povertystealer | 15bf2e47fd14a3a676452ca26d5c2551a67140ed8e8d3f1ebce9e5fcb7aa3fb4

Analysis

max time kernel
1570s
max time network
1599s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
11-03-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sysvol.exe
Size

1.8MB
MD5

03fa96650130466d43c4b486c615294a
SHA1

88650e99ae745097810f096035a3272455e0b708
SHA256

15bf2e47fd14a3a676452ca26d5c2551a67140ed8e8d3f1ebce9e5fcb7aa3fb4
SHA512

c0583e46f845e6a53a559ca4658d7203a921ff9fabb8a5cee20551e80f056d2def72c112921968435a3e30bb0dcd08bb824159f1bca1bcfa137bf3ee3263115f
SSDEEP

49152:gwsPtT+HW9zDL6axnzPmZ/lqTpv9Dasv3xzHM3kCJwf:gwMtSAXL68nzgITZBfxxCW

Score

10^/10

povertystealer persistence stealer

Malware Config

Signatures

Detect Poverty Stealer Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2492-45-0x0000000000220000-0x000000000022A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4564 created 3404	4564	Enters.pif	55

Executes dropped EXE 4 IoCs

pid	Process
4564	Enters.pif
2672	Enters.pif
2492	calc.exe
2068	calc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\Run\App = "C:\\Windows\\SysWoW64\\calc.exe"	powershell.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	Enters.pif
File opened (read-only)	\??\m:	Enters.pif
File opened (read-only)	\??\N:	Enters.pif
File opened (read-only)	\??\O:	Enters.pif
File opened (read-only)	\??\p:	Enters.pif
File opened (read-only)	\??\y:	Enters.pif
File opened (read-only)	\??\a:	Enters.pif
File opened (read-only)	\??\k:	Enters.pif
File opened (read-only)	\??\h:	Enters.pif
File opened (read-only)	\??\H:	Enters.pif
File opened (read-only)	\??\M:	Enters.pif
File opened (read-only)	\??\o:	Enters.pif
File opened (read-only)	\??\q:	Enters.pif
File opened (read-only)	\??\s:	Enters.pif
File opened (read-only)	\??\F:	Enters.pif
File opened (read-only)	\??\g:	Enters.pif
File opened (read-only)	\??\v:	Enters.pif
File opened (read-only)	\??\V:	Enters.pif
File opened (read-only)	\??\Y:	Enters.pif
File opened (read-only)	\??\T:	Enters.pif
File opened (read-only)	\??\U:	Enters.pif
File opened (read-only)	\??\n:	Enters.pif
File opened (read-only)	\??\L:	Enters.pif
File opened (read-only)	\??\Q:	Enters.pif
File opened (read-only)	\??\r:	Enters.pif
File opened (read-only)	\??\R:	Enters.pif
File opened (read-only)	\??\S:	Enters.pif
File opened (read-only)	\??\W:	Enters.pif
File opened (read-only)	\??\G:	Enters.pif
File opened (read-only)	\??\I:	Enters.pif
File opened (read-only)	\??\z:	Enters.pif
File opened (read-only)	\??\u:	Enters.pif
File opened (read-only)	\??\Z:	Enters.pif
File opened (read-only)	\??\D:	Enters.pif
File opened (read-only)	\??\E:	Enters.pif
File opened (read-only)	\??\B:	Enters.pif
File opened (read-only)	\??\J:	Enters.pif
File opened (read-only)	\??\K:	Enters.pif
File opened (read-only)	\??\X:	Enters.pif
File opened (read-only)	\??\A:	Enters.pif
File opened (read-only)	\??\b:	Enters.pif
File opened (read-only)	\??\x:	Enters.pif
File opened (read-only)	\??\j:	Enters.pif
File opened (read-only)	\??\P:	Enters.pif
File opened (read-only)	\??\t:	Enters.pif
File opened (read-only)	\??\w:	Enters.pif
File opened (read-only)	\??\e:	Enters.pif
File opened (read-only)	\??\i:	Enters.pif

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 2672	4564	Enters.pif	85
PID 2672 set thread context of 2492	2672	Enters.pif	86
PID 2672 set thread context of 2068	2672	Enters.pif	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2404	tasklist.exe
2268	tasklist.exe

