fadb8eb7a7e20388dd3f9cf66171ae8d1c1e0845aed740ea58fa432c69bbaa7e

Analysis

max time kernel
134s
max time network
151s
platform
windows10_x64
resource
win10-en-20211014
submitted
22/11/2021, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
445fa165957d7e773453c4b83fe703f3.exe
Size 296KB
Sample211122-xe7snsgfdj
SHA256 fadb8eb7a7e20388dd3f9cf66171ae8d1c1e0845aed740ea58fa432c69bbaa7e
MD5 445fa165957d7e773453c4b83fe703f3
SHA1 78f17a5ffce0b7b34532d33b85d999ba2bfbcb74
SHA512 aa40b9620db0e9e6b2aa6c170b0aa2808d336bb122d63d766d04710d5fc03a0aa9dfc1b9b185be2488aea02898cd33c8749c24308276010b6a5301092560f768
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer suricata

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\", \"C:\\Windows\\Logs\\NetSetup\\System.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\", \"C:\\Windows\\Logs\\NetSetup\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\", \"C:\\Windows\\Logs\\NetSetup\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Windows\\System32\\DeviceCenter\\RuntimeBroker.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\", \"C:\\Windows\\Logs\\NetSetup\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Windows\\System32\\DeviceCenter\\RuntimeBroker.exe\", \"C:\\Windows\\WindowsUpdate\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Boot\\uk-UA\\sihost.exe\", \"C:\\Windows\\Logs\\NetSetup\\System.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Windows\\System32\\DeviceCenter\\RuntimeBroker.exe\", \"C:\\Windows\\WindowsUpdate\\explorer.exe\", \"C:\\Windows\\System32\\credprovhost\\lsass.exe\""	445fa165957d7e773453c4b83fe703f3.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3840	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	3840	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	3840	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3840	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	3840	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	3840	schtasks.exe	69

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
3544	System.exe
1268	System.exe
3396	System.exe
3420	svigs.exe
3792	msing.exe
2208	sihost64.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Boot\\uk-UA\\sihost.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Boot\\uk-UA\\sihost.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Logs\\NetSetup\\System.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WindowsUpdate\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WindowsUpdate\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\credprovhost\\lsass.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Logs\\NetSetup\\System.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\DeviceCenter\\RuntimeBroker.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\DeviceCenter\\RuntimeBroker.exe\""	445fa165957d7e773453c4b83fe703f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\credprovhost\\lsass.exe\""	445fa165957d7e773453c4b83fe703f3.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DeviceCenter\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\SysWOW64\credprovhost\lsass.exe	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\SysWOW64\credprovhost\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\SysWOW64\DeviceCenter\RuntimeBroker.exe	445fa165957d7e773453c4b83fe703f3.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 3544 set thread context of 3396	3544	System.exe	78

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logs\NetSetup\System.exe	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\Logs\NetSetup\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\WindowsUpdate\explorer.exe	445fa165957d7e773453c4b83fe703f3.exe
File created	C:\Windows\WindowsUpdate\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	445fa165957d7e773453c4b83fe703f3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1392	schtasks.exe
2652	schtasks.exe
1208	schtasks.exe
660	schtasks.exe
2432	schtasks.exe
1432	schtasks.exe
1436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
900	445fa165957d7e773453c4b83fe703f3.exe
900	445fa165957d7e773453c4b83fe703f3.exe
900	445fa165957d7e773453c4b83fe703f3.exe
3544	System.exe
3544	System.exe
3396	System.exe
3396	System.exe
3396	System.exe
3396	System.exe
3396	System.exe
3420	svigs.exe
3792	msing.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3396	System.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	445fa165957d7e773453c4b83fe703f3.exe
Token: SeDebugPrivilege	900	445fa165957d7e773453c4b83fe703f3.exe
Token: SeDebugPrivilege	3544	System.exe
Token: SeDebugPrivilege	3396	System.exe
Token: SeDebugPrivilege	3420	svigs.exe
Token: SeDebugPrivilege	3792	msing.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 2772 wrote to memory of 900	2772	445fa165957d7e773453c4b83fe703f3.exe	68
PID 900 wrote to memory of 3544	900	445fa165957d7e773453c4b83fe703f3.exe	76
PID 900 wrote to memory of 3544	900	445fa165957d7e773453c4b83fe703f3.exe	76
PID 900 wrote to memory of 3544	900	445fa165957d7e773453c4b83fe703f3.exe	76
PID 3544 wrote to memory of 1268	3544	System.exe	77
PID 3544 wrote to memory of 1268	3544	System.exe	77
PID 3544 wrote to memory of 1268	3544	System.exe	77
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3544 wrote to memory of 3396	3544	System.exe	78
PID 3396 wrote to memory of 3420	3396	System.exe	79
PID 3396 wrote to memory of 3420	3396	System.exe	79
PID 3420 wrote to memory of 3568	3420	svigs.exe	82
PID 3420 wrote to memory of 3568	3420	svigs.exe	82
PID 3568 wrote to memory of 2432	3568	cmd.exe	84
PID 3568 wrote to memory of 2432	3568	cmd.exe	84
PID 3420 wrote to memory of 2168	3420	svigs.exe	85
PID 3420 wrote to memory of 2168	3420	svigs.exe	85
PID 2168 wrote to memory of 3792	2168	cmd.exe	87
PID 2168 wrote to memory of 3792	2168	cmd.exe	87
PID 3792 wrote to memory of 2208	3792	msing.exe	88
PID 3792 wrote to memory of 2208	3792	msing.exe	88
PID 2208 wrote to memory of 2304	2208	sihost64.exe	89
PID 2208 wrote to memory of 2304	2208	sihost64.exe	89
PID 2208 wrote to memory of 2304	2208	sihost64.exe	89

