purecrypter | cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c

Analysis

max time kernel
137s
max time network
176s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
25-01-2023 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
Size

2.4MB
MD5

a61ca48da85a9ca93ca3e2b846f49603
SHA1

e76f6120f4fee7fbee5243c9e3aa53c65cc3acbf
SHA256

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c
SHA512

24aa2c189e1420ec6fc82a9e1e3e0a0a186f238758c2decabac950e8b08a305e306eacbe544eaf7dbeb2b7080f99ff0ad2c6f573f7262a13b11a549e0ae8511d
SSDEEP

49152:qfFfLewfpME45GDDqvI/Nd1xVovNyNqy3h3aiKT0wtKXtycqm2vfOtI:OFKwR25GDDr1sNyAyg/titynB3Oa

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Signatures

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/344-162-0x0000000004F30000-0x00000000051A0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fmqkuuswyi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vmjahlk\\Fmqkuuswyi.exe\""	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

description	pid	process	target process
PID 344 set thread context of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

616 3776 WerFault.exe cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

pid	pid_target	process	target process
616	3776	WerFault.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

powershell.execd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

pid	process
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exepowershell.execd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

description	pid	process
Token: SeDebugPrivilege	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	3776	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

description	pid	process	target process
PID 344 wrote to memory of 4544	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	powershell.exe
PID 344 wrote to memory of 4544	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	powershell.exe
PID 344 wrote to memory of 4544	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	powershell.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
PID 344 wrote to memory of 3776	344	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe	cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe

C:\Users\Admin\AppData\Local\Temp\cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
"C:\Users\Admin\AppData\Local\Temp\cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Users\Admin\AppData\Local\Temp\cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
C:\Users\Admin\AppData\Local\Temp\cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1696
3⤵
- Program crash
PID:616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cd7c2065e6fd3d81d85b8eb62c828292c291703d5dcde7511f3ae2c2c53e738c.exe.log
Filesize
1KB

MD5
a4c9efdd12de4be6c51ab236c66c2ab3

SHA1
dbf3506b44d012d086a9721a9d6f754a2300abe1

SHA256
4638c54651fd448f457e56d5ac09fa125820e10799bc0f74807fc82c094da2ad

SHA512
73e75604411db3a4c3e95efe69d2bf6ae9a97dfe75152868c37d0d6f6f52937d61f7136a54f029a497d8c83b77aaeda59d7de9c71d8ca6e474c17450b00dcc0e

Download Submit
memory/344-161-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-148-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-122-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-123-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-124-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-125-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-126-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-127-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-128-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-129-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-130-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-131-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-132-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-133-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-134-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-135-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-136-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-137-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-138-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-139-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-140-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-141-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-142-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-143-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-144-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-145-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-146-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-164-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Filesize
5.0MB

Download
memory/344-163-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-149-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-162-0x0000000004F30000-0x00000000051A0000-memory.dmp

Filesize
2.4MB

Download
memory/344-151-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-152-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-153-0x0000000000480000-0x00000000006F0000-memory.dmp

Filesize
2.4MB

Download
memory/344-154-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-155-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-156-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-157-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-158-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-159-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-160-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-120-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-150-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-121-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-147-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-165-0x0000000005360000-0x00000000053F2000-memory.dmp

Filesize
584KB

Download
memory/344-166-0x0000000005310000-0x0000000005332000-memory.dmp

Filesize
136KB

Download
memory/344-167-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-168-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-169-0x0000000005E80000-0x00000000061D0000-memory.dmp

Filesize
3.3MB

Download
memory/344-170-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-171-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-172-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-173-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-174-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-175-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-176-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-177-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-178-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-179-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-180-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-181-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-182-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-183-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-184-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-185-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-186-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/344-274-0x00000000051A0000-0x00000000051F2000-memory.dmp

Filesize
328KB

Download
memory/3776-276-0x000000000041612E-mapping.dmp

Download
memory/3776-321-0x0000000002E40000-0x0000000002E66000-memory.dmp

Filesize
152KB

Download
memory/3776-318-0x0000000001500000-0x000000000150A000-memory.dmp

Filesize
40KB

Download
memory/3776-311-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4544-188-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/4544-189-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/4544-190-0x0000000077170000-0x00000000772FE000-memory.dmp

Filesize
1.6MB

Download
memory/4544-268-0x0000000009770000-0x000000000978A000-memory.dmp

Filesize
104KB

Download
memory/4544-187-0x0000000000000000-mapping.dmp

Download
memory/4544-247-0x0000000007970000-0x00000000079D6000-memory.dmp

Filesize
408KB

Download
memory/4544-248-0x0000000008030000-0x0000000008096000-memory.dmp

Filesize
408KB

Download
memory/4544-228-0x0000000007A00000-0x0000000008028000-memory.dmp

Filesize
6.2MB

Download
memory/4544-251-0x0000000008100000-0x000000000811C000-memory.dmp

Filesize
112KB

Download
memory/4544-252-0x00000000086B0000-0x00000000086FB000-memory.dmp

Filesize
300KB

Download
memory/4544-256-0x00000000089B0000-0x0000000008A26000-memory.dmp

Filesize
472KB

Download
memory/4544-267-0x000000000A090000-0x000000000A708000-memory.dmp

Filesize
6.5MB

Download
memory/4544-223-0x0000000005190000-0x00000000051C6000-memory.dmp

Filesize
216KB

Download