ef72da859c27792c1b94e8d9de4c0484205ebe1e378caa03c629ed1d1202ddc7

Analysis

max time kernel
57s
max time network
60s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
17/01/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iDK.exe
Size 139.5MB
Sample240117-txwlksafcp
SHA256 12dbb66212cd087b3c21a0f3ae114531fbadaeb5205e08885ffb48961f880ba5
MD5 5f5d21213a4c3b738aa9fe62bd84be57
SHA1 2231e836b63c4cf9b5c4abcd7a64628d7707c6b5
SHA512 17c373cdca8cc98a18a278eab90839273db5163394ed49a1a82895f0abdfbbcf2270be9a9710bd5ce7b3e57987751294d1cc471320e3bb8dd71403cda724adc9
SSDEEP 786432:/14w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:/14kpHwQjCWv+K18CedmVvEQEpcJW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4880	iDK.exe
4880	iDK.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
4	ipinfo.io
5	ipinfo.io
6	ipinfo.io

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2668	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2200	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
352	tasklist.exe
1600	tasklist.exe
768	tasklist.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	iDK.exe
4880	iDK.exe
4880	iDK.exe
4880	iDK.exe
2436	iDK.exe
2436	iDK.exe
608	powershell.exe
608	powershell.exe
4636	powershell.exe
4636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4088	wmic.exe
Token: SeSecurityPrivilege	4088	wmic.exe
Token: SeTakeOwnershipPrivilege	4088	wmic.exe
Token: SeLoadDriverPrivilege	4088	wmic.exe
Token: SeSystemProfilePrivilege	4088	wmic.exe
Token: SeSystemtimePrivilege	4088	wmic.exe
Token: SeProfSingleProcessPrivilege	4088	wmic.exe
Token: SeIncBasePriorityPrivilege	4088	wmic.exe
Token: SeCreatePagefilePrivilege	4088	wmic.exe
Token: SeBackupPrivilege	4088	wmic.exe
Token: SeRestorePrivilege	4088	wmic.exe
Token: SeShutdownPrivilege	4088	wmic.exe
Token: SeDebugPrivilege	4088	wmic.exe
Token: SeSystemEnvironmentPrivilege	4088	wmic.exe
Token: SeRemoteShutdownPrivilege	4088	wmic.exe
Token: SeUndockPrivilege	4088	wmic.exe
Token: SeManageVolumePrivilege	4088	wmic.exe
Token: 33	4088	wmic.exe
Token: 34	4088	wmic.exe
Token: 35	4088	wmic.exe
Token: 36	4088	wmic.exe
Token: SeIncreaseQuotaPrivilege	4088	wmic.exe
Token: SeSecurityPrivilege	4088	wmic.exe
Token: SeTakeOwnershipPrivilege	4088	wmic.exe
Token: SeLoadDriverPrivilege	4088	wmic.exe
Token: SeSystemProfilePrivilege	4088	wmic.exe
Token: SeSystemtimePrivilege	4088	wmic.exe
Token: SeProfSingleProcessPrivilege	4088	wmic.exe
Token: SeIncBasePriorityPrivilege	4088	wmic.exe
Token: SeCreatePagefilePrivilege	4088	wmic.exe
Token: SeBackupPrivilege	4088	wmic.exe
Token: SeRestorePrivilege	4088	wmic.exe
Token: SeShutdownPrivilege	4088	wmic.exe
Token: SeDebugPrivilege	4088	wmic.exe
Token: SeSystemEnvironmentPrivilege	4088	wmic.exe
Token: SeRemoteShutdownPrivilege	4088	wmic.exe
Token: SeUndockPrivilege	4088	wmic.exe
Token: SeManageVolumePrivilege	4088	wmic.exe
Token: 33	4088	wmic.exe
Token: 34	4088	wmic.exe
Token: 35	4088	wmic.exe
Token: 36	4088	wmic.exe
Token: SeDebugPrivilege	352	tasklist.exe
Token: SeShutdownPrivilege	4880	iDK.exe
Token: SeCreatePagefilePrivilege	4880	iDK.exe
Token: SeIncreaseQuotaPrivilege	4332	WMIC.exe
Token: SeSecurityPrivilege	4332	WMIC.exe
Token: SeTakeOwnershipPrivilege	4332	WMIC.exe
Token: SeLoadDriverPrivilege	4332	WMIC.exe
Token: SeSystemProfilePrivilege	4332	WMIC.exe
Token: SeSystemtimePrivilege	4332	WMIC.exe
Token: SeProfSingleProcessPrivilege	4332	WMIC.exe
Token: SeIncBasePriorityPrivilege	4332	WMIC.exe
Token: SeCreatePagefilePrivilege	4332	WMIC.exe
Token: SeBackupPrivilege	4332	WMIC.exe
Token: SeRestorePrivilege	4332	WMIC.exe
Token: SeShutdownPrivilege	4332	WMIC.exe
Token: SeDebugPrivilege	4332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4332	WMIC.exe
Token: SeRemoteShutdownPrivilege	4332	WMIC.exe
Token: SeUndockPrivilege	4332	WMIC.exe
Token: SeManageVolumePrivilege	4332	WMIC.exe
Token: 33	4332	WMIC.exe
Token: 34	4332	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4088	4880	iDK.exe	79
PID 4880 wrote to memory of 4088	4880	iDK.exe	79
PID 4880 wrote to memory of 3732	4880	iDK.exe	82
PID 4880 wrote to memory of 3732	4880	iDK.exe	82
PID 4880 wrote to memory of 3080	4880	iDK.exe	84
PID 4880 wrote to memory of 3080	4880	iDK.exe	84
PID 3080 wrote to memory of 352	3080	cmd.exe	86
PID 3080 wrote to memory of 352	3080	cmd.exe	86
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 1736	4880	iDK.exe	87
PID 4880 wrote to memory of 2436	4880	iDK.exe	88
PID 4880 wrote to memory of 2436	4880	iDK.exe	88
PID 4880 wrote to memory of 4604	4880	iDK.exe	90
PID 4880 wrote to memory of 4604	4880	iDK.exe	90
PID 4604 wrote to memory of 4332	4604	cmd.exe	92
PID 4604 wrote to memory of 4332	4604	cmd.exe	92
PID 4880 wrote to memory of 1132	4880	iDK.exe	93
PID 4880 wrote to memory of 1132	4880	iDK.exe	93
PID 4880 wrote to memory of 4576	4880	iDK.exe	94
PID 4880 wrote to memory of 4576	4880	iDK.exe	94
PID 1132 wrote to memory of 1600	1132	cmd.exe	97
PID 1132 wrote to memory of 1600	1132	cmd.exe	97
PID 4880 wrote to memory of 1776	4880	iDK.exe	98
PID 4880 wrote to memory of 1776	4880	iDK.exe	98
PID 4880 wrote to memory of 2776	4880	iDK.exe	101
PID 4880 wrote to memory of 2776	4880	iDK.exe	101

