aurora | cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2022 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
Size

255KB
MD5

bf7a1064534e4a982fd046500aeac179
SHA1

dac39c83c573a5ab56bfcd996f59a2e5c41e2588
SHA256

cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d
SHA512

dd80625d646c1d22121019e8a9d676c53b48883dba7e31b88df51ceb4142b9fe89dcdce2db4aecf64ba61e6f6493e6d16b813473904832343011569fcde45b8e
SSDEEP

3072:o5aX4uYV1LUkJaSKmRC67c0yKLTuZjD/8pX5EkcEUIymqfh8mJH27hZY:F4JLUzSK967Ny8CZjDS5Ek8CKmmkZY

Score

10^/10

aurora smokeloader backdoor spyware stealer trojan upx

Malware Config

Extracted

Family

aurora

45.15.156.97:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/4800-133-0x00000000005F0000-0x00000000005F9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
4012	D46C.exe
4984	D71C.exe
4368	D9FB.exe
2072	DECF.exe
3696	E44E.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000231a7-153.dat	upx
behavioral1/files/0x00070000000231a7-154.dat	upx
behavioral1/memory/3696-156-0x0000000000500000-0x0000000000884000-memory.dmp	upx
behavioral1/memory/3696-195-0x0000000000500000-0x0000000000884000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2072	DECF.exe
2072	DECF.exe
2072	DECF.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	2072	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DECF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DECF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DECF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DECF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DECF.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4800	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
4800	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
4800	cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found
2080	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4164	wmic.exe
Token: SeSecurityPrivilege	4164	wmic.exe
Token: SeTakeOwnershipPrivilege	4164	wmic.exe
Token: SeLoadDriverPrivilege	4164	wmic.exe
Token: SeSystemProfilePrivilege	4164	wmic.exe
Token: SeSystemtimePrivilege	4164	wmic.exe
Token: SeProfSingleProcessPrivilege	4164	wmic.exe
Token: SeIncBasePriorityPrivilege	4164	wmic.exe
Token: SeCreatePagefilePrivilege	4164	wmic.exe
Token: SeBackupPrivilege	4164	wmic.exe
Token: SeRestorePrivilege	4164	wmic.exe
Token: SeShutdownPrivilege	4164	wmic.exe
Token: SeDebugPrivilege	4164	wmic.exe
Token: SeSystemEnvironmentPrivilege	4164	wmic.exe
Token: SeRemoteShutdownPrivilege	4164	wmic.exe
Token: SeUndockPrivilege	4164	wmic.exe
Token: SeManageVolumePrivilege	4164	wmic.exe
Token: 33	4164	wmic.exe
Token: 34	4164	wmic.exe
Token: 35	4164	wmic.exe
Token: 36	4164	wmic.exe
Token: SeIncreaseQuotaPrivilege	4164	wmic.exe
Token: SeSecurityPrivilege	4164	wmic.exe
Token: SeTakeOwnershipPrivilege	4164	wmic.exe
Token: SeLoadDriverPrivilege	4164	wmic.exe
Token: SeSystemProfilePrivilege	4164	wmic.exe
Token: SeSystemtimePrivilege	4164	wmic.exe
Token: SeProfSingleProcessPrivilege	4164	wmic.exe
Token: SeIncBasePriorityPrivilege	4164	wmic.exe
Token: SeCreatePagefilePrivilege	4164	wmic.exe
Token: SeBackupPrivilege	4164	wmic.exe
Token: SeRestorePrivilege	4164	wmic.exe
Token: SeShutdownPrivilege	4164	wmic.exe
Token: SeDebugPrivilege	4164	wmic.exe
Token: SeSystemEnvironmentPrivilege	4164	wmic.exe
Token: SeRemoteShutdownPrivilege	4164	wmic.exe
Token: SeUndockPrivilege	4164	wmic.exe
Token: SeManageVolumePrivilege	4164	wmic.exe
Token: 33	4164	wmic.exe
Token: 34	4164	wmic.exe
Token: 35	4164	wmic.exe
Token: 36	4164	wmic.exe
Token: SeShutdownPrivilege	2080	Process not Found
Token: SeCreatePagefilePrivilege	2080	Process not Found
Token: SeIncreaseQuotaPrivilege	384	WMIC.exe
Token: SeSecurityPrivilege	384	WMIC.exe
Token: SeTakeOwnershipPrivilege	384	WMIC.exe
Token: SeLoadDriverPrivilege	384	WMIC.exe
