b0a7c

  • C:\Users\Admin\AppData\Roaming\svсhost.exe

    Filesize

    238KB

    MD5

    2faf13feda202796051c439b5abd8d48

    SHA1

    5c2d1f4be4f7dcef2f5577a15ea3f31c59ddbe8b

    SHA256

    cde6b414622136dd14a5a025f6d8fe2313c36a347086fceb168b5dff1a6c288b

    SHA512

    dd46a3f553ff3bf0a39b8f4132d1053ac1758b2befb8a1b096455bd7812f2bcaf29fc9dcf00ef0bb972b4c27e47cc2b347f3fe4e58bab7708be1855fd7bdf2b9

  • C:\Windows\mssessionbroker.exe

    Filesize

    3.2MB

    MD5

    92a5e51542295394c53461b13e665c43

    SHA1

    a08c4add16ed45d29438e738f7596bf49515158b

    SHA256

    9a2840d13c3c8084fea89ebd5ab0db184f6133369ce2f84f3759bf9a2594bca9

    SHA512

    203d4d81e05729d24422f96bc6ddea249d3f3a5779580a46d40b705b63f2aa3a3f51e5100af871b35c52f455611e2e0dcdd8eb7671bc066b3452ef0e440813bd

  • \??\PIPE\srvsvc

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\AppData\Local\Temp\(DL) Nivea-Man.exe

    Filesize

    26.4MB

    MD5

    a93dbfca3fd421c8c41d7c30b330533e

    SHA1

    d69b2f10f6dc9a1a784d3bab2d88a77fa2ab4cc1

    SHA256

    09461701c82c17bc4e0c168ddc67d1ec17a3d1bb58a727bc0444e116261e1432

    SHA512

    b7ce11d658a215b40f3440515b97e755341c2ae6867f5d4a290ef865d05d79e5f527dd55ccdb5b14f41c3512c997865127685b84a615138899f752e4001cb297

  • \Users\Admin\AppData\Local\Temp\7427.tmp\(DL) Nivea-Man.exe

    Filesize

    45.9MB

    MD5

    79786ad55686b649dc45f84fbce344be

    SHA1

    0bb8bc9ebcde6f093a1a41f71c7bd7a21ee3b406

    SHA256

    9ffb6d0a907fc8fde590301ad78fa7aca2dc9372066e2eb62b08bcc58f0d2ae4

    SHA512

    9358156124fd65351960e2a1034e547fbc0ab1403824702f198213c017c7626c890ab54008531484866eb1f745e1ef8f0e6eaede7869039768983aa90ef3221a

