mercurialgrabber | 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

Resubmissions

18-04-2023 19:35

230418-ya1z1afd91 10

18-04-2023 19:31

230418-x8wmhafd7w 7

Analysis

max time kernel
191s
max time network
194s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2023 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial.exe
Size

3.2MB
MD5

a9477b3e21018b96fc5d2264d4016e65
SHA1

493fa8da8bf89ea773aeb282215f78219a5401b7
SHA256

890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
SHA512

66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
SSDEEP

98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score

10^/10

mercurialgrabber agilenet evasion spyware stealer

Malware Config

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

output.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions output.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

output.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools output.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

output.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion output.exe
Executes dropped EXE 1 IoCs

Processes:

output.exe

pid process

4996 output.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	output.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	output.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	output.exe

pid	process
4996	output.exe

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2408-126-0x0000000005A40000-0x0000000005A5C000-memory.dmp	agile_net
behavioral1/memory/2408-127-0x0000000005BA0000-0x0000000005BC0000-memory.dmp	agile_net
behavioral1/memory/2408-128-0x0000000005BC0000-0x0000000005BE0000-memory.dmp	agile_net
behavioral1/memory/2408-129-0x0000000005BE0000-0x0000000005BF0000-memory.dmp	agile_net
behavioral1/memory/2408-130-0x0000000005C10000-0x0000000005C24000-memory.dmp	agile_net
behavioral1/memory/2408-131-0x0000000005C70000-0x0000000005CDE000-memory.dmp	agile_net
behavioral1/memory/2408-132-0x0000000005C30000-0x0000000005C4E000-memory.dmp	agile_net
behavioral1/memory/2408-133-0x0000000005CE0000-0x0000000005D16000-memory.dmp	agile_net
behavioral1/memory/2408-134-0x0000000005D30000-0x0000000005D3E000-memory.dmp	agile_net
behavioral1/memory/2408-135-0x0000000005D40000-0x0000000005D4E000-memory.dmp	agile_net
behavioral1/memory/2408-136-0x0000000006470000-0x00000000065BA000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip4.seeip.org
8 ip4.seeip.org
9 ip4.seeip.org
11 ip-api.com

flow	ioc
7	ip4.seeip.org
8	ip4.seeip.org
9	ip4.seeip.org
11	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

output.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	output.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	output.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 4996 WerFault.exe output.exe
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

output.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S output.exe

pid	pid_target	process	target process
4140	4996	WerFault.exe	output.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	output.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

output.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	output.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

output.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	output.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Mercurial.exe

pid process

2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
2408 Mercurial.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mercurial.exeoutput.exe

description pid process

Token: SeDebugPrivilege 2408 Mercurial.exe
Token: SeDebugPrivilege 4996 output.exe

pid	process
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe
2408	Mercurial.exe

description	pid	process
Token: SeDebugPrivilege	2408	Mercurial.exe
Token: SeDebugPrivilege	4996	output.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Mercurial.execsc.exe

description	pid	process	target process
PID 2408 wrote to memory of 4684	2408	Mercurial.exe	csc.exe
PID 2408 wrote to memory of 4684	2408	Mercurial.exe	csc.exe
PID 2408 wrote to memory of 4684	2408	Mercurial.exe	csc.exe
PID 4684 wrote to memory of 2892	4684	csc.exe	cvtres.exe
PID 4684 wrote to memory of 2892	4684	csc.exe	cvtres.exe
PID 4684 wrote to memory of 2892	4684	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C66.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0EF215E766F40BBAD94D7AC5C1D1CC.TMP"
3⤵
PID:2892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\output.exe
"C:\Users\Admin\AppData\Local\Temp\output.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4996 -s 1920
2⤵
- Program crash
PID:4140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES6C66.tmp
Filesize
1KB

MD5
c66e66ebc0490d029b297769ba2d2256

SHA1
687ed6585cac2b8ec6b4bc98714ce1752499e928

SHA256
94e2efa2bd6480d7265d08379c82c50182c3e6b0230a3a70e9c674d5c664705a

SHA512
c182d16e4ddd57677e8419c12db68bfd9318d74da7a64d5eec58720a789526ab3ff971e282b13e9876a41e3b506dad4d5cbff48f83f5fc70604fca42f34c6c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\output.exe
Filesize
41KB

MD5
bf67d5e42d55899ea800e6daa3afd271

SHA1
cea9873cfb4da568802595046fc81956a2c830ed

SHA256
f7a544151a58d3955b70deb0b476741d9842024a417bb0b055d353cf652f06d5

SHA512
263f58b57a844c4610ec563344742aa474b93b716e0a72f8e6b8303841c74665ccb2919ea9ff2b16f1980f1e709b7a77b6472956198e84740de2a6ebea3c5539

Download Submit
C:\Users\Admin\AppData\Local\Temp\output.exe
Filesize
41KB

MD5
bf67d5e42d55899ea800e6daa3afd271

SHA1
cea9873cfb4da568802595046fc81956a2c830ed

SHA256
f7a544151a58d3955b70deb0b476741d9842024a417bb0b055d353cf652f06d5

SHA512
263f58b57a844c4610ec563344742aa474b93b716e0a72f8e6b8303841c74665ccb2919ea9ff2b16f1980f1e709b7a77b6472956198e84740de2a6ebea3c5539

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.0.cs
Filesize
11KB

MD5
6e09c67b55a62916fc9204eff6877bf0

SHA1
5bdd02efc746008dbbb8704eecffbf34136b8695

SHA256
a4962989573ad9ff719db89381e95c64f6e0be84f31d20d346a2df632b9c9adf

SHA512
362aa38ddffeea66f1cb2ba7d42e2f0754c9b1b28a8e7b0f794ebcfc74043349e5ee9e2b58720af89d3612e0d6931b47ac12f11be274ca271227e8e622ef01e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.1.cs
Filesize
5KB

