xmrig | 52e4aceb09acb18ea005e7bc89522d7353d4b7eded4181777d2e1912aaa846f5

Analysis

max time kernel
126s
max time network
138s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/12/2021, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAPPHIRE_Plugin.exe
Size 753KB
Sample211224-qtjaasdbej
SHA256 52e4aceb09acb18ea005e7bc89522d7353d4b7eded4181777d2e1912aaa846f5
MD5 b632941f0e34ae5460f332172403297a
SHA1 b9a80e7824187e8f8db6d6e1ab9511564267ed59
SHA512 5f80020f0048bea1d20e7fc85b0c863367c5bc53a3c1cfc0d06a69b978ea9bd519d444192048fd3ed54b89221e06dfc7b54070dc17cd88d3f7a5971776e9fa66
MD5 SHA1 SHA512

Score

10^/10

xmrig discovery miner spyware stealer

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2920	fm.exe
3236	bdwtibgd.exe
1240	sihost32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\bdwtibgd.exe	conhost.exe
File opened for modification	C:\Windows\system32\bdwtibgd.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	conhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2372	2520	SAPPHIRE_Plugin.exe	69

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2372	RegAsm.exe
2372	RegAsm.exe
2372	RegAsm.exe
2000	conhost.exe
1200	powershell.exe
1200	powershell.exe
1200	powershell.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe
1488	conhost.exe
1488	conhost.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	RegAsm.exe
Token: SeDebugPrivilege	2000	conhost.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe
Token: 34	1200	powershell.exe
Token: 35	1200	powershell.exe
Token: 36	1200	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeIncreaseQuotaPrivilege	2516	powershell.exe
Token: SeSecurityPrivilege	2516	powershell.exe
Token: SeTakeOwnershipPrivilege	2516	powershell.exe
Token: SeLoadDriverPrivilege	2516	powershell.exe
Token: SeSystemProfilePrivilege	2516	powershell.exe
Token: SeSystemtimePrivilege	2516	powershell.exe
Token: SeProfSingleProcessPrivilege	2516	powershell.exe
Token: SeIncBasePriorityPrivilege	2516	powershell.exe
Token: SeCreatePagefilePrivilege	2516	powershell.exe
Token: SeBackupPrivilege	2516	powershell.exe
Token: SeRestorePrivilege	2516	powershell.exe
Token: SeShutdownPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeSystemEnvironmentPrivilege	2516	powershell.exe
Token: SeRemoteShutdownPrivilege	2516	powershell.exe
Token: SeUndockPrivilege	2516	powershell.exe
Token: SeManageVolumePrivilege	2516	powershell.exe
Token: 33	2516	powershell.exe
Token: 34	2516	powershell.exe
Token: 35	2516	powershell.exe
Token: 36	2516	powershell.exe
Token: SeDebugPrivilege	1488	conhost.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2520 wrote to memory of 2372	2520	SAPPHIRE_Plugin.exe	69
PID 2372 wrote to memory of 2920	2372	RegAsm.exe	71
PID 2372 wrote to memory of 2920	2372	RegAsm.exe	71
PID 2920 wrote to memory of 2000	2920	fm.exe	72
PID 2920 wrote to memory of 2000	2920	fm.exe	72
PID 2920 wrote to memory of 2000	2920	fm.exe	72
PID 2000 wrote to memory of 3316	2000	conhost.exe	73
PID 2000 wrote to memory of 3316	2000	conhost.exe	73
PID 3316 wrote to memory of 1200	3316	cmd.exe	75
PID 3316 wrote to memory of 1200	3316	cmd.exe	75
PID 2000 wrote to memory of 3192	2000	conhost.exe	76
PID 2000 wrote to memory of 3192	2000	conhost.exe	76
PID 3192 wrote to memory of 2584	3192	cmd.exe	78
PID 3192 wrote to memory of 2584	3192	cmd.exe	78
PID 3316 wrote to memory of 2516	3316	cmd.exe	80
PID 3316 wrote to memory of 2516	3316	cmd.exe	80
PID 2000 wrote to memory of 2904	2000	conhost.exe	83
PID 2000 wrote to memory of 2904	2000	conhost.exe	83
PID 2904 wrote to memory of 3236	2904	cmd.exe	85
PID 2904 wrote to memory of 3236	2904	cmd.exe	85
PID 3236 wrote to memory of 1488	3236	bdwtibgd.exe	86
PID 3236 wrote to memory of 1488	3236	bdwtibgd.exe	86
PID 3236 wrote to memory of 1488	3236	bdwtibgd.exe	86
PID 1488 wrote to memory of 1380	1488	conhost.exe	87
PID 1488 wrote to memory of 1380	1488	conhost.exe	87
PID 1380 wrote to memory of 2368	1380	cmd.exe	89
PID 1380 wrote to memory of 2368	1380	cmd.exe	89
PID 1488 wrote to memory of 1240	1488	conhost.exe	90
PID 1488 wrote to memory of 1240	1488	conhost.exe	90
PID 1380 wrote to memory of 3284	1380	cmd.exe	91
PID 1380 wrote to memory of 3284	1380	cmd.exe	91
PID 1240 wrote to memory of 3652	1240	sihost32.exe	92
PID 1240 wrote to memory of 3652	1240	sihost32.exe	92
PID 1240 wrote to memory of 3652	1240	sihost32.exe	92