Token: SeSystemProfilePrivilege	384	WMIC.exe
Token: SeSystemtimePrivilege	384	WMIC.exe
Token: SeProfSingleProcessPrivilege	384	WMIC.exe
Token: SeIncBasePriorityPrivilege	384	WMIC.exe
Token: SeCreatePagefilePrivilege	384	WMIC.exe
Token: SeBackupPrivilege	384	WMIC.exe
Token: SeRestorePrivilege	384	WMIC.exe
Token: SeShutdownPrivilege	384	WMIC.exe
Token: SeDebugPrivilege	384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	384	WMIC.exe
Token: SeRemoteShutdownPrivilege	384	WMIC.exe
Token: SeUndockPrivilege	384	WMIC.exe
Token: SeManageVolumePrivilege	384	WMIC.exe
Token: 33	384	WMIC.exe
Token: 34	384	WMIC.exe
Token: 35	384	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4012	2080	Process not Found	89
PID 2080 wrote to memory of 4012	2080	Process not Found	89
PID 2080 wrote to memory of 4984	2080	Process not Found	90
PID 2080 wrote to memory of 4984	2080	Process not Found	90
PID 2080 wrote to memory of 4368	2080	Process not Found	92
PID 2080 wrote to memory of 4368	2080	Process not Found	92
PID 2080 wrote to memory of 2072	2080	Process not Found	93
PID 2080 wrote to memory of 2072	2080	Process not Found	93
PID 2080 wrote to memory of 2072	2080	Process not Found	93
PID 2080 wrote to memory of 3696	2080	Process not Found	94
PID 2080 wrote to memory of 3696	2080	Process not Found	94
PID 2080 wrote to memory of 3576	2080	Process not Found	95
PID 2080 wrote to memory of 3576	2080	Process not Found	95
PID 2080 wrote to memory of 3576	2080	Process not Found	95
PID 2080 wrote to memory of 3576	2080	Process not Found	95
PID 2080 wrote to memory of 4288	2080	Process not Found	96
PID 2080 wrote to memory of 4288	2080	Process not Found	96
PID 2080 wrote to memory of 4288	2080	Process not Found	96
PID 3696 wrote to memory of 4164	3696	E44E.exe	97
PID 3696 wrote to memory of 4164	3696	E44E.exe	97
PID 3696 wrote to memory of 2200	3696	E44E.exe	99
PID 3696 wrote to memory of 2200	3696	E44E.exe	99
PID 2080 wrote to memory of 2136	2080	Process not Found	101
PID 2080 wrote to memory of 2136	2080	Process not Found	101
PID 2080 wrote to memory of 2136	2080	Process not Found	101
PID 2080 wrote to memory of 2136	2080	Process not Found	101
PID 2200 wrote to memory of 384	2200	cmd.exe	102
PID 2200 wrote to memory of 384	2200	cmd.exe	102
PID 3696 wrote to memory of 2364	3696	E44E.exe	103
PID 3696 wrote to memory of 2364	3696	E44E.exe	103
PID 2364 wrote to memory of 2108	2364	cmd.exe	105
PID 2364 wrote to memory of 2108	2364	cmd.exe	105
PID 2080 wrote to memory of 2324	2080	Process not Found	106
PID 2080 wrote to memory of 2324	2080	Process not Found	106
PID 2080 wrote to memory of 2324	2080	Process not Found	106
PID 2080 wrote to memory of 2832	2080	Process not Found	107
PID 2080 wrote to memory of 2832	2080	Process not Found	107
PID 2080 wrote to memory of 2832	2080	Process not Found	107
PID 2080 wrote to memory of 2832	2080	Process not Found	107
PID 2080 wrote to memory of 1008	2080	Process not Found	108
PID 2080 wrote to memory of 1008	2080	Process not Found	108
PID 2080 wrote to memory of 1008	2080	Process not Found	108
PID 2080 wrote to memory of 1008	2080	Process not Found	108
PID 2080 wrote to memory of 792	2080	Process not Found	109
PID 2080 wrote to memory of 792	2080	Process not Found	109
PID 2080 wrote to memory of 792	2080	Process not Found	109
PID 2080 wrote to memory of 792	2080	Process not Found	109
PID 2080 wrote to memory of 3920	2080	Process not Found	110
PID 2080 wrote to memory of 3920	2080	Process not Found	110
PID 2080 wrote to memory of 3920	2080	Process not Found	110
PID 2080 wrote to memory of 4224	2080	Process not Found	111
PID 2080 wrote to memory of 4224	2080	Process not Found	111
PID 2080 wrote to memory of 4224	2080	Process not Found	111
PID 2080 wrote to memory of 4224	2080	Process not Found	111

