Overview

overview

10

Static

static

3

726653ca6a...94.exe

windows7-x64

10

726653ca6a...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2024 01:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    726653ca6a7c8ba9be0c2a8be957b464bd108580e9e6135cce2b11b124180e94.exe

  • Size

    4.6MB

  • MD5

    513e198d8d3251a4114115603be2ef5b

  • SHA1

    fc273f9f478d807b87bf17c9ebedd49fe4451509

  • SHA256

    726653ca6a7c8ba9be0c2a8be957b464bd108580e9e6135cce2b11b124180e94

  • SHA512

    b689ea55a907f743af6f6c44cd175ca7dccd346fffca25aae9f472745d8c4248dd9f0ec8380fb936e95067d35768282991b327073c29baab1c78bf57559004c9

  • SSDEEP

    98304:IsTtFCMoEBCSbrQJEqAQPqGwxMDYNaYHzPcLZc/9fFQucTeu52Xu:IitFXoBo0rVwxWYNzHg21NQucTj5w

Score
10/10
agentteslagurcuredlinesectopratdiscoveryevasionexecutioninfostealerkeyloggerratspywarestealerthemidatrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7390139954:AAFw-89dzufZnN9iQ-qMJ7xuGsXRrzvXAEI/

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7390139954:AAFw-89dzufZnN9iQ-qMJ7xuGsXRrzvXAEI/sendDocumen

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 13 IoCs
  • Sectoprat family
    sectoprat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 29 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\726653ca6a7c8ba9be0c2a8be957b464bd108580e9e6135cce2b11b124180e94.exe
    "C:\Users\Admin\AppData\Local\Temp\726653ca6a7c8ba9be0c2a8be957b464bd108580e9e6135cce2b11b124180e94.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C wmic path win32_ComputerSystem get model
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic path win32_ComputerSystem get model
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:208
    • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
      "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4312
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sgBDFAKb.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sgBDFAKb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE7B0.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2188
      • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
        "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
        3⤵
        • Executes dropped EXE
        PID:4028
      • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
        "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
        3⤵
        • Executes dropped EXE
        PID:1224
      • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
        "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
        3⤵
        • Executes dropped EXE
        PID:4912
      • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
        "C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3188
    • C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe
      "C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XyJQWVqVwSU.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2436
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XyJQWVqVwSU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD448.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3188
      • C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe
        "C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe"
        3⤵
        • Executes dropped EXE
        PID:2388
      • C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe
        "C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe"
        3⤵
        • Executes dropped EXE
        PID:3944
      • C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe
        "C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2768
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\726653ca6a7c8ba9be0c2a8be957b464bd108580e9e6135cce2b11b124180e94.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\system32\timeout.exe
        TIMEOUT /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

4
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AsuUQa4j6S2HpNn.exe.log
    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    60bf6fee9d3363d35b00ce55bf516a55

    SHA1

    4fde93defca239fc85a2a0818b24c9e1e4294a2a

    SHA256

    bc8820752330d9551439a501538c44e702c52558b102e4c33f987413b17740e1

    SHA512

    5356e7c27bb2b6c0a5ca44e402fc3a768703140acfb3b0227728e47eadb4e15a2f789a4d333d161be3f5a6b0ac3e39e4e23d645db2fc26c667698e44913d41d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    b1198e7bf50ef29f4ecf34ca50d0c311

    SHA1

    ca18a2263b6596b7920ac47457a7f10a3cf23b9a

    SHA256

    31d5dcbc0e4b573c98b28e3251331776a308f64b63086fcebb763cd688b26bb0

    SHA512

    3d9f78b6d70830c4e0405128b7c0a4642f590004c24c01cd5fb3f4da656671be8046877baebc0e525660a419b6cd6cba24a5d95b53ba26a664e7d96205033b57

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\PEQUwNvwEW\BLClOKQwCpC7NEW.exe
    Filesize

    2.3MB

    MD5

    3111fce09bd593632338703ec7b79ec4

    SHA1

    0692697feadf4502ca36d468de45942d9857f9b5

    SHA256

    ddbaa3837446cb7c45a6f00ab198d6460a16db74d869887d2e9d0de37ff364e2

    SHA512

    2e0ef5795621b6d9b80a16949d512a7ca18415397f3dd515608b0f998fae0b3c9c4b720d867396a4a1e894460f185c5150615f9115e8e11a008b5ccc4721ccd6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1abd4zjt.ylp.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cHUnEQyHoEpn\AsuUQa4j6S2HpNn.exe
    Filesize

    2.3MB

    MD5

    20cf29e88f8334623bacf9b4a786583f

    SHA1

    92177c432f500254d8b1b7531898a7f73a9f2ab6

    SHA256

    6b0ee9d248c8927e65ada232489f00f04febc1d735d58637a881237c09371a12

    SHA512

    131056feef1acb34d5f18b0a4997240314809f9800beda7c7878d9f0506ae10d707f458abb0e1f5dc9ab86c28a3d94801a4c9654320a8608b55c256edbe6ce30