MD5
8aab1997664a604aca551b20202bfd14

SHA1
279cf8f218069cbf4351518ad6df9a783ca34bc5

SHA256
029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f

SHA512
cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.2.cs
Filesize
7KB

MD5
6fdae9afc1f8e77e882f1ba6b5859a4e

SHA1
33eb96f75ffe9a1c4f94388e7465b997320265a5

SHA256
a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d

SHA512
97bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.3.cs
Filesize
8KB

MD5
6ba707982ee7e5f0ae55ce3fa5ccad17

SHA1
d094c98491058ed49861ce82701abe1f38385f18

SHA256
19af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797

SHA512
d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.4.cs
Filesize
2KB

MD5
fae5458a5b3cee952e25d44d6eb9db85

SHA1
060d40137e9cce9f40adbb3b3763d1f020601e42

SHA256
240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06

SHA512
25f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.5.cs
Filesize
4KB

MD5
42f157ad8e79e06a142791d6e98e0365

SHA1
a05e8946e04907af3f631a7de1537d7c1bb34443

SHA256
e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed

SHA512
e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.6.cs
Filesize
6KB

MD5
8ec0f0e49ffe092345673ab4d9f45641

SHA1
401bd9e2894e9098504f7cc8f8d52f86c3ebe495

SHA256
93b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac

SHA512
60363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.7.cs
Filesize
16KB

MD5
05206d577ce19c1ef8d9341b93cd5520

SHA1
1ee5c862592045912eb45f9d94376f47b5410d3d

SHA256
e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877

SHA512
4648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.8.cs
Filesize
561B

MD5
7ae06a071e39d392c21f8395ef5a9261

SHA1
007e618097c9a099c9f5c3129e5bbf1fc7deb930

SHA256
00e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718

SHA512
5203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.9.cs
Filesize
10KB

MD5
380d15f61b0e775054eefdce7279510d

SHA1
47285dc55dafd082edd1851eea8edc2f7a1d0157

SHA256
bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717

SHA512
d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.cmdline
Filesize
833B

MD5
522cc5c5b1c0f3840523f6b6dcd2aa21

SHA1
e5631a8d56074a4be221dfed52095c1eff99bd90

SHA256
13542baf6d5bf8abfe3c7b13e5a9e7f977d09ba1379628b483c707102a65a9bf

SHA512
bcccb203750984b0592ff51b996ef154747094768cd640388116013b02d90977465aca2727061e5b14d7ff7a88b952dbc2e61fbddbc55a511a232918e263faa2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCB0EF215E766F40BBAD94D7AC5C1D1CC.TMP
Filesize
1KB

MD5
2c8070f084ff635f9e016b831cd6ef16

SHA1
84d8287a21eaf176ebd7b3efe8571b3862de873a

SHA256
535d007133ddae112030480aac0b6954d4aac98bcd69b0ef192a010770564a4f

SHA512
f7dd550984e579912cf8fa688c53985308862954688b44482c83c05d61274519812a5ea9b6ddcfcd8972d117c8e3edfa6da0e23f3c8ea17ef0bdab80bf0d4c1f

Download Submit
memory/2408-139-0x0000000009300000-0x0000000009308000-memory.dmp

Filesize
32KB

Download
memory/2408-124-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-138-0x0000000005ED0000-0x0000000005F00000-memory.dmp

Filesize
192KB

Download
memory/2408-121-0x0000000000CC0000-0x0000000000FFA000-memory.dmp

Filesize
3.2MB

Download
memory/2408-140-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-141-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-142-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-143-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-144-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-145-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-146-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-147-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-148-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-149-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-150-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-151-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-152-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-136-0x0000000006470000-0x00000000065BA000-memory.dmp

Filesize
1.3MB

Download
memory/2408-135-0x0000000005D40000-0x0000000005D4E000-memory.dmp

Filesize
56KB

Download
memory/2408-134-0x0000000005D30000-0x0000000005D3E000-memory.dmp

Filesize
56KB

Download
memory/2408-133-0x0000000005CE0000-0x0000000005D16000-memory.dmp

Filesize
216KB

Download
memory/2408-132-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Filesize
120KB

Download
memory/2408-131-0x0000000005C70000-0x0000000005CDE000-memory.dmp

Filesize
440KB

Download
memory/2408-130-0x0000000005C10000-0x0000000005C24000-memory.dmp

Filesize
80KB

Download
memory/2408-129-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

Filesize
64KB

Download
memory/2408-128-0x0000000005BC0000-0x0000000005BE0000-memory.dmp

Filesize
128KB

Download
memory/2408-127-0x0000000005BA0000-0x0000000005BC0000-memory.dmp

Filesize
128KB

Download
memory/2408-126-0x0000000005A40000-0x0000000005A5C000-memory.dmp

Filesize
112KB

Download
memory/2408-125-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/2408-137-0x00000000067B0000-0x00000000068C6000-memory.dmp

Filesize
1.1MB

Download
memory/2408-183-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-184-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-185-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-186-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-187-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-188-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-189-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-190-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-191-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-192-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-193-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-194-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-195-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-196-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-197-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-198-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-199-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-200-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-201-0x0000000005960000-0x0000000005970000-memory.dmp

Filesize
64KB

Download
memory/2408-202-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-203-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/2408-123-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/2408-122-0x0000000005F70000-0x000000000646E000-memory.dmp

Filesize
5.0MB

Download
memory/2408-207-0x0000000001690000-0x0000000001790000-memory.dmp

Filesize
1024KB

Download
memory/4996-206-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/4996-208-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/4996-212-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download