0d900cb2be48cef95db3dbe86221d8d1007ba294b963ee580c2293c6be37f07a

Resubmissions

02/03/2024, 17:29

240302-v2y3yafh788

02/03/2024, 17:24

240302-vysrrafh3810

02/03/2024, 17:22

240302-vxn26sfd2110

Analysis

max time kernel
105s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2024, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crazyCore.exe
Size 15.0MB
Sample240302-vysrrafh38
SHA256 0d900cb2be48cef95db3dbe86221d8d1007ba294b963ee580c2293c6be37f07a
MD5 3e69eb9b5ab82999bdc78d6232917e2f
SHA1 3516807c3f86bfb9298cfb9840dacbff99fb8f48
SHA512 f0f0f3dc549d989e710b3db10674629adaed4291e700f38fdcfa52ab4847a02aecf63fbc0197a747fae2ca997a6a6e8ed454e58e83ebbdae20cb30d01810de9e
SSDEEP 49152:celaraJaKaoCNpHWuZkYZ+RYkwhtzLjxI8LbX154Kx3bvQQz5RrlD1ZNyWO1MO9U:v3W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4568	attrib.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1748	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	crazyCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	crazyCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	crazyCore.exe
Key created	\Registry\User\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\NotificationData	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	crazyCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	crazyCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	crazyCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	crazyCore.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	crazyCore.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2472	WINWORD.EXE
2472	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1160	crazyCore.exe
1136	powershell.exe
1136	powershell.exe
4660	powershell.exe
4660	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	crazyCore.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1160	crazyCore.exe
1160	crazyCore.exe
2472	WINWORD.EXE
2472	WINWORD.EXE
2472	WINWORD.EXE
2472	WINWORD.EXE
2472	WINWORD.EXE
2472	WINWORD.EXE
2472	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1440	1160	crazyCore.exe	81
PID 1160 wrote to memory of 1440	1160	crazyCore.exe	81
PID 1440 wrote to memory of 1136	1440	cmd.exe	83
PID 1440 wrote to memory of 1136	1440	cmd.exe	83
PID 1136 wrote to memory of 1868	1136	powershell.exe	84
PID 1136 wrote to memory of 1868	1136	powershell.exe	84
PID 1160 wrote to memory of 4100	1160	crazyCore.exe	85
PID 1160 wrote to memory of 4100	1160	crazyCore.exe	85
PID 4100 wrote to memory of 4568	4100	cmd.exe	87
PID 4100 wrote to memory of 4568	4100	cmd.exe	87
PID 4100 wrote to memory of 4660	4100	cmd.exe	88
PID 4100 wrote to memory of 4660	4100	cmd.exe	88
PID 1160 wrote to memory of 4220	1160	crazyCore.exe	89
PID 1160 wrote to memory of 4220	1160	crazyCore.exe	89
PID 4220 wrote to memory of 1748	4220	cmd.exe	91
PID 4220 wrote to memory of 1748	4220	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4568	attrib.exe

C:\Users\Admin\AppData\Local\Temp\crazyCore.exe
"C:\Users\Admin\AppData\Local\Temp\crazyCore.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -Command reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications' /v DisableNotifications /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications' /v DisableNotifications /t REG_DWORD /d 1 /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender notification settings
      PID:1868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mkdir \\.\C:\ProgramData\Nul & attrib +r +h +s \\.\C:\ProgramData\Nul & powershell -Command Add-MpPreference -ExclusionPath @('C:\ProgramData', 'C:\Windows\system32\svchost.exe') -ExclusionExtension '.exe'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s \\.\C:\ProgramData\Nul
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath @('C:\ProgramData', 'C:\Windows\system32\svchost.exe') -ExclusionExtension '.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc create "nulhost" binpath="C:\ProgramData\Nul\nulhost.exe" start="auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\sc.exe
    sc create "nulhost" binpath="C:\ProgramData\Nul\nulhost.exe" start="auto"
    3⤵
    - Launches sc.exe
    PID:1748

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ResolveFormat.vbe"
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1bdc4f0e8c0845ba527337f1e791da5873c34dff15eb33c71a5aba89e4db4c80
MD5 9e9cde84e97360fb39f64e3697c25587
SHA1 02f67f54c54a08320a5331e464dc77b2816fbc97
SHA512 c719f5adf610599f0e57df5241da9b3fb595839fcbf955acbf4007ebc75d400916cec75cf9f24f72be6118237641c7800ae9b4c28b585b71a63d02a5789ca044
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wecmk2u0.tjk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wecmk2u0.tjk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 202B
SHA256 fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0
MD5 4566d1d70073cd75fe35acb78ff9d082
SHA1 f602ecc057a3c19aa07671b34b4fdd662aa033cc
SHA512 b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8
MD5 SHA1 SHA512

Submit Download

memory/1136-20-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/1136-28-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/1136-21-0x000001C3A1270000-0x000001C3A1280000-memory.dmp

Download

memory/1136-19-0x000001C3A1210000-0x000001C3A1232000-memory.dmp

Download

memory/1160-12-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-5-0x000001FA59550000-0x000001FA59558000-memory.dmp

Download

memory/1160-10-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-11-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/1160-42-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-13-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-8-0x000001FA71E40000-0x000001FA71E4E000-memory.dmp

Download

memory/1160-7-0x000001FA71FF0000-0x000001FA72028000-memory.dmp

Download

memory/1160-6-0x000001FA59540000-0x000001FA5954A000-memory.dmp

Download

memory/1160-9-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-25-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-4-0x000001FA71E80000-0x000001FA71EC0000-memory.dmp

Download

memory/1160-3-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-2-0x000001FA72090000-0x000001FA720A0000-memory.dmp

Download

memory/1160-0-0x000001FA56940000-0x000001FA57842000-memory.dmp

Download

memory/1160-49-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/1160-1-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/2472-50-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-64-0x00007FFB53E50000-0x00007FFB53E60000-memory.dmp

Download

memory/2472-111-0x00007FFB94FE0000-0x00007FFB9509D000-memory.dmp

Download

memory/2472-110-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-109-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-52-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-54-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-56-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-55-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-58-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-57-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-59-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-60-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-53-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-51-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-61-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-62-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-108-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-63-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-65-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-67-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-66-0x00007FFB53E50000-0x00007FFB53E60000-memory.dmp

Download

memory/2472-69-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-70-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-68-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-72-0x00007FFB96180000-0x00007FFB96389000-memory.dmp

Download

memory/2472-73-0x00007FFB94FE0000-0x00007FFB9509D000-memory.dmp

Download

memory/2472-107-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/2472-106-0x00007FFB56210000-0x00007FFB56220000-memory.dmp

Download

memory/4660-38-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download

memory/4660-43-0x0000020663080000-0x0000020663090000-memory.dmp

Download

memory/4660-39-0x0000020663080000-0x0000020663090000-memory.dmp

Download

memory/4660-41-0x0000020663080000-0x0000020663090000-memory.dmp

Download

memory/4660-45-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp

Download