hancitor | 543cdd57d5a93f18c0b357a04c191632aefa9c38e3bd6947ade49745307cf6a3

Analysis

max time kernel
140s
max time network
152s
platform
windows10_x64
resource
win10-20220331-en
submitted
05-04-2022 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

V3158D2199.doc
Size

943KB
MD5

db770ed53fa4d80325dd5da9f9602445
SHA1

e883d5e246841e2ca50c9f6b177d276fbdbcf903
SHA256

543cdd57d5a93f18c0b357a04c191632aefa9c38e3bd6947ade49745307cf6a3
SHA512

760f49ae2c2b3df620ee272ce06974b163ad9701c1810c6489b689a9d166f3699fbdd78a8a5ea14c09e1afe162c4a5c04b8c64e9247b4440b63f05a95b3b70f6

Score

10^/10

hancitor 2103_punosh downloader

Malware Config

Extracted

Family

hancitor

Botnet

2103_punosh

http://nanogeelr.com/9/forum.php

http://ockpitehou.ru/9/forum.php

http://lumentsawfu.ru/9/forum.php

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3936	2072	extrac32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1760	2072	rundll32.exe	65

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	4236	rundll32.exe
20	4236	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
4236	rundll32.exe
4236	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3729659790-1998850411-3319863756-1000_Classes\Local Settings	cmd.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{69552653-C743-4646-B469-30DA213AFC74}\borw4 (2).doc:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{69552653-C743-4646-B469-30DA213AFC74}\helf.hp_:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{C102B8D8-5AAF-48C3-A5EF-5898578A52A1}\borw4.doc:Zone.Identifier	WINWORD.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{69552653-C743-4646-B469-30DA213AFC74}\borw4.doc:Zone.Identifier	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2072	WINWORD.EXE
2072	WINWORD.EXE
4880	WINWORD.EXE
4880	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4236	rundll32.exe
4236	rundll32.exe
1996	powershell.exe
1996	powershell.exe
1996	powershell.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	2012	taskmgr.exe
Token: SeSystemProfilePrivilege	2012	taskmgr.exe
Token: SeCreateGlobalPrivilege	2012	taskmgr.exe
Token: 33	2012	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2012	taskmgr.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
2072	WINWORD.EXE
4880	WINWORD.EXE
4880	WINWORD.EXE
4880	WINWORD.EXE
4880	WINWORD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4400	2072	WINWORD.EXE	68
PID 2072 wrote to memory of 4400	2072	WINWORD.EXE	68
PID 2072 wrote to memory of 3936	2072	WINWORD.EXE	70
PID 2072 wrote to memory of 3936	2072	WINWORD.EXE	70
PID 2072 wrote to memory of 1760	2072	WINWORD.EXE	71
PID 2072 wrote to memory of 1760	2072	WINWORD.EXE	71
PID 1760 wrote to memory of 4236	1760	rundll32.exe	72
PID 1760 wrote to memory of 4236	1760	rundll32.exe	72
PID 1760 wrote to memory of 4236	1760	rundll32.exe	72
PID 1996 wrote to memory of 1292	1996	powershell.exe	75
PID 1996 wrote to memory of 1292	1996	powershell.exe	75
PID 1292 wrote to memory of 4880	1292	cmd.exe	78
PID 1292 wrote to memory of 4880	1292	cmd.exe	78

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\V3158D2199.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4400
- C:\Windows\SYSTEM32\extrac32.exe
  extrac32.exe helff.hp_
  2⤵
  - Process spawned unexpected child process
  PID:3936
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe helf.hpl,YDCFOMQICNKAUXS
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe helf.hpl,YDCFOMQICNKAUXS
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\V3158D2199.doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4880

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F4F3C2A5-04F2-4513-8EC4-336A96B68A50

Filesize
142KB

MD5
473d56807eafdabc7bcb2aac200f6906

SHA1
c802635df98b19ed0e798c447017046cf2070b8c

SHA256
1e5e85175ee23ea3eebd223f55cf2c59dec07dcef3bfa3c24d2fdf6b9356c666

SHA512
e636e0cb6d1db0d75366f3a9fe50aa2066767337f83390924045924b87baa803d0434ead72aa090c7e20615534cafa77ff9fc86f3f13780081881b31a1aafad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
b00f3f56c104c94e03cd2ad8452c14e7