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpD448.tmp
    Filesize

    1KB

    MD5

    fc63c5f5ed2055d08a006f171da8db60

    SHA1

    c842d906772fb8976a24212dfefd8b64626ab3b3

    SHA256

    bbc4d763da7d93739fd2519cc933841e38eca86277cac35411a7b40771ea33dd

    SHA512

    8f50f6d4799ece341c9baf4617b56eb31af6f962b29195849c4b68ad957051ae0d8c859d176f03be3c6edd553fc48f8633e528eb3c86be305754313951a1e422

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpE7B0.tmp
    Filesize

    1KB

    MD5

    ae64c5e543f8bb62b9cca7966d77fb28

    SHA1

    ad5a8f698b6ede588cf17d8e6e576aadbeef032b

    SHA256

    d2d91aa84f33d5c216671ff6f15de6b13af65fef29cc17fd58ff58e1bc4b691c

    SHA512

    c88c320f730f5bd2e6a858e3cb5c404cd2aacabda90dcf41555dbea3eb6bf2279724c2c4177155b83bc560b1cbb030755f88e4a4377ba89d9a13c1947b52997a

    Download Submit

  • memory/1272-102-0x0000000006130000-0x000000000614E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1272-91-0x00000000060F0000-0x0000000006122000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1272-84-0x0000000005FD0000-0x000000000601C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1272-118-0x0000000007050000-0x0000000007061000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1272-40-0x00000000021F0000-0x0000000002226000-memory.dmp

    Filesize

    216KB

    Download

  • memory/1272-41-0x0000000004C50000-0x0000000005278000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/1272-114-0x0000000007490000-0x0000000007B0A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/1272-83-0x0000000005B20000-0x0000000005B3E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1272-115-0x0000000006E50000-0x0000000006E6A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1272-92-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1272-106-0x0000000006D10000-0x0000000006DB3000-memory.dmp

    Filesize

    652KB

    Download

  • memory/1272-45-0x00000000053F0000-0x0000000005456000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2284-33-0x00000000052D0000-0x00000000052EE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2284-32-0x0000000005330000-0x00000000053CC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2284-28-0x0000000000530000-0x0000000000780000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2284-29-0x0000000005600000-0x0000000005BA4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2284-30-0x0000000005050000-0x00000000050E2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2284-31-0x0000000005020000-0x000000000502A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2284-35-0x000000000AAD0000-0x000000000ACE8000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-120-0x0000000007220000-0x0000000007234000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2436-121-0x0000000007320000-0x000000000733A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2436-119-0x0000000007210000-0x000000000721E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2436-117-0x0000000007260000-0x00000000072F6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2436-116-0x0000000007050000-0x000000000705A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2436-122-0x0000000007300000-0x0000000007308000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2436-44-0x0000000005570000-0x00000000055D6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2436-43-0x0000000004C70000-0x0000000004C92000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2436-56-0x0000000005700000-0x0000000005A54000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2436-103-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2492-183-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2492-193-0x0000000007190000-0x0000000007233000-memory.dmp

    Filesize

    652KB

    Download

  • memory/2492-194-0x00000000074B0000-0x00000000074C1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/2768-76-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-88-0x0000000005B50000-0x0000000005B62000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2768-0-0x00007FFFFBD73000-0x00007FFFFBD75000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2768-81-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-71-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-72-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-74-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-73-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-75-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-89-0x0000000005BC0000-0x0000000005BFC000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2768-87-0x00000000061E0000-0x00000000067F8000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/2768-53-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-77-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-78-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-86-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-82-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-80-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-79-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-200-0x0000000007840000-0x0000000007D6C000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/2768-70-0x0000000000400000-0x0000000000A0A000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2768-199-0x0000000007140000-0x0000000007302000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2768-90-0x0000000005E60000-0x0000000005F6A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2768-1-0x0000000000020000-0x00000000004C4000-memory.dmp

    Filesize

    4.6MB

    Download

  • memory/3188-156-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-163-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-172-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-167-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-168-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-166-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-164-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-162-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-165-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-170-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-160-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-169-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-201-0x0000000006DB0000-0x0000000006E00000-memory.dmp

    Filesize

    320KB

    Download

  • memory/3188-158-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3188-161-0x0000000000400000-0x0000000000A20000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4220-27-0x0000000000770000-0x00000000009C6000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/4220-34-0x000000000AD50000-0x000000000AF6E000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4312-195-0x0000000007160000-0x0000000007174000-memory.dmp

    Filesize

    80KB

    Download

  • memory/4312-173-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4312-132-0x0000000005590000-0x00000000058E4000-memory.dmp

    Filesize

    3.3MB

    Download