aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
84s
max time network
81s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora purecrypter downloader loader persistence spyware stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1464-66-0x00000000064C0000-0x0000000006860000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Executes dropped EXE 3 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

872 voiceadequovl.exe
1464 voiceadequovl.exe
596 voiceadequovl.exe
Loads dropped DLL 4 IoCs

Processes:

voiceadequovl.exe

pid process

872 voiceadequovl.exe
872 voiceadequovl.exe
872 voiceadequovl.exe
872 voiceadequovl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
872	voiceadequovl.exe
1464	voiceadequovl.exe
596	voiceadequovl.exe

pid	process
872	voiceadequovl.exe
872	voiceadequovl.exe
872	voiceadequovl.exe
872	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

voiceadequovl.exe

description pid process target process

PID 1464 set thread context of 596 1464 voiceadequovl.exe voiceadequovl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1088 powershell.exe
1588 powershell.exe

description	pid	process	target process
PID 1464 set thread context of 596	1464	voiceadequovl.exe	voiceadequovl.exe

pid	process
1088	powershell.exe
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1464	voiceadequovl.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeIncreaseQuotaPrivilege	1072	wmic.exe
Token: SeSecurityPrivilege	1072	wmic.exe
Token: SeTakeOwnershipPrivilege	1072	wmic.exe
Token: SeLoadDriverPrivilege	1072	wmic.exe
Token: SeSystemProfilePrivilege	1072	wmic.exe
Token: SeSystemtimePrivilege	1072	wmic.exe
Token: SeProfSingleProcessPrivilege	1072	wmic.exe
Token: SeIncBasePriorityPrivilege	1072	wmic.exe
Token: SeCreatePagefilePrivilege	1072	wmic.exe
Token: SeBackupPrivilege	1072	wmic.exe
Token: SeRestorePrivilege	1072	wmic.exe
Token: SeShutdownPrivilege	1072	wmic.exe
Token: SeDebugPrivilege	1072	wmic.exe
Token: SeSystemEnvironmentPrivilege	1072	wmic.exe
Token: SeRemoteShutdownPrivilege	1072	wmic.exe
Token: SeUndockPrivilege	1072	wmic.exe
Token: SeManageVolumePrivilege	1072	wmic.exe
Token: 33	1072	wmic.exe
Token: 34	1072	wmic.exe
Token: 35	1072	wmic.exe
Token: SeIncreaseQuotaPrivilege	1072	wmic.exe
Token: SeSecurityPrivilege	1072	wmic.exe
Token: SeTakeOwnershipPrivilege	1072	wmic.exe
Token: SeLoadDriverPrivilege	1072	wmic.exe
Token: SeSystemProfilePrivilege	1072	wmic.exe
Token: SeSystemtimePrivilege	1072	wmic.exe
Token: SeProfSingleProcessPrivilege	1072	wmic.exe
Token: SeIncBasePriorityPrivilege	1072	wmic.exe
Token: SeCreatePagefilePrivilege	1072	wmic.exe
Token: SeBackupPrivilege	1072	wmic.exe
Token: SeRestorePrivilege	1072	wmic.exe
Token: SeShutdownPrivilege	1072	wmic.exe
Token: SeDebugPrivilege	1072	wmic.exe
Token: SeSystemEnvironmentPrivilege	1072	wmic.exe
Token: SeRemoteShutdownPrivilege	1072	wmic.exe
Token: SeUndockPrivilege	1072	wmic.exe
Token: SeManageVolumePrivilege	1072	wmic.exe
Token: 33	1072	wmic.exe
Token: 34	1072	wmic.exe
Token: 35	1072	wmic.exe
Token: SeIncreaseQuotaPrivilege	1152	WMIC.exe
Token: SeSecurityPrivilege	1152	WMIC.exe
Token: SeTakeOwnershipPrivilege	1152	WMIC.exe
Token: SeLoadDriverPrivilege	1152	WMIC.exe
Token: SeSystemProfilePrivilege	1152	WMIC.exe
Token: SeSystemtimePrivilege	1152	WMIC.exe
Token: SeProfSingleProcessPrivilege	1152	WMIC.exe
Token: SeIncBasePriorityPrivilege	1152	WMIC.exe
Token: SeCreatePagefilePrivilege	1152	WMIC.exe
Token: SeBackupPrivilege	1152	WMIC.exe
Token: SeRestorePrivilege	1152	WMIC.exe
Token: SeShutdownPrivilege	1152	WMIC.exe
Token: SeDebugPrivilege	1152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1152	WMIC.exe
Token: SeRemoteShutdownPrivilege	1152	WMIC.exe
Token: SeUndockPrivilege	1152	WMIC.exe
Token: SeManageVolumePrivilege	1152	WMIC.exe
Token: 33	1152	WMIC.exe
Token: 34	1152	WMIC.exe
Token: 35	1152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1152	WMIC.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exe

