plugx | 03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170

Analysis

max time kernel
183s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe
Size 239KB
Sample221001-3ltghsddcn
SHA256 03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170
MD5 69b7c08a2e149ceb4f6ff9bd61f14290
SHA1 0c81051d61536ec14fe193e64bda356a885b63cd
SHA512 ee6076e993a0db2b408077ecbfdcaa69e63e965699bfe8ff0e29005bc081e220ac600b6daf6af1a8a81cc722f990b69cad7483596fc5ffde87b4799a6d7b73e1
SSDEEP 6144:/27gCbTehEqclWYacI5Jg6A0xPl4aX5D8owFSunNQLW3:/27/bTehEqclrt2X44JUSunOLA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 8 IoCs

resource	yara_rule
behavioral2/memory/4452-139-0x00000000006C0000-0x00000000006F0000-memory.dmp	family_plugx
behavioral2/memory/4220-149-0x00000000005C0000-0x00000000005F0000-memory.dmp	family_plugx
behavioral2/memory/1968-150-0x0000000000E30000-0x0000000000E60000-memory.dmp	family_plugx
behavioral2/memory/4368-153-0x0000000000DC0000-0x0000000000DF0000-memory.dmp	family_plugx
behavioral2/memory/4220-154-0x00000000005C0000-0x00000000005F0000-memory.dmp	family_plugx
behavioral2/memory/4328-156-0x0000000001610000-0x0000000001640000-memory.dmp	family_plugx
behavioral2/memory/4368-157-0x0000000000DC0000-0x0000000000DF0000-memory.dmp	family_plugx
behavioral2/memory/4328-158-0x0000000001610000-0x0000000001640000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 3 IoCs

pid	Process
4452	NvSmart.exe
4220	NvSmart.exe
1968	NvSmart.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe

Loads dropped DLL 3 IoCs

pid	Process
4452	NvSmart.exe
4220	NvSmart.exe
1968	NvSmart.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files	NvSmart.exe
File opened for modification	C:\Program Files (x86)\Common Files\NvSmart.dat	NvSmart.exe
File created	C:\Program Files (x86)\Common Files\NvSmart.dat	NvSmart.exe
File opened for modification	C:\Program Files (x86)\Common Files\NvSmart.exe	NvSmart.exe
File created	C:\Program Files (x86)\Common Files\NvSmart.exe	NvSmart.exe
File opened for modification	C:\Program Files (x86)\Common Files\NvSmartMax.dll	NvSmart.exe
File created	C:\Program Files (x86)\Common Files\NvSmartMax.dll	NvSmart.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 36004500440033004600310031003100340044003600390043004200370043000000	svchost.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	NvSmart.exe
4452	NvSmart.exe
4368	svchost.exe
4368	svchost.exe
4368	svchost.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4368	svchost.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4368	svchost.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4368	svchost.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4368	svchost.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe
4328	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4368	svchost.exe
4328	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	NvSmart.exe
Token: SeTcbPrivilege	4452	NvSmart.exe
Token: SeDebugPrivilege	4220	NvSmart.exe
Token: SeTcbPrivilege	4220	NvSmart.exe
Token: SeDebugPrivilege	1968	NvSmart.exe
Token: SeTcbPrivilege	1968	NvSmart.exe
Token: SeDebugPrivilege	4368	svchost.exe
Token: SeTcbPrivilege	4368	svchost.exe
Token: SeDebugPrivilege	4328	msiexec.exe
Token: SeTcbPrivilege	4328	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4452	1124	03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe	82
PID 1124 wrote to memory of 4452	1124	03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe	82
PID 1124 wrote to memory of 4452	1124	03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe	82
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 1968 wrote to memory of 4368	1968	NvSmart.exe	85
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86
PID 4368 wrote to memory of 4328	4368	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe
"C:\Users\Admin\AppData\Local\Temp\03cbf99ae34bd4e53613ec36805e5f9ea7c2ce84011d99fc0dd37a5dcc3e8170.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmart.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmart.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452

C:\Program Files (x86)\Common Files\NvSmart.exe
"C:\Program Files (x86)\Common Files\NvSmart.exe" 100 4452
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files (x86)\Common Files\NvSmart.exe
"C:\Program Files (x86)\Common Files\NvSmart.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 4368
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NvSmart.dat

Path C:\Program Files (x86)\Common Files\NvSmart.dat
Size 120KB
SHA256 0ebcbb904423910f81d8813852a0b4d73edbcc4d4216d58b723bc130eccbc2d0
MD5 92821c7ab934963e9b04f917d272cefc
SHA1 e8c092d9f0858dda6378962f20e44ffc39245f73
SHA512 3cccbd7955a5baf3056140bfdef68e7e3e9cd193ae13a9e79074b7913360cb791dc95e9b5cff75227449ed9743dacc6711b12186b20193523915adf79d24c142
SSDEEP 3072:Bmyt3cpbk8xPbJ2v/aNt8I5ECn87s95kaeH:8A0xPl4aX5D8owF
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmart.exe