GoLang User-Agent 10 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	37	Go-http-client/1.1
HTTP User-Agent header	13	Go-http-client/1.1
HTTP User-Agent header	20	Go-http-client/1.1
HTTP User-Agent header	21	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1
HTTP User-Agent header	36	Go-http-client/1.1
HTTP User-Agent header	14	Go-http-client/1.1
HTTP User-Agent header	23	Go-http-client/1.1
HTTP User-Agent header	26	Go-http-client/1.1
HTTP User-Agent header	31	Go-http-client/1.1

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4724	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif
2672	Enters.pif
2672	Enters.pif
2672	Enters.pif
2672	Enters.pif
2672	Enters.pif
2672	Enters.pif
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeDebugPrivilege	4308	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4564	Enters.pif
4564	Enters.pif
4564	Enters.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3412	3608	sysvol.exe	73
PID 3608 wrote to memory of 3412	3608	sysvol.exe	73
PID 3608 wrote to memory of 3412	3608	sysvol.exe	73
PID 3412 wrote to memory of 2268	3412	cmd.exe	75
PID 3412 wrote to memory of 2268	3412	cmd.exe	75
PID 3412 wrote to memory of 2268	3412	cmd.exe	75
PID 3412 wrote to memory of 420	3412	cmd.exe	76
PID 3412 wrote to memory of 420	3412	cmd.exe	76
PID 3412 wrote to memory of 420	3412	cmd.exe	76
PID 3412 wrote to memory of 2404	3412	cmd.exe	78
PID 3412 wrote to memory of 2404	3412	cmd.exe	78
PID 3412 wrote to memory of 2404	3412	cmd.exe	78
PID 3412 wrote to memory of 4668	3412	cmd.exe	79
PID 3412 wrote to memory of 4668	3412	cmd.exe	79
PID 3412 wrote to memory of 4668	3412	cmd.exe	79
PID 3412 wrote to memory of 4580	3412	cmd.exe	80
PID 3412 wrote to memory of 4580	3412	cmd.exe	80
PID 3412 wrote to memory of 4580	3412	cmd.exe	80
PID 3412 wrote to memory of 4740	3412	cmd.exe	81
PID 3412 wrote to memory of 4740	3412	cmd.exe	81
PID 3412 wrote to memory of 4740	3412	cmd.exe	81
PID 3412 wrote to memory of 2476	3412	cmd.exe	82
PID 3412 wrote to memory of 2476	3412	cmd.exe	82
PID 3412 wrote to memory of 2476	3412	cmd.exe	82
PID 3412 wrote to memory of 4564	3412	cmd.exe	83
PID 3412 wrote to memory of 4564	3412	cmd.exe	83
PID 3412 wrote to memory of 4724	3412	cmd.exe	84
PID 3412 wrote to memory of 4724	3412	cmd.exe	84
PID 3412 wrote to memory of 4724	3412	cmd.exe	84
PID 4564 wrote to memory of 2672	4564	Enters.pif	85
PID 4564 wrote to memory of 2672	4564	Enters.pif	85
PID 4564 wrote to memory of 2672	4564	Enters.pif	85
PID 4564 wrote to memory of 2672	4564	Enters.pif	85
PID 2672 wrote to memory of 2492	2672	Enters.pif	86
PID 2672 wrote to memory of 2492	2672	Enters.pif	86
PID 2672 wrote to memory of 2492	2672	Enters.pif	86
PID 2672 wrote to memory of 2492	2672	Enters.pif	86
PID 2672 wrote to memory of 2068	2672	Enters.pif	87
PID 2672 wrote to memory of 2068	2672	Enters.pif	87
PID 2672 wrote to memory of 2068	2672	Enters.pif	87
PID 2672 wrote to memory of 2068	2672	Enters.pif	87
PID 2068 wrote to memory of 4308	2068	calc.exe	88
PID 2068 wrote to memory of 4308	2068	calc.exe	88
PID 2068 wrote to memory of 4308	2068	calc.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\sysvol.exe
  "C:\Users\Admin\AppData\Local\Temp\sysvol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:420
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2404
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:4668
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 32046
      4⤵
      PID:4580
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Compound + Injection + Emotions + Worm + Participants + Richmond + Alot 32046\Enters.pif
      4⤵
      PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Disco 32046\r
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\32046\Enters.pif
      32046\Enters.pif 32046\r
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4564
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4724
- C:\Users\Admin\AppData\Local\Temp\32046\Enters.pif
  C:\Users\Admin\AppData\Local\Temp\32046\Enters.pif
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWoW64\calc.exe
    C:\Windows\SysWoW64\calc.exe
    3⤵
    - Executes dropped EXE
    PID:2492
- - C:\Windows\SysWoW64\calc.exe
    C:\Windows\SysWoW64\calc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Windows\SysWoW64\calc.exe\" }"
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32046\Enters.pif