description	pid	process	target process
PID 108 wrote to memory of 872	108	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 108 wrote to memory of 872	108	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 108 wrote to memory of 872	108	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 108 wrote to memory of 872	108	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 872 wrote to memory of 1464	872	voiceadequovl.exe	voiceadequovl.exe
PID 872 wrote to memory of 1464	872	voiceadequovl.exe	voiceadequovl.exe
PID 872 wrote to memory of 1464	872	voiceadequovl.exe	voiceadequovl.exe
PID 872 wrote to memory of 1464	872	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 1088	1464	voiceadequovl.exe	powershell.exe
PID 1464 wrote to memory of 1088	1464	voiceadequovl.exe	powershell.exe
PID 1464 wrote to memory of 1088	1464	voiceadequovl.exe	powershell.exe
PID 1464 wrote to memory of 1088	1464	voiceadequovl.exe	powershell.exe
PID 1464 wrote to memory of 636	1464	voiceadequovl.exe	cmd.exe
PID 1464 wrote to memory of 636	1464	voiceadequovl.exe	cmd.exe
PID 1464 wrote to memory of 636	1464	voiceadequovl.exe	cmd.exe
PID 1464 wrote to memory of 636	1464	voiceadequovl.exe	cmd.exe
PID 636 wrote to memory of 1588	636	cmd.exe	powershell.exe
PID 636 wrote to memory of 1588	636	cmd.exe	powershell.exe
PID 636 wrote to memory of 1588	636	cmd.exe	powershell.exe
PID 636 wrote to memory of 1588	636	cmd.exe	powershell.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 1464 wrote to memory of 596	1464	voiceadequovl.exe	voiceadequovl.exe
PID 596 wrote to memory of 1072	596	voiceadequovl.exe	wmic.exe
PID 596 wrote to memory of 1072	596	voiceadequovl.exe	wmic.exe
PID 596 wrote to memory of 1072	596	voiceadequovl.exe	wmic.exe
PID 596 wrote to memory of 1072	596	voiceadequovl.exe	wmic.exe
PID 596 wrote to memory of 1144	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1144	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1144	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1144	596	voiceadequovl.exe	cmd.exe
PID 1144 wrote to memory of 1152	1144	cmd.exe	WMIC.exe
PID 1144 wrote to memory of 1152	1144	cmd.exe	WMIC.exe
PID 1144 wrote to memory of 1152	1144	cmd.exe	WMIC.exe
PID 1144 wrote to memory of 1152	1144	cmd.exe	WMIC.exe
PID 596 wrote to memory of 1608	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1608	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1608	596	voiceadequovl.exe	cmd.exe
PID 596 wrote to memory of 1608	596	voiceadequovl.exe	cmd.exe
PID 1608 wrote to memory of 1488	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1488	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1488	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1488	1608	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic path win32_VideoController get name"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1144
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic cpu get name"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic cpu get name
        6⤵
        
        PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
681d2539f4c9be85853beefd61475dd4

SHA1
f298e11e572e940a9bb58454464ac2c5a3b3e2fe

SHA256
6032996cd41fb82539c28feb5adc130810bcdce7cf2c50ebed6d7de8f45e978d

SHA512
87d7db462aff1fa486f35130bc5ed9cf85bce74d895b40430dad38ab51b67679e6fcfd1db6e284d2cbf0f52143501e448f51469f3f83b411e1126746bb242fb8

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
285.6MB

MD5
01b746473d65049c779518f576c75f08

SHA1
5b680c54ed596848bd6c85901234a8731a865849

SHA256
265128433af941447afdcf8caa43de0b869effaed4e3a87e1d93a56a095b320f

SHA512
d95eafa8ea989adbe9cd862d592181f7e6a9f6f59b9b87088baf76ff81862d8519e04f2fa53ba122b1fa3bb2891948f75ac70e02c6f4437c1b4116f43960ed64

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
284.1MB

MD5
8f95687c7276e0f4f7dc27a5e6fce19f

SHA1
305df226954bf1d142838c5e2559188d8328346b

SHA256
f67c4fefe26eefb201e4af33685c5adc3115130ca0ca224ebe49b52786f56e1b

SHA512
d9400deed7317654ca29d1eef4678967b4734f738e4ca90e22e2c635d935d40d5ba00bbbec7e1f371018decf148d1dfac523de657f12f381abee675246b22810