Path C:\Program Files (x86)\Common Files\NvSmart.exe
Size 43KB
SHA256 35ca38b9b7292b8c9da598ce5f2baafb76b90b66ddac366a43c77cbdf984801d
MD5 4d0c8f09a4e3bd5c063c2c4f100ed8d6
SHA1 7f9193357d84761336184851ac06464efd41a09b
SHA512 4fa141785dba9aabb01ce563f1e2d4b1e96b75a8eefd44814160520de0c3da9c084e65e494fe3566db9c1094aad46efe8b4b546236432b582c4724542f210b21
SSDEEP 768:wp+QDJgY/OTFStOWjmyPTc+6lye958ZwPOz:wpj9IexPANL58Zw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmart.exe

Path C:\Program Files (x86)\Common Files\NvSmart.exe
Size 43KB
SHA256 35ca38b9b7292b8c9da598ce5f2baafb76b90b66ddac366a43c77cbdf984801d
MD5 4d0c8f09a4e3bd5c063c2c4f100ed8d6
SHA1 7f9193357d84761336184851ac06464efd41a09b
SHA512 4fa141785dba9aabb01ce563f1e2d4b1e96b75a8eefd44814160520de0c3da9c084e65e494fe3566db9c1094aad46efe8b4b546236432b582c4724542f210b21
SSDEEP 768:wp+QDJgY/OTFStOWjmyPTc+6lye958ZwPOz:wpj9IexPANL58Zw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmart.exe

Path C:\Program Files (x86)\Common Files\NvSmart.exe
Size 43KB
SHA256 35ca38b9b7292b8c9da598ce5f2baafb76b90b66ddac366a43c77cbdf984801d
MD5 4d0c8f09a4e3bd5c063c2c4f100ed8d6
SHA1 7f9193357d84761336184851ac06464efd41a09b
SHA512 4fa141785dba9aabb01ce563f1e2d4b1e96b75a8eefd44814160520de0c3da9c084e65e494fe3566db9c1094aad46efe8b4b546236432b582c4724542f210b21
SSDEEP 768:wp+QDJgY/OTFStOWjmyPTc+6lye958ZwPOz:wpj9IexPANL58Zw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmartMax.dll

Path C:\Program Files (x86)\Common Files\NvSmartMax.dll
Size 11KB
SHA256 c164b75b738f3d85c27016b4cc9515d8dd5d12f16175e31fac2b13c5c2737fef
MD5 1fab1cd41b73e9a485c4237307c72d24
SHA1 f48a4e1cafbf00c33221c605dc2f843dba74f903
SHA512 70dd3d214dd2871364253775a404c35ae91db388108e8577d49de368a93f15ce542aa1c5408e1b4640371999d09e186741a911ed39f044320fd7ee04b7eeab85
SSDEEP 192:0ENy/gpKQq2yBx92Ol5gfLtUcynY335/wJirNmL/a7mK8tF0ou7+wNsLhZ:0Epax99l5gfmnY3mirILjugL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmartMax.dll

Path C:\Program Files (x86)\Common Files\NvSmartMax.dll
Size 11KB
SHA256 c164b75b738f3d85c27016b4cc9515d8dd5d12f16175e31fac2b13c5c2737fef
MD5 1fab1cd41b73e9a485c4237307c72d24
SHA1 f48a4e1cafbf00c33221c605dc2f843dba74f903
SHA512 70dd3d214dd2871364253775a404c35ae91db388108e8577d49de368a93f15ce542aa1c5408e1b4640371999d09e186741a911ed39f044320fd7ee04b7eeab85
SSDEEP 192:0ENy/gpKQq2yBx92Ol5gfLtUcynY335/wJirNmL/a7mK8tF0ou7+wNsLhZ:0Epax99l5gfmnY3mirILjugL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmartMax.dll

Path C:\Program Files (x86)\Common Files\NvSmartMax.dll
Size 11KB
SHA256 c164b75b738f3d85c27016b4cc9515d8dd5d12f16175e31fac2b13c5c2737fef
MD5 1fab1cd41b73e9a485c4237307c72d24
SHA1 f48a4e1cafbf00c33221c605dc2f843dba74f903
SHA512 70dd3d214dd2871364253775a404c35ae91db388108e8577d49de368a93f15ce542aa1c5408e1b4640371999d09e186741a911ed39f044320fd7ee04b7eeab85
SSDEEP 192:0ENy/gpKQq2yBx92Ol5gfLtUcynY335/wJirNmL/a7mK8tF0ou7+wNsLhZ:0Epax99l5gfmnY3mirILjugL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

bug.log

Path C:\ProgramData\SxS\bug.log
Size 622B
SHA256 f68ca5f7eb5815eb731290d1d8baf8f33c3bd83c812649e43b1c6347b58a7f2b
MD5 25ec741c4d8175b431543fdc0fc41206
SHA1 511d2c4cdb77c67cd26f2a8d58ede37d9f8b114c
SHA512 a1f1b660979943de1831da3ba74013654bcf3be314a88c6719859348ebf1a6f81468c259a50a57599b131e806c87a0f034f34aee03a1e4cfd6f13b6f9bee864c
MD5 SHA1 SHA512