Filesize
1.0MB

MD5
bfa84dbde0df8f1cad3e179bd46a6e34

SHA1
06ae3c38d4b2f8125656268925ebde9eca6a1f9e

SHA256
6de412b8674ffba5d78ff9d36abffbe2cf86fd08b2231592fca2fcf41f1f2314

SHA512
edd4c839437570003e1cc4a04e6cb7bf8c70c0ebdae741e69782e9bdf47c42441cd8d709170898859b94b3248cccf0e9dfa5e183c110b93ded935ce69a0ff82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\32046\Enters.pif

Filesize
258KB

MD5
bde17ad7c1841f36662a1241e1b6b128

SHA1
ce2f0b19da0651edbc1ec39da4b2c487970206aa

SHA256
48bd22986a35562067231d88f73f6a695290ae77fe09865ad1e94807f019fc72

SHA512
f24a5aa2c8609271c8b26c0eaf8a7d09b1697e969a4cb4b6c9b03858f98b681d52dac6fa2817ff20e00c5748007840180be59273296ca1be4f94bbfa173b2260

Download Submit
C:\Users\Admin\AppData\Local\Temp\Alot

Filesize
45KB

MD5
0c257b9edbcc7f41af6e1027bc0713ee

SHA1
2149a7bb22476f85610c842c34628b2f22d8a549

SHA256
7ac226e081d090f2e3cb99104b4226fcd5e77cb83f7edb23081c1a2bd376533c

SHA512
f98b584e5112a81336ad4d7f2a1a4066028fc0c9d7a0b5b148172bd4c9a0485983ea868522a61999415837fdbd73401cb703138729e03831dc39bbe6c1f3f25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bathrooms

Filesize
13KB

MD5
a0d9b89b48e8fc49b82d019ee8500484

SHA1
5ca4d2e68d734e2314bc226f0bd6b5c04e0bdac3

SHA256
f231fe2acf36b89ade78b80eb336650de0e4a7e9bfee25e70bce55a93c77e02a

SHA512
1ac26f3815f4477a1ba6e73fe90587952fda18dd4da2ccd201bb5a36eebbe76270ace8b5f8764e279568ed394e5bdcf9ee10a429ad6c76f9b462c37043034fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compound

Filesize
161KB

MD5
da2be5607513a22a9d61d9538f5f0636

SHA1
e77975bb6f507b4089409a06ab2226a6d54bfefd

SHA256
640dd32f2764bdb5c0578093a02e828ff53e18d397512a1992bba583d1d2e648

SHA512
1f432b70928e2b41fe74427e086bca411c88710adba700c32bc6089d02684edd04859503269b95bfa64be7439ebbfd41d928d9a464717517db18e68bc3eb63f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Disco

Filesize
2.8MB

MD5
8de31c24cb7fe99ff6348875de7cd146

SHA1
8e2afafc129d1ddfc6de010029bb867f1708c6f6

SHA256
dc30e0b588b256bd593502a28b6ce43f0da029b38fd70408b19b415d219066df

SHA512
6a20368a0cbc03e25fb699815f584727c050f4b583ff8ee467e4a03ce4123c29d2f90dc8a4745831f5bc860b7deaa68a2bc19364c46bfe136956d265539ac133

Download Submit
C:\Users\Admin\AppData\Local\Temp\Emotions

Filesize
261KB

MD5
8a83e45fdfd2f28ef8210428fecdef9c

SHA1
db669761c961b72e7771cd8317c582ef8e48ddd1

SHA256
7e9d688abe2dd7d1ac4796a62d9e816d8c3efe719f2de72ce6c49221e027d2a7

SHA512
74dff439e42139117e9d384cb6323039683aaf5c18ed71285eec65d215eb4bf4a4c3e284231f1e7da6af9147606e9ccf13f081fb84f7f311f4e444878a7ab1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Injection