C:\Users\Admin\AppData\Local\Temp\445fa165957d7e773453c4b83fe703f3.exe
"C:\Users\Admin\AppData\Local\Temp\445fa165957d7e773453c4b83fe703f3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\445fa165957d7e773453c4b83fe703f3.exe
  "C:\Users\Admin\AppData\Local\Temp\445fa165957d7e773453c4b83fe703f3.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\Logs\NetSetup\System.exe
    "C:\Windows\Logs\NetSetup\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\Logs\NetSetup\System.exe
      "C:\Windows\Logs\NetSetup\System.exe"
      4⤵
      Executes dropped EXE
      PID:1268
  - - C:\Windows\Logs\NetSetup\System.exe
      "C:\Windows\Logs\NetSetup\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\svigs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svigs.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "msing" /tr "C:\Users\Admin\Microsoft\msing.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "msing" /tr "C:\Users\Admin\Microsoft\msing.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2432
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\Microsoft\msing.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Users\Admin\Microsoft\msing.exe
        
        C:\Users\Admin\Microsoft\msing.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "stppnxkfjpovjwf"
        9⤵
        
        PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Boot\uk-UA\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Logs\NetSetup\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\DeviceCenter\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WindowsUpdate\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credprovhost\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-133-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/900-124-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/900-132-0x0000000004FC0000-0x0000000004FC5000-memory.dmp

Download

memory/900-130-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/900-129-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/900-131-0x0000000004F60000-0x0000000004F67000-memory.dmp

Download

memory/2304-186-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-188-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-193-0x00000265CED80000-0x00000265CED86000-memory.dmp

Download

memory/2304-195-0x00000265D0AA3000-0x00000265D0AA5000-memory.dmp

Download

memory/2304-194-0x00000265D0AA0000-0x00000265D0AA2000-memory.dmp

Download

memory/2304-185-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-196-0x00000265D0AA6000-0x00000265D0AA7000-memory.dmp

Download

memory/2304-187-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-192-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-191-0x00000265CF000000-0x00000265CF002000-memory.dmp

Download

memory/2304-189-0x00000265CF030000-0x00000265CF033000-memory.dmp

Download

memory/2772-121-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/2772-117-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/2772-122-0x00000000049F0000-0x0000000004EEE000-memory.dmp

Download

memory/2772-123-0x0000000008D50000-0x0000000008DB9000-memory.dmp

Download

memory/2772-115-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/2772-120-0x00000000049F0000-0x0000000004EEE000-memory.dmp

Download

memory/2772-119-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download

memory/2772-118-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/3396-158-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3420-169-0x0000000002C30000-0x0000000002C31000-memory.dmp

Download

memory/3420-163-0x000000001B9D0000-0x000000001BBC1000-memory.dmp

Download

memory/3420-165-0x0000000000B70000-0x0000000000D64000-memory.dmp

Download

memory/3420-166-0x000000001B7C0000-0x000000001B7C2000-memory.dmp

Download

memory/3420-167-0x000000001B7C3000-0x000000001B7C5000-memory.dmp

Download

memory/3420-168-0x000000001B7C6000-0x000000001B7C7000-memory.dmp

Download

memory/3544-144-0x0000000004E00000-0x00000000052FE000-memory.dmp

Download

memory/3544-145-0x0000000004E00000-0x00000000052FE000-memory.dmp

Download

memory/3544-142-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/3792-184-0x0000000002DD6000-0x0000000002DD7000-memory.dmp

Download

memory/3792-182-0x0000000002DD0000-0x0000000002DD2000-memory.dmp

Download

memory/3792-183-0x0000000002DD3000-0x0000000002DD5000-memory.dmp

Download