b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe
Size

1.0MB
MD5

e8a38a7d4ced39ff3a03fa3899919492
SHA1

9422f5e17796ce68c30a58034cdd9123ae63efae
SHA256

b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370
SHA512

d7681e83110fb36eed70143afa839058a71756be344e39cbed863795978d9ec9c05153942da88a1e66217ee99d7e2461ce5c01712851f33522212f1158ee7fa1
SSDEEP

24576:kykIlFn/PC+KMWgxQIoGjqcAaOuUAnHj82GZK1GvEw:zkIXn/P3KqxQKjp7nD8o1Gv

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	13356134.exe

Executes dropped EXE 4 IoCs

pid	Process
1704	za857528.exe
1504	za142039.exe
1760	13356134.exe
1140	w21Sw65.exe

Loads dropped DLL 10 IoCs

pid	Process
1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe
1704	za857528.exe
1704	za857528.exe
1504	za142039.exe
1504	za142039.exe
1504	za142039.exe
1760	13356134.exe
1504	za142039.exe
1504	za142039.exe
1140	w21Sw65.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	13356134.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	13356134.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za857528.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	za857528.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za142039.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	za142039.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	13356134.exe
1760	13356134.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	13356134.exe
Token: SeDebugPrivilege	1140	w21Sw65.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1468 wrote to memory of 1704	1468	b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe	27
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1704 wrote to memory of 1504	1704	za857528.exe	28
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1760	1504	za142039.exe	29
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30
PID 1504 wrote to memory of 1140	1504	za142039.exe	30

C:\Users\Admin\AppData\Local\Temp\b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe
"C:\Users\Admin\AppData\Local\Temp\b684daa3c34aa840255d46d1ba002519587e2704cca10f4aee8d8922c6860370.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe

Filesize
774KB

MD5
c425fa2c0d692d766cc133da247080a8

SHA1
aded8fc55dd44bed8e1a1c376839f79dabcccf8e

SHA256
f9fd664a3113b660286a3bac31f88e33c8933165e8c3b3c728b5195f257d3d59

SHA512
ea73651f8ad379f6a765b281206ad65094e83453b4114a8b0ef61ea7645d8831e77919ad2a787c620b142e105ac01b8445747b43b436cd66f375cbb784aa637d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe

Filesize
774KB

MD5
c425fa2c0d692d766cc133da247080a8

SHA1
aded8fc55dd44bed8e1a1c376839f79dabcccf8e

SHA256
f9fd664a3113b660286a3bac31f88e33c8933165e8c3b3c728b5195f257d3d59

SHA512
ea73651f8ad379f6a765b281206ad65094e83453b4114a8b0ef61ea7645d8831e77919ad2a787c620b142e105ac01b8445747b43b436cd66f375cbb784aa637d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe

Filesize
592KB

MD5
c4fb61a589d41bb40140ffc6df9eb4e3

SHA1
0d0348dafc3d451b2165e82a2de02f3f0724800a

SHA256
de70984841daf6489c7275504d02ef78518432df5c0a6593a141c08dc8eb6002

SHA512
876a20009fbe8a7ef51f14bc03e04faeb98b4b41c5381a721b959dfa3b1a7eeee3a96169c30c07d9c366d81f5247e1d7a94b86b369aca0c03e5ca384e0222724

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe

Filesize
592KB

MD5
c4fb61a589d41bb40140ffc6df9eb4e3

SHA1
0d0348dafc3d451b2165e82a2de02f3f0724800a

SHA256
de70984841daf6489c7275504d02ef78518432df5c0a6593a141c08dc8eb6002

SHA512
876a20009fbe8a7ef51f14bc03e04faeb98b4b41c5381a721b959dfa3b1a7eeee3a96169c30c07d9c366d81f5247e1d7a94b86b369aca0c03e5ca384e0222724

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe

Filesize
774KB

MD5
c425fa2c0d692d766cc133da247080a8

SHA1
aded8fc55dd44bed8e1a1c376839f79dabcccf8e

SHA256
f9fd664a3113b660286a3bac31f88e33c8933165e8c3b3c728b5195f257d3d59

SHA512
ea73651f8ad379f6a765b281206ad65094e83453b4114a8b0ef61ea7645d8831e77919ad2a787c620b142e105ac01b8445747b43b436cd66f375cbb784aa637d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\za857528.exe