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
194.2MB

MD5
df3fb8223c2c0c76dd2d0fbe5e4b1b5b

SHA1
bc354adb87c57620ce4ffc072ae11ae338578fb7

SHA256
ff79f3caf6290ffe86b5a4b06a5a68f7c7f9b713b0b77ab0f21205a939b6009f

SHA512
e8b4677b9dfa7a01aa887cc53ae5fef6979fb7699e955caf343b67da2eec5c91d064890830f939ba4b2c478b2db80a6dd5321f9524b58ad81b44d4eb9b59de0c

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
284.8MB

MD5
533377e3843f1f8a04b38687b7ba7448

SHA1
d3e42f9e213afe32ffd9f11ecbdc21e8972284d7

SHA256
117538702817304fba93536d138d71dafbf95832edd0ec8dbbd3bd5b188de693

SHA512
54b0bf8dcd1053421c7fbc8f77d9ec35ff30e820d158ce21cff868203d30d7b0a09273a79a75de77cd7d38880fd008bf61865e84f1d7b6801bc759e2fe5ec6b5

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
287.9MB

MD5
e4113d735199d614eaf1ae1e4388bc27

SHA1
f2437277bc3780e18a4b43384e768e84e079d3c9

SHA256
5e474c08e07491a3cd49b85d4a134580b09921382bdb1336c79b914d3ddbfc33

SHA512
d5d45e07a9681e7db1cff4ec300e571a7d5904f6b6bbb3582cf84dbb214f66aedfdb4f20c88774335fd6118a0a79672c43e2ec55f74b97c13a06ad8d9793b7f9

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
285.3MB

MD5
9b870c40688e84e3681d1957a5395369

SHA1
8fda23288329e7cd6a4335e91559ebd0f69e95c7

SHA256
05a35661a90c540d691a11ec4ebd45c91d6a790ec839dab064af7571a134e31b

SHA512
66826a1e90ea7f2233aa18ed932ae649d32a01e540e3aed42f04929330b461a9a5d9f056ebdff4651d3ed65895153f3c1262a97b48183aa2cb757142154c32d6

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
285.5MB

MD5
94348489d185ece8249fedc8ecd0884f

SHA1
9c12b8f8e29db252de6ecdcbabfbfe594793c93a

SHA256
31737ae298a7a3c1d958e843a86f4952e0309342b4fbb55891e816f2ead90ff2

SHA512
e5dce2641f4b1fb35e094304f57bd0b3de6b1d47a9dfc115d52218743170732d329f5ba185e1273a290f9e2f25d5f8880f14ed062f68eb75cc5a31e470495fbc

Download Submit
memory/596-90-0x0000000000464C20-mapping.dmp

Download
memory/596-85-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-100-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-89-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-88-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-86-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-93-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-94-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-82-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-80-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-78-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/596-77-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/636-72-0x0000000000000000-mapping.dmp

Download
memory/872-54-0x0000000000000000-mapping.dmp

Download
memory/872-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1072-95-0x0000000000000000-mapping.dmp

Download
memory/1088-71-0x000000006FB30000-0x00000000700DB000-memory.dmp

Filesize
5.7MB

Download
memory/1088-70-0x000000006FB30000-0x00000000700DB000-memory.dmp

Filesize
5.7MB

Download
memory/1088-69-0x000000006FB30000-0x00000000700DB000-memory.dmp

Filesize
5.7MB

Download
memory/1088-67-0x0000000000000000-mapping.dmp

Download
memory/1144-96-0x0000000000000000-mapping.dmp

Download
memory/1152-97-0x0000000000000000-mapping.dmp

Download
memory/1464-74-0x00000000054C0000-0x0000000005632000-memory.dmp

Filesize
1.4MB

Download
memory/1464-62-0x0000000000000000-mapping.dmp

Download
memory/1464-65-0x0000000000D90000-0x0000000001504000-memory.dmp

Filesize
7.5MB

Download
memory/1464-66-0x00000000064C0000-0x0000000006860000-memory.dmp

Filesize
3.6MB

Download
memory/1488-99-0x0000000000000000-mapping.dmp

Download
memory/1588-84-0x000000006FAE0000-0x000000007008B000-memory.dmp

Filesize
5.7MB

Download
memory/1588-73-0x0000000000000000-mapping.dmp

Download
memory/1588-101-0x000000006FAE0000-0x000000007008B000-memory.dmp

Filesize
5.7MB

Download
memory/1608-98-0x0000000000000000-mapping.dmp

Download