C:\Users\Admin\AppData\Local\Temp\cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe
"C:\Users\Admin\AppData\Local\Temp\cf70b739c8248dd6c8a69bd9fdc1610b2a590a6cf03fa2cd1e80901f7892da0d.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4800

C:\Users\Admin\AppData\Local\Temp\D46C.exe
C:\Users\Admin\AppData\Local\Temp\D46C.exe
1⤵
- Executes dropped EXE
PID:4012

C:\Users\Admin\AppData\Local\Temp\D71C.exe
C:\Users\Admin\AppData\Local\Temp\D71C.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Local\Temp\D9FB.exe
C:\Users\Admin\AppData\Local\Temp\D9FB.exe
1⤵
- Executes dropped EXE
PID:4368

C:\Users\Admin\AppData\Local\Temp\DECF.exe
C:\Users\Admin\AppData\Local\Temp\DECF.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 868
  2⤵
  - Program crash
  PID:3864

C:\Users\Admin\AppData\Local\Temp\E44E.exe
C:\Users\Admin\AppData\Local\Temp\E44E.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\system32\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:384
- C:\Windows\system32\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2108

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3576

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4288

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2136

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2324

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2832

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1008

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:792

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3920

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2072 -ip 2072
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D46C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\D46C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\D71C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\D71C.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9FB.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9FB.exe

Filesize
4KB

MD5
9748489855d9dd82ab09da5e3e55b19e

SHA1
6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

SHA256
05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

SHA512
7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\DECF.exe

Filesize
391KB

MD5
32ff11fcbf02b62dcad355079d5e16bc

SHA1
9aba77828bad17c19be8241272ff245878baef72

SHA256
8a96b82fcd6dd526678e4cec01dae6ee403a033594822ab487ced1b571094be2

SHA512
4f2766aed94ca825c585f7c89bf332ed46ccf1aff4b4923fd32464f321dd9ffc7c2b34bc95154378e238d9988811a8d869f2c30e0b74cd3bd97229be0223724d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DECF.exe

Filesize
391KB

MD5
32ff11fcbf02b62dcad355079d5e16bc

SHA1
9aba77828bad17c19be8241272ff245878baef72

SHA256
8a96b82fcd6dd526678e4cec01dae6ee403a033594822ab487ced1b571094be2

SHA512
4f2766aed94ca825c585f7c89bf332ed46ccf1aff4b4923fd32464f321dd9ffc7c2b34bc95154378e238d9988811a8d869f2c30e0b74cd3bd97229be0223724d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44E.exe

Filesize
960KB

MD5
fb2021ecab72d6199c4125078070e0b9

SHA1
26f496166498db29ef8981057b6cc82a5677e4cc

SHA256
19ff750819058dbeb6888e6ad508f181c9e7aa97bd0f40b7f9784f464dd8722c

SHA512
a49637cb25d394a119b3dc7ffa77211f6f3cce3d1b304edcbfac2b8c676854d61f632bc805e4b36cfddf30f4a77398511672917169f5e7ee44c35c67803ddf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44E.exe