C:\Users\Admin\AppData\Local\Temp\SAPPHIRE_Plugin.exe
"C:\Users\Admin\AppData\Local\Temp\SAPPHIRE_Plugin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\fm.exe
    "C:\Users\Admin\AppData\Local\Temp\fm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fm.exe"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "bdwtibgd" /tr "C:\Windows\system32\bdwtibgd.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3192
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "bdwtibgd" /tr "C:\Windows\system32\bdwtibgd.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2584
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\bdwtibgd.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Windows\system32\bdwtibgd.exe
        
        C:\Windows\system32\bdwtibgd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\bdwtibgd.exe"
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3284
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost32"
        9⤵
        
        PID:3652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-175-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-166-0x0000012575860000-0x00000125758D6000-memory.dmp

Download

memory/1200-197-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-174-0x0000012574AD6000-0x0000012574AD8000-memory.dmp

Download

memory/1200-173-0x0000012574AD3000-0x0000012574AD5000-memory.dmp

Download

memory/1200-172-0x0000012574AD0000-0x0000012574AD2000-memory.dmp

Download

memory/1200-171-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-167-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-210-0x0000012574AD8000-0x0000012574AD9000-memory.dmp

Download

memory/1200-164-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-163-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-161-0x00000125756B0000-0x00000125756D2000-memory.dmp

Download

memory/1200-156-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-157-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-160-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-159-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1200-158-0x0000012572F20000-0x0000012572F22000-memory.dmp

Download

memory/1488-256-0x000001B7DF080000-0x000001B7DF092000-memory.dmp

Download

memory/1488-253-0x000001B7F7CF0000-0x000001B7F7EE2000-memory.dmp

Download

memory/1488-254-0x000001B7F7CF0000-0x000001B7F7EE2000-memory.dmp

Download

memory/1488-273-0x000001B7F7AE0000-0x000001B7F7AE2000-memory.dmp

Download

memory/1488-277-0x000001B7F7AE6000-0x000001B7F7AE7000-memory.dmp

Download

memory/1488-274-0x000001B7F7AE3000-0x000001B7F7AE5000-memory.dmp

Download

memory/2000-141-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-150-0x00000115C9BB0000-0x00000115C9BC2000-memory.dmp

Download

memory/2000-148-0x00000115C7D50000-0x00000115C7F41000-memory.dmp

Download

memory/2000-147-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-145-0x00000115E27E0000-0x00000115E29D2000-memory.dmp

Download

memory/2000-144-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-143-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-152-0x00000115E25D6000-0x00000115E25D7000-memory.dmp

Download

memory/2000-142-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-153-0x00000115C9B50000-0x00000115C9B52000-memory.dmp

