cryptbot | 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7

Analysis

max time kernel
157s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-02-2022 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
Size

8.4MB
MD5

01916ff0453c0730f2a6f4a822840722
SHA1

1616f0667616e90847d0585923ba1af1773371ab
SHA256

3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7
SHA512

b296150c4cecff1324db41a61ab18b3944a27972abf1f752720efe62f803f56f2d1a4917b96f560e28238dcfc472300749e090a45575a40772af98303226c8a4

Score

10^/10

cryptbot discovery evasion spyware stealer themida trojan

Malware Config

Extracted

Family

cryptbot

tisysc64.top

morvak06.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 5 IoCs

Processes:

Setup.exeSetup1.exeKMSpico.exeKMSpico.tmpDpEditor.exe

pid process

4732 Setup.exe
4600 Setup1.exe
2452 KMSpico.exe
4932 KMSpico.tmp
2652 DpEditor.exe

pid	process
4732	Setup.exe
4600	Setup1.exe
2452	KMSpico.exe
4932	KMSpico.tmp
2652	DpEditor.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup1.exeDpEditor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Program Files (x86)\affair1\Setup1.exe	themida
C:\Program Files (x86)\affair1\Setup1.exe	themida
behavioral2/memory/4600-138-0x00000000007D0000-0x0000000000EB0000-memory.dmp	themida
behavioral2/memory/4600-142-0x00000000007D0000-0x0000000000EB0000-memory.dmp	themida
behavioral2/memory/4600-144-0x00000000007D0000-0x0000000000EB0000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
behavioral2/memory/2652-151-0x0000000000EA0000-0x0000000001580000-memory.dmp	themida
behavioral2/memory/2652-152-0x0000000000EA0000-0x0000000001580000-memory.dmp	themida
behavioral2/memory/2652-153-0x0000000000EA0000-0x0000000001580000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup1.exeDpEditor.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DpEditor.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Setup1.exeDpEditor.exe

pid process

4600 Setup1.exe
2652 DpEditor.exe

pid	process
4600	Setup1.exe
2652	DpEditor.exe

Drops file in Program Files directory 8 IoCs

Processes:

3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe

description	ioc	process
File created	C:\Program Files (x86)\affair1\__tmp_rar_sfx_access_check_30253375	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File created	C:\Program Files (x86)\affair1\KMSpico.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File opened for modification	C:\Program Files (x86)\affair1\KMSpico.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File created	C:\Program Files (x86)\affair1\Setup.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File opened for modification	C:\Program Files (x86)\affair1\Setup.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File created	C:\Program Files (x86)\affair1\Setup1.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File opened for modification	C:\Program Files (x86)\affair1\Setup1.exe	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
File opened for modification	C:\Program Files (x86)\affair1	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe

Drops file in Windows directory 8 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

DpEditor.exe

pid process

2652 DpEditor.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup1.exeDpEditor.exe

pid process

4600 Setup1.exe
4600 Setup1.exe
2652 DpEditor.exe
2652 DpEditor.exe

pid	process
2652	DpEditor.exe

pid	process
4600	Setup1.exe
4600	Setup1.exe
2652	DpEditor.exe
2652	DpEditor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	4716	svchost.exe
Token: SeCreatePagefilePrivilege	4716	svchost.exe
Token: SeShutdownPrivilege	4716	svchost.exe
Token: SeCreatePagefilePrivilege	4716	svchost.exe
Token: SeShutdownPrivilege	4716	svchost.exe
Token: SeCreatePagefilePrivilege	4716	svchost.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe
Token: SeRestorePrivilege	1636	TiWorker.exe
Token: SeSecurityPrivilege	1636	TiWorker.exe
Token: SeBackupPrivilege	1636	TiWorker.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exeKMSpico.exeSetup1.exe

description	pid	process	target process
PID 1288 wrote to memory of 4732	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup.exe
PID 1288 wrote to memory of 4732	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup.exe
PID 1288 wrote to memory of 4732	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup.exe
PID 1288 wrote to memory of 4600	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup1.exe
PID 1288 wrote to memory of 4600	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup1.exe
PID 1288 wrote to memory of 4600	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	Setup1.exe
PID 1288 wrote to memory of 2452	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	KMSpico.exe
PID 1288 wrote to memory of 2452	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	KMSpico.exe
PID 1288 wrote to memory of 2452	1288	3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe	KMSpico.exe
PID 2452 wrote to memory of 4932	2452	KMSpico.exe	KMSpico.tmp
PID 2452 wrote to memory of 4932	2452	KMSpico.exe	KMSpico.tmp
PID 2452 wrote to memory of 4932	2452	KMSpico.exe	KMSpico.tmp
PID 4600 wrote to memory of 2652	4600	Setup1.exe	DpEditor.exe
PID 4600 wrote to memory of 2652	4600	Setup1.exe	DpEditor.exe
PID 4600 wrote to memory of 2652	4600	Setup1.exe	DpEditor.exe

C:\Users\Admin\AppData\Local\Temp\3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
"C:\Users\Admin\AppData\Local\Temp\3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files (x86)\affair1\Setup.exe
"C:\Program Files (x86)\affair1\Setup.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4732

C:\Program Files (x86)\affair1\Setup1.exe
"C:\Program Files (x86)\affair1\Setup1.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:2652