Submit Download

NvSmart.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmart.dat
Size 120KB
SHA256 0ebcbb904423910f81d8813852a0b4d73edbcc4d4216d58b723bc130eccbc2d0
MD5 92821c7ab934963e9b04f917d272cefc
SHA1 e8c092d9f0858dda6378962f20e44ffc39245f73
SHA512 3cccbd7955a5baf3056140bfdef68e7e3e9cd193ae13a9e79074b7913360cb791dc95e9b5cff75227449ed9743dacc6711b12186b20193523915adf79d24c142
SSDEEP 3072:Bmyt3cpbk8xPbJ2v/aNt8I5ECn87s95kaeH:8A0xPl4aX5D8owF
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmart.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmart.exe
Size 43KB
SHA256 35ca38b9b7292b8c9da598ce5f2baafb76b90b66ddac366a43c77cbdf984801d
MD5 4d0c8f09a4e3bd5c063c2c4f100ed8d6
SHA1 7f9193357d84761336184851ac06464efd41a09b
SHA512 4fa141785dba9aabb01ce563f1e2d4b1e96b75a8eefd44814160520de0c3da9c084e65e494fe3566db9c1094aad46efe8b4b546236432b582c4724542f210b21
SSDEEP 768:wp+QDJgY/OTFStOWjmyPTc+6lye958ZwPOz:wpj9IexPANL58Zw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmart.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmart.exe
Size 43KB
SHA256 35ca38b9b7292b8c9da598ce5f2baafb76b90b66ddac366a43c77cbdf984801d
MD5 4d0c8f09a4e3bd5c063c2c4f100ed8d6
SHA1 7f9193357d84761336184851ac06464efd41a09b
SHA512 4fa141785dba9aabb01ce563f1e2d4b1e96b75a8eefd44814160520de0c3da9c084e65e494fe3566db9c1094aad46efe8b4b546236432b582c4724542f210b21
SSDEEP 768:wp+QDJgY/OTFStOWjmyPTc+6lye958ZwPOz:wpj9IexPANL58Zw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmartMax.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dll
Size 11KB
SHA256 c164b75b738f3d85c27016b4cc9515d8dd5d12f16175e31fac2b13c5c2737fef
MD5 1fab1cd41b73e9a485c4237307c72d24
SHA1 f48a4e1cafbf00c33221c605dc2f843dba74f903
SHA512 70dd3d214dd2871364253775a404c35ae91db388108e8577d49de368a93f15ce542aa1c5408e1b4640371999d09e186741a911ed39f044320fd7ee04b7eeab85
SSDEEP 192:0ENy/gpKQq2yBx92Ol5gfLtUcynY335/wJirNmL/a7mK8tF0ou7+wNsLhZ:0Epax99l5gfmnY3mirILjugL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvSmartMax.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dll
Size 11KB
SHA256 c164b75b738f3d85c27016b4cc9515d8dd5d12f16175e31fac2b13c5c2737fef
MD5 1fab1cd41b73e9a485c4237307c72d24
SHA1 f48a4e1cafbf00c33221c605dc2f843dba74f903
SHA512 70dd3d214dd2871364253775a404c35ae91db388108e8577d49de368a93f15ce542aa1c5408e1b4640371999d09e186741a911ed39f044320fd7ee04b7eeab85
SSDEEP 192:0ENy/gpKQq2yBx92Ol5gfLtUcynY335/wJirNmL/a7mK8tF0ou7+wNsLhZ:0Epax99l5gfmnY3mirILjugL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1968-150-0x0000000000E30000-0x0000000000E60000-memory.dmp

Download

memory/4220-149-0x00000000005C0000-0x00000000005F0000-memory.dmp

Download

memory/4220-154-0x00000000005C0000-0x00000000005F0000-memory.dmp

Download

memory/4328-156-0x0000000001610000-0x0000000001640000-memory.dmp

Download

memory/4328-158-0x0000000001610000-0x0000000001640000-memory.dmp

Download

memory/4368-153-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

Download

memory/4368-157-0x0000000000DC0000-0x0000000000DF0000-memory.dmp

Download

memory/4452-138-0x00000000020B0000-0x00000000021B0000-memory.dmp

Download

memory/4452-139-0x00000000006C0000-0x00000000006F0000-memory.dmp

Download