  • memory/296-68-0x0000000000400000-0x00000000021CF000-memory.dmp

    Filesize

    29.8MB

  • memory/652-237-0x00000000002C0000-0x0000000000302000-memory.dmp

    Filesize

    264KB

  • memory/680-169-0x0000000000EB0000-0x0000000000EF2000-memory.dmp

    Filesize

    264KB

  • memory/740-69-0x00000000004D0000-0x00000000004DE000-memory.dmp

    Filesize

    56KB

  • memory/740-58-0x0000000000830000-0x0000000000B6A000-memory.dmp

    Filesize

    3.2MB

  • memory/740-70-0x00000000004E0000-0x00000000004EE000-memory.dmp

    Filesize

    56KB

  • memory/960-215-0x0000000001080000-0x00000000010C2000-memory.dmp

    Filesize

    264KB

  • memory/1028-245-0x0000000001130000-0x0000000001172000-memory.dmp

    Filesize

    264KB

  • memory/1068-192-0x0000000001340000-0x0000000001382000-memory.dmp

    Filesize

    264KB

  • memory/1356-154-0x0000000000930000-0x0000000000972000-memory.dmp

    Filesize

    264KB

  • memory/1648-37-0x0000000001380000-0x00000000013C2000-memory.dmp

    Filesize

    264KB

  • memory/1728-267-0x00000000001D0000-0x0000000000212000-memory.dmp

    Filesize

    264KB

  • memory/1780-123-0x0000000000390000-0x00000000003D2000-memory.dmp

    Filesize

    264KB

  • memory/2128-33-0x0000000001110000-0x0000000001152000-memory.dmp

    Filesize

    264KB

  • memory/2208-131-0x0000000000BF0000-0x0000000000C32000-memory.dmp

    Filesize

    264KB

  • memory/2272-109-0x0000000001000000-0x000000000109D000-memory.dmp

    Filesize

    628KB

  • memory/2272-44-0x0000000001000000-0x000000000109D000-memory.dmp

    Filesize

    628KB

  • memory/2272-88-0x0000000001000000-0x000000000109D000-memory.dmp

    Filesize

    628KB

  • memory/2372-1-0x00000000008B0000-0x00000000008F2000-memory.dmp

    Filesize

    264KB

  • memory/2372-29-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2372-0-0x000007FEF5563000-0x000007FEF5564000-memory.dmp

    Filesize

    4KB

  • memory/2372-35-0x0000000002300000-0x000000000230C000-memory.dmp

    Filesize

    48KB

  • memory/2372-28-0x000007FEF5563000-0x000007FEF5564000-memory.dmp

    Filesize

    4KB

  • memory/2372-2-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2440-147-0x0000000000890000-0x00000000008D2000-memory.dmp

    Filesize

    264KB

  • memory/2580-14-0x000000001B760000-0x000000001BA42000-memory.dmp

    Filesize

    2.9MB

  • memory/2580-15-0x0000000001F00000-0x0000000001F08000-memory.dmp

    Filesize

    32KB

  • memory/2796-207-0x0000000000080000-0x00000000000C2000-memory.dmp

    Filesize

    264KB

  • memory/2884-8-0x0000000002790000-0x0000000002798000-memory.dmp

    Filesize

    32KB

  • memory/2884-7-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

    Filesize

    2.9MB

  • memory/2908-275-0x0000000000DB0000-0x0000000000DF2000-memory.dmp

    Filesize

    264KB

  • memory/3040-138-0x00000000003A0000-0x00000000003E2000-memory.dmp

    Filesize

    264KB

  • memory/3040-114-0x00000000003E0000-0x0000000000422000-memory.dmp

    Filesize

    264KB

  • memory/3044-117-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-141-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-103-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-104-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-105-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-107-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-108-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-101-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-110-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-111-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-112-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-100-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-115-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-116-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-98-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-118-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-119-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-120-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-97-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-121-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-124-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-125-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-126-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-127-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-128-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-129-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-96-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-132-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-133-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-134-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-135-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-136-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-95-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-139-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-140-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-102-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-142-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-143-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-144-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-145-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-94-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-148-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-149-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-150-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-151-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-152-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-93-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-155-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-156-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-157-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-158-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-159-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-160-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-161-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-163-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-164-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-165-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-166-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-167-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-91-0x00000000006A0000-0x00000000006AA000-memory.dmp

    Filesize

    40KB

  • memory/3044-170-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-171-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-172-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-173-0x0000000001350000-0x0000000004A40000-memory.dmp

    Filesize

    54.9MB

  • memory/3044-92-0x00000000006A0000-0x00000000006AA000-memory.dmp

    Filesize

    40KB

  • memory/3044-89-0x0000000000680000-0x000000000068A000-memory.dmp

    Filesize

    40KB

  • memory/3044-90-0x0000000000680000-0x000000000068A000-memory.dmp

    Filesize

    40KB

  • memory/3044-86-0x00000000006A0000-0x00000000006AA000-memory.dmp

    Filesize

    40KB

  • memory/3044-87-0x00000000006A0000-0x00000000006AA000-memory.dmp

    Filesize

    40KB

  • memory/3044-84-0x0000000000680000-0x000000000068A000-memory.dmp

    Filesize

    40KB

  • memory/3044-85-0x0000000000680000-0x000000000068A000-memory.dmp

    Filesize

    40KB