Download

memory/2000-146-0x00000115E27E0000-0x00000115E29D2000-memory.dmp

Download

memory/2000-151-0x00000115E25D3000-0x00000115E25D5000-memory.dmp

Download

memory/2000-149-0x00000115E25D0000-0x00000115E25D2000-memory.dmp

Download

memory/2368-309-0x000002237FFA6000-0x000002237FFA8000-memory.dmp

Download

memory/2368-280-0x000002237FFA0000-0x000002237FFA2000-memory.dmp

Download

memory/2368-275-0x0000022300D40000-0x0000022300DB6000-memory.dmp

Download

memory/2368-281-0x000002237FFA3000-0x000002237FFA5000-memory.dmp

Download

memory/2368-264-0x00000223001F0000-0x0000022300212000-memory.dmp

Download

memory/2368-328-0x000002237FFA8000-0x000002237FFA9000-memory.dmp

Download

memory/2372-133-0x0000000006D50000-0x0000000006DE2000-memory.dmp

Download

memory/2372-124-0x0000000005670000-0x0000000005C76000-memory.dmp

Download

memory/2372-137-0x0000000008000000-0x000000000852C000-memory.dmp

Download

memory/2372-136-0x0000000007900000-0x0000000007AC2000-memory.dmp

Download

memory/2372-127-0x00000000051A0000-0x0000000005206000-memory.dmp

Download

memory/2372-135-0x0000000006E40000-0x0000000006E90000-memory.dmp

Download

memory/2372-134-0x0000000006890000-0x00000000068AE000-memory.dmp

Download

memory/2372-132-0x0000000006C30000-0x0000000006CA6000-memory.dmp

Download

memory/2372-120-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2372-131-0x0000000007130000-0x000000000762E000-memory.dmp

Download

memory/2372-126-0x0000000005240000-0x000000000534A000-memory.dmp

Download

memory/2372-130-0x0000000005C80000-0x0000000005CCB000-memory.dmp

Download

memory/2372-129-0x0000000005E60000-0x0000000005E61000-memory.dmp

Download

memory/2372-128-0x0000000005610000-0x000000000564E000-memory.dmp

Download

memory/2372-125-0x0000000005110000-0x0000000005122000-memory.dmp

Download

memory/2372-122-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2372-123-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2516-211-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-201-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-241-0x00000201233A8000-0x00000201233A9000-memory.dmp

Download

memory/2516-240-0x00000201233A6000-0x00000201233A8000-memory.dmp

Download

memory/2516-200-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-217-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-214-0x00000201233A3000-0x00000201233A5000-memory.dmp

Download

memory/2516-212-0x00000201233A0000-0x00000201233A2000-memory.dmp

Download

memory/2516-209-0x0000020123E40000-0x0000020123EB6000-memory.dmp

Download

memory/2516-208-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-218-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-207-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-205-0x000002010B270000-0x000002010B292000-memory.dmp

Download

memory/2516-204-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-203-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2516-202-0x000002010AC20000-0x000002010AC22000-memory.dmp

Download

memory/2520-115-0x0000000000FD0000-0x0000000001090000-memory.dmp

Download

memory/2520-116-0x0000000000FD0000-0x0000000001090000-memory.dmp

Download

memory/2520-119-0x000000001BDA0000-0x000000001BDA2000-memory.dmp

Download

memory/2520-117-0x0000000003470000-0x00000000034E6000-memory.dmp

Download

memory/2520-118-0x00000000019C0000-0x00000000019DE000-memory.dmp

Download

memory/3284-329-0x0000022AEC340000-0x0000022AEC342000-memory.dmp

Download

memory/3284-353-0x0000022AEC348000-0x0000022AEC349000-memory.dmp

Download

memory/3284-321-0x0000022AED0C0000-0x0000022AED136000-memory.dmp

Download

memory/3284-316-0x0000022AEC350000-0x0000022AEC372000-memory.dmp

Download

memory/3284-333-0x0000022AEC346000-0x0000022AEC348000-memory.dmp

Download

memory/3284-332-0x0000022AEC343000-0x0000022AEC345000-memory.dmp

Download

memory/3652-358-0x0000018FB86D0000-0x0000018FB86D6000-memory.dmp

Download

memory/3652-359-0x0000018FB86D0000-0x0000018FB86D6000-memory.dmp

Download

memory/3652-363-0x0000018FB86E0000-0x0000018FB86E2000-memory.dmp

Download

memory/3652-362-0x0000018FB6C60000-0x0000018FB6C67000-memory.dmp

Download

memory/3652-364-0x0000018FB86E3000-0x0000018FB86E5000-memory.dmp

Download

memory/3652-365-0x0000018FB86E6000-0x0000018FB86E7000-memory.dmp

Download