Filesize
960KB

MD5
fb2021ecab72d6199c4125078070e0b9

SHA1
26f496166498db29ef8981057b6cc82a5677e4cc

SHA256
19ff750819058dbeb6888e6ad508f181c9e7aa97bd0f40b7f9784f464dd8722c

SHA512
a49637cb25d394a119b3dc7ffa77211f6f3cce3d1b304edcbfac2b8c676854d61f632bc805e4b36cfddf30f4a77398511672917169f5e7ee44c35c67803ddf48

Download Submit
memory/792-186-0x0000000001210000-0x000000000121B000-memory.dmp

Filesize
44KB

Download
memory/792-185-0x0000000001220000-0x0000000001226000-memory.dmp

Filesize
24KB

Download
memory/792-202-0x0000000001220000-0x0000000001226000-memory.dmp

Filesize
24KB

Download
memory/1008-201-0x0000000001220000-0x0000000001225000-memory.dmp

Filesize
20KB

Download
memory/1008-183-0x0000000001210000-0x0000000001219000-memory.dmp

Filesize
36KB

Download
memory/1008-182-0x0000000001220000-0x0000000001225000-memory.dmp

Filesize
20KB

Download
memory/2072-162-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2072-177-0x0000000000620000-0x000000000063D000-memory.dmp

Filesize
116KB

Download
memory/2072-194-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2072-193-0x00000000006C9000-0x00000000006F1000-memory.dmp

Filesize
160KB

Download
memory/2072-178-0x0000000002730000-0x0000000003730000-memory.dmp

Filesize
16.0MB

Download
memory/2072-160-0x00000000006C9000-0x00000000006F1000-memory.dmp

Filesize
160KB

Download
memory/2072-161-0x00000000005D0000-0x0000000000604000-memory.dmp

Filesize
208KB

Download
memory/2136-172-0x0000000000F10000-0x0000000000F19000-memory.dmp

Filesize
36KB

Download
memory/2136-198-0x0000000000F20000-0x0000000000F25000-memory.dmp

Filesize
20KB

Download
memory/2136-171-0x0000000000F20000-0x0000000000F25000-memory.dmp

Filesize
20KB

Download
memory/2324-174-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/2324-199-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/2324-175-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/2832-180-0x0000000000A00000-0x0000000000A27000-memory.dmp

Filesize
156KB

Download
memory/2832-179-0x0000000000A30000-0x0000000000A52000-memory.dmp

Filesize
136KB

Download
memory/2832-200-0x0000000000A30000-0x0000000000A52000-memory.dmp

Filesize
136KB

Download
memory/3576-158-0x0000000000660000-0x000000000066B000-memory.dmp

Filesize
44KB

Download
memory/3576-157-0x0000000000670000-0x0000000000677000-memory.dmp

Filesize
28KB

Download
memory/3576-196-0x0000000000670000-0x0000000000677000-memory.dmp

Filesize
28KB

Download
memory/3696-156-0x0000000000500000-0x0000000000884000-memory.dmp

Filesize
3.5MB

Download
memory/3696-195-0x0000000000500000-0x0000000000884000-memory.dmp

Filesize
3.5MB

Download
memory/3920-189-0x0000000000380000-0x000000000038D000-memory.dmp

Filesize
52KB

Download
memory/3920-203-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/3920-188-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/4012-140-0x00007FFF1C2C0000-0x00007FFF1CD81000-memory.dmp

Filesize
10.8MB

Download
memory/4012-139-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/4224-191-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/4224-192-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/4224-204-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/4288-197-0x0000000000A80000-0x0000000000A89000-memory.dmp

Filesize
36KB

Download
memory/4288-163-0x0000000000A80000-0x0000000000A89000-memory.dmp

Filesize
36KB

Download
memory/4288-164-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/4368-148-0x00007FFF1C2C0000-0x00007FFF1CD81000-memory.dmp

Filesize
10.8MB

Download
memory/4800-133-0x00000000005F0000-0x00000000005F9000-memory.dmp

Filesize
36KB

Download
memory/4800-134-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4800-132-0x000000000063E000-0x000000000064E000-memory.dmp

Filesize
64KB

Download
memory/4800-135-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4984-144-0x00007FFF1C2C0000-0x00007FFF1CD81000-memory.dmp

Filesize
10.8MB

Download