C:\Users\Admin\AppData\Local\Temp\iDK.exe
"C:\Users\Admin\AppData\Local\Temp\iDK.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get locale
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo wlan"
  2⤵
  PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:352
- C:\Users\Admin\AppData\Local\Temp\iDK.exe
  "C:\Users\Admin\AppData\Local\Temp\iDK.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 --field-trial-handle=1696,17864445145112576920,13774856470443943954,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\iDK.exe
  "C:\Users\Admin\AppData\Local\Temp\iDK.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1896 --field-trial-handle=1696,17864445145112576920,13774856470443943954,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=4880 get ExecutablePath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=4880 get ExecutablePath
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
  2⤵
  PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size"
  2⤵
  PID:1776
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get size
    3⤵
    - Collects information from the system
    PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:4720
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"
  2⤵
  PID:2776
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    PID:984
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %NUMBER_OF_PROCESSORS%"
  2⤵
  PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:3460
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:2148
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:4680
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4192
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:2112
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2200
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:2404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=4880 get ExecutablePath"
  2⤵
  PID:1668
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=4880 get ExecutablePath
    3⤵
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\app.asar.unpacked\node_modules\take-cam\prey-webcam.exe" -invalid youcam,cyberlink,google -frame 10 -outfile C:\Users\Admin\AppData\Local\Temp\f4xuypziUTC52YdGgp7d\System\cam.4880_Admin.jpg"
  2⤵
  PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\app.asar.unpacked\node_modules\take-cam\snapshot.exe" /T C:\Users\Admin\AppData\Local\Temp\f4xuypziUTC52YdGgp7d\System\cam.4880_Admin"
  2⤵
  PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

7f801cf1-d1ba-4c54-9cb6-24e824d67e63.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\7f801cf1-d1ba-4c54-9cb6-24e824d67e63.tmp.node
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_3v30tiz4.m5r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3v30tiz4.m5r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

b580b259-5eba-471a-b421-2d6f387e6239.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\b580b259-5eba-471a-b421-2d6f387e6239.tmp.node
Size 643KB
SHA256 4a30d3658b44882a8e0067e61e59459b163d635f1ff1397702681810867e6206
MD5 0113eef93d399e0986408754fa932dc4
SHA1 3951ed75dc671001a60488de96d42ce9ef2b0638
SHA512 77673d212e48287269a1209aa66e0e48885de3a7ebd83f1081c9f1946009eed1581edd9488f0bdf4ce687f6a8b15cdcbd31a7426bf16086607db29b87c8c7914
SSDEEP 6144:pIbsfhn81q5xh4ofdw5fOsHL0hWbZkPnXFrLqAqZwXfsdFqiCWY:p0sfh8qxhdfdAOsHL0hWyP15NPwqit
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/608-36-0x000001D21FBC0000-0x000001D21FBD0000-memory.dmp

Download

memory/608-34-0x000001D21FBC0000-0x000001D21FBD0000-memory.dmp

Download

memory/608-35-0x000001D21FBC0000-0x000001D21FBD0000-memory.dmp

Download

memory/608-32-0x000001D2381F0000-0x000001D238212000-memory.dmp

Download

memory/608-40-0x00007FFC1C590000-0x00007FFC1D052000-memory.dmp

Download

memory/608-33-0x00007FFC1C590000-0x00007FFC1D052000-memory.dmp

Download

memory/1736-12-0x00007FFC3E9B0000-0x00007FFC3E9B1000-memory.dmp

Download

memory/4636-52-0x00007FFC1C590000-0x00007FFC1D052000-memory.dmp

Download

memory/4636-53-0x0000020DF9740000-0x0000020DF9750000-memory.dmp

Download

memory/4636-54-0x0000020DF9740000-0x0000020DF9750000-memory.dmp

Download

memory/4636-55-0x0000020DF9740000-0x0000020DF9750000-memory.dmp

Download

memory/4636-58-0x00007FFC1C590000-0x00007FFC1D052000-memory.dmp

Download