C:\Program Files (x86)\affair1\KMSpico.exe
"C:\Program Files (x86)\affair1\KMSpico.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\is-EQ18E.tmp\KMSpico.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EQ18E.tmp\KMSpico.tmp" /SL5="$5002A,2952592,69120,C:\Program Files (x86)\affair1\KMSpico.exe"
3⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\affair1\KMSpico.exe
MD5
a02164371a50c5ff9fa2870ef6e8cfa3

SHA1
060614723f8375ecaad8b249ff07e3be082d7f25

SHA256
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

SHA512
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

Download Submit
C:\Program Files (x86)\affair1\KMSpico.exe
MD5
a02164371a50c5ff9fa2870ef6e8cfa3

SHA1
060614723f8375ecaad8b249ff07e3be082d7f25

SHA256
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

SHA512
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

Download Submit
C:\Program Files (x86)\affair1\Setup.exe
MD5
b7c4d84e29ceef241c3fd8cbcaaa6915

SHA1
eaea6e4203d921d2e2784f872ce6bb7ce6876764

SHA256
05ad9dc479c246795c6cb5a470159c3f90d6d4fb6c37febdc45ddec2fc636c9d

SHA512
46cf110a892757c624270441f52938953d572dadab6489eafe25f34c5a4aea83e91d1ea42e4733f99b27a842cc662f523cb46d3605d2fdf369723fa69da1c3fa

Download Submit
C:\Program Files (x86)\affair1\Setup.exe
MD5
b7c4d84e29ceef241c3fd8cbcaaa6915

SHA1
eaea6e4203d921d2e2784f872ce6bb7ce6876764

SHA256
05ad9dc479c246795c6cb5a470159c3f90d6d4fb6c37febdc45ddec2fc636c9d

SHA512
46cf110a892757c624270441f52938953d572dadab6489eafe25f34c5a4aea83e91d1ea42e4733f99b27a842cc662f523cb46d3605d2fdf369723fa69da1c3fa

Download Submit
C:\Program Files (x86)\affair1\Setup1.exe
MD5
5471e00dc319a006f9a41cb84c46df04

SHA1
a94273294009f89fceda6b263b7c40d18494d4d4

SHA256
eb3c5b00bc5347197ae29e42948b225f4871c6ff63856309e0566e546e7cfcb5

SHA512
86b8b2da5b376a77282af562ecff82dbb0ae44e8180b8dd2712da087e5cfbc8e106618bc5334569fe94820076876f8d8c1ce214f7c455dc03d47de0707d736fb

Download Submit
C:\Program Files (x86)\affair1\Setup1.exe
MD5
5471e00dc319a006f9a41cb84c46df04

SHA1
a94273294009f89fceda6b263b7c40d18494d4d4

SHA256
eb3c5b00bc5347197ae29e42948b225f4871c6ff63856309e0566e546e7cfcb5

SHA512
86b8b2da5b376a77282af562ecff82dbb0ae44e8180b8dd2712da087e5cfbc8e106618bc5334569fe94820076876f8d8c1ce214f7c455dc03d47de0707d736fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EQ18E.tmp\KMSpico.tmp
MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EQ18E.tmp\KMSpico.tmp
MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
5471e00dc319a006f9a41cb84c46df04

SHA1
a94273294009f89fceda6b263b7c40d18494d4d4

SHA256
eb3c5b00bc5347197ae29e42948b225f4871c6ff63856309e0566e546e7cfcb5

SHA512
86b8b2da5b376a77282af562ecff82dbb0ae44e8180b8dd2712da087e5cfbc8e106618bc5334569fe94820076876f8d8c1ce214f7c455dc03d47de0707d736fb

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
5471e00dc319a006f9a41cb84c46df04

SHA1
a94273294009f89fceda6b263b7c40d18494d4d4

SHA256
eb3c5b00bc5347197ae29e42948b225f4871c6ff63856309e0566e546e7cfcb5

SHA512
86b8b2da5b376a77282af562ecff82dbb0ae44e8180b8dd2712da087e5cfbc8e106618bc5334569fe94820076876f8d8c1ce214f7c455dc03d47de0707d736fb

Download Submit
memory/2452-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2452-141-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2652-153-0x0000000000EA0000-0x0000000001580000-memory.dmp

Filesize
6.9MB

Download
memory/2652-152-0x0000000000EA0000-0x0000000001580000-memory.dmp

Filesize
6.9MB

Download
memory/2652-151-0x0000000000EA0000-0x0000000001580000-memory.dmp

Filesize
6.9MB

Download
memory/4600-144-0x00000000007D0000-0x0000000000EB0000-memory.dmp

Filesize
6.9MB

Download
memory/4600-143-0x0000000077814000-0x0000000077816000-memory.dmp

Filesize
8KB

Download
memory/4600-138-0x00000000007D0000-0x0000000000EB0000-memory.dmp

Filesize
6.9MB

Download
memory/4600-142-0x00000000007D0000-0x0000000000EB0000-memory.dmp

Filesize
6.9MB

Download
memory/4716-147-0x0000019812C40000-0x0000019812C50000-memory.dmp

Filesize
64KB

Download
memory/4716-148-0x0000019815130000-0x0000019815134000-memory.dmp

Filesize
16KB

Download
memory/4716-146-0x0000019812A20000-0x0000019812A30000-memory.dmp

Filesize
64KB

Download
memory/4732-154-0x000000000044B000-0x000000000044D000-memory.dmp

Filesize
8KB

Download
memory/4732-155-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/4732-156-0x0000000002A50000-0x0000000002A98000-memory.dmp

Filesize
288KB

Download
memory/4932-145-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download