SHA1
51b78e45015e0d9d62fbdf31b75a22535a107204

SHA256
ba2b669020334ff01a85bfc900ea4371ea557bd315f154875d9bdfdc16ae8b50

SHA512
93e1609be5bbb414c285f37432ce93294c3d1583ef46c7c6c570c122f0b166c34b0ad87de708005c8af97dee27923ba53395a34c2563cdadf3c0a708848b3525

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\helff.hp_

Filesize
799KB

MD5
0e71bc3c48b2cb1b5fcd107c2a1eb772

SHA1
9276387d7ba0f9a92b743c6d7cca30ce92752308

SHA256
d71ba9640c1c7bb714cd772a6a8c5f62affa9230e3eb68dcdd89793452178c40

SHA512
bfe545e8bedd2e7582811fbb88d6286ed23b985c68fed55340309b3baf6c85f3b8ec2b3cf4b85d65c36ceba5f034c0dc8773fc0c5d0bad7f0c8499d0b5a9fcdf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
be0ce64e3405d1d2d943cbcb9fd1dd8a

SHA1
e350b2b324352946e313ed0c07e028ba6fa83be4

SHA256
b17e87624743ccdd75d224355d66a01b223f7229a9f39618d65752a1cc81b778

SHA512
10358fdf57090a0122e09c71e449e3c2ebac1cb075020fd25f3df70acd1f99ffca45ad7bdd649be0999c2a98dda5ade1fc5284e96a59948b416d591845406d21

Download Submit
\??\c:\users\admin\appdata\roaming\microsoft\templates\helf.hpl

Filesize
1.7MB

MD5
5df3d0f5c72cf5e5f5558d0427fbe188

SHA1
7f3d18d51f70b226fd93cdcc50b30f24584e54a9

SHA256
446322c5499d41edee0ca0b83aba36f0cc74ed4743a2e50e6eb36d2a3469d85f

SHA512
85b4bac6afcb5e909ba6b805ef14479305a785a68b99893287bdb07c5a55e51db8f22c2ab5343d7898e07a8de424357377aacd8c5c1288e06d07fefaa2d0c757

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Templates\helf.hpl

Filesize
1.7MB

MD5
5df3d0f5c72cf5e5f5558d0427fbe188

SHA1
7f3d18d51f70b226fd93cdcc50b30f24584e54a9

SHA256
446322c5499d41edee0ca0b83aba36f0cc74ed4743a2e50e6eb36d2a3469d85f

SHA512
85b4bac6afcb5e909ba6b805ef14479305a785a68b99893287bdb07c5a55e51db8f22c2ab5343d7898e07a8de424357377aacd8c5c1288e06d07fefaa2d0c757

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Templates\helf.hpl

Filesize
1.7MB

MD5
5df3d0f5c72cf5e5f5558d0427fbe188

SHA1
7f3d18d51f70b226fd93cdcc50b30f24584e54a9

SHA256
446322c5499d41edee0ca0b83aba36f0cc74ed4743a2e50e6eb36d2a3469d85f

SHA512
85b4bac6afcb5e909ba6b805ef14479305a785a68b99893287bdb07c5a55e51db8f22c2ab5343d7898e07a8de424357377aacd8c5c1288e06d07fefaa2d0c757

Download Submit
memory/1996-455-0x000001C2EFFA0000-0x000001C2F0016000-memory.dmp

Filesize
472KB

Download
memory/1996-444-0x000001C2EFEE0000-0x000001C2EFF1C000-memory.dmp

Filesize
240KB

Download
memory/1996-433-0x000001C2EF963000-0x000001C2EF965000-memory.dmp

Filesize
8KB

Download
memory/1996-430-0x000001C2EF960000-0x000001C2EF962000-memory.dmp

Filesize
8KB

Download
memory/1996-423-0x000001C2EF910000-0x000001C2EF932000-memory.dmp

Filesize
136KB

Download
memory/2072-418-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-415-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-417-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-116-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-416-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-119-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-118-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/2072-117-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/4236-323-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/4236-322-0x0000000000810000-0x0000000000817000-memory.dmp

Filesize
28KB

Download
memory/4236-321-0x00000000042B0000-0x000000000446C000-memory.dmp

Filesize
1.7MB

Download
memory/4880-478-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/4880-477-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/4880-476-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download
memory/4880-475-0x00007FFBA9BC0000-0x00007FFBA9BD0000-memory.dmp

Filesize
64KB

Download