Filesize
774KB

MD5
c425fa2c0d692d766cc133da247080a8

SHA1
aded8fc55dd44bed8e1a1c376839f79dabcccf8e

SHA256
f9fd664a3113b660286a3bac31f88e33c8933165e8c3b3c728b5195f257d3d59

SHA512
ea73651f8ad379f6a765b281206ad65094e83453b4114a8b0ef61ea7645d8831e77919ad2a787c620b142e105ac01b8445747b43b436cd66f375cbb784aa637d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe

Filesize
592KB

MD5
c4fb61a589d41bb40140ffc6df9eb4e3

SHA1
0d0348dafc3d451b2165e82a2de02f3f0724800a

SHA256
de70984841daf6489c7275504d02ef78518432df5c0a6593a141c08dc8eb6002

SHA512
876a20009fbe8a7ef51f14bc03e04faeb98b4b41c5381a721b959dfa3b1a7eeee3a96169c30c07d9c366d81f5247e1d7a94b86b369aca0c03e5ca384e0222724

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\za142039.exe

Filesize
592KB

MD5
c4fb61a589d41bb40140ffc6df9eb4e3

SHA1
0d0348dafc3d451b2165e82a2de02f3f0724800a

SHA256
de70984841daf6489c7275504d02ef78518432df5c0a6593a141c08dc8eb6002

SHA512
876a20009fbe8a7ef51f14bc03e04faeb98b4b41c5381a721b959dfa3b1a7eeee3a96169c30c07d9c366d81f5247e1d7a94b86b369aca0c03e5ca384e0222724

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\13356134.exe

Filesize
376KB

MD5
0be4cbdedff8e963795332922708a279

SHA1
3aa8beff78ba9b7167e44a925c8d90f392a9016c

SHA256
3a3c1508f8054ac086636a90827cf0e486ec4f7e516f8ab663dd2e04cff0ab00

SHA512
f2824d78f5173dbfae4abd2b305991461ee319dfea2d7bb76e4f403b1c93763d5746599a17ad657c61cba4311f1d4961016515ce9b542278fcf3dceefd818c68

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\w21Sw65.exe

Filesize
459KB

MD5
24196892443a821ee2c506fe71864951

SHA1
af38f3bb51a0ec56b34e3b7f812adf82588dada7

SHA256
dcf7ce9a14c4e9250a0d591b298c6fa649bb62ca59f4bb5db2bf668a027e9b7e

SHA512
0ebddc2ca7947010a3dd509ec57163ea9a8e891859a023fa7a8170afda58bd68c34b9f71c7fa6630686d2bb4489da3806417c83348a837f0433de932b97e57e8

Download Submit
memory/1140-164-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-134-0x0000000004DE0000-0x0000000004E1A000-memory.dmp

Filesize
232KB

Download
memory/1140-354-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/1140-168-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-148-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-931-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-162-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-160-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-152-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-158-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-156-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-154-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-356-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-150-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-166-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-144-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-140-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-933-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-934-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-358-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-360-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-936-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/1140-133-0x0000000004C50000-0x0000000004C8C000-memory.dmp

Filesize
240KB

Download
memory/1140-146-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-135-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-138-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-136-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1140-142-0x0000000004DE0000-0x0000000004E15000-memory.dmp

Filesize
212KB

Download
memory/1760-91-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-122-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1760-121-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1760-120-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-118-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-116-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-114-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-112-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-110-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-108-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-106-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-104-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-102-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-100-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-98-0x00000000050F0000-0x0000000005130000-memory.dmp

Filesize
256KB

Download
memory/1760-97-0x00000000050F0000-0x0000000005130000-memory.dmp

Filesize
256KB

Download
memory/1760-96-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-94-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-92-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/1760-90-0x0000000000890000-0x00000000008A8000-memory.dmp

Filesize
96KB

Download
memory/1760-89-0x0000000000850000-0x000000000086A000-memory.dmp

Filesize
104KB

Download
memory/1760-88-0x00000000002E0000-0x000000000030D000-memory.dmp

Filesize
180KB

Download