Filesize
194KB

MD5
4d21c2eec34495a74f67de9c7944bff3

SHA1
f9241a3fc121e397e23d6f3d07a3ee24b14137c2

SHA256
647a49b0eab7039c74d69e4142ed1be7f01afe9cbd6483d01039cf5b289973da

SHA512
8091201ebe4c08b105e558d2085aed1e90366ce289effa3e2d2a6b51d9364f1f68e3c1d8e54502931800a34d469152bb615e688d7563ac8b299de02c7161110c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Participants

Filesize
108KB

MD5
53c678fa488852a4533e20624a3f4ac2

SHA1
22af659f0f7b6f09e3780ecafa87dff857c29707

SHA256
33f67ac58e056d541e9ffc261620bb6069bc3bdc0690cf6b1b4402cf64476da4

SHA512
79f7f93f9bc6b731bed2a69868cf2451b4c255fda7500914e8a0580b0fa6a8d468b2a2ec27c01f9b007e0addf9b5bc1abd569edeea16496464461cb09cb71fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Richmond

Filesize
166KB

MD5
bc70f3222d729f92658b32a28c6d7375

SHA1
8591ee5231e1efcf3eadc507909ec98b2cf29614

SHA256
5f9ba61683e3b51ca21cb15674306b7c58b62ee68210d96ecf8fb00b1d396a2f

SHA512
10e7738f01e40321e305f89115df545c29a60bad47b91fca651cec8d1dcacb4551c72f838ac0a10f7d5739090d042ac429c85ebced5056809d0251d8c909f3c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Worm

Filesize
111KB

MD5
1624046c22d7d232e3ad77d456743551

SHA1
6ac978fe79d62baec9626ae3d18e2263ea91ede7

SHA256
0795d6a6fdc1bac55de379cd7f33e4440dc3645e748f91d2b3b4dddf38a8635a

SHA512
da89fc52fab7905d82fd1d9abb92ba53ec5f93f1ed296acab297aeeb8ce0b708052f8b519300926323001274d769b859778fbb7e736375f6e7c196f6287dcdc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4lbdxkj.14m.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2068-128-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-122-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-137-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-136-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-134-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-133-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-131-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-140-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-130-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-142-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-99-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-143-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-98-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-94-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-48-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-127-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-125-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-124-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-123-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-138-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-121-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-119-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-118-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-117-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-116-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-115-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-113-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-144-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-112-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-111-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-109-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-105-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-104-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-101-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2068-93-0x0000000000820000-0x000000000103C000-memory.dmp

Filesize
8.1MB

Download
memory/2492-45-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2492-44-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/2672-36-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-39-0x000001EA2ED80000-0x000001EA2ED83000-memory.dmp

Filesize
12KB

Download
memory/2672-26-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-27-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-29-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-30-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-31-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-32-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-33-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-34-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-35-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/2672-37-0x000001EA2E850000-0x000001EA2E9FC000-memory.dmp

Filesize
1.7MB

Download
memory/4308-66-0x0000000007E40000-0x0000000007E8B000-memory.dmp

Filesize
300KB

Download
memory/4308-62-0x0000000007640000-0x0000000007990000-memory.dmp

Filesize
3.3MB

Download
memory/4308-58-0x0000000006C10000-0x0000000007238000-memory.dmp

Filesize
6.2MB

Download
memory/4308-57-0x00000000065D0000-0x00000000065E0000-memory.dmp

Filesize
64KB

Download
memory/4308-56-0x00000000065D0000-0x00000000065E0000-memory.dmp

Filesize
64KB

Download
memory/4308-55-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/4308-54-0x0000000006450000-0x0000000006486000-memory.dmp

Filesize
216KB

Download
memory/4308-60-0x00000000072B0000-0x0000000007316000-memory.dmp

Filesize
408KB

Download
memory/4308-61-0x0000000007320000-0x0000000007386000-memory.dmp

Filesize
408KB

Download
memory/4308-59-0x0000000006A80000-0x0000000006AA2000-memory.dmp

Filesize
136KB

Download
memory/4308-65-0x0000000007390000-0x00000000073AC000-memory.dmp

Filesize
112KB

Download
memory/4308-92-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/4308-67-0x0000000007BD0000-0x0000000007C46000-memory.dmp

Filesize
472KB

Download
memory/4308-82-0x0000000008AD0000-0x0000000008B64000-memory.dmp

Filesize
592KB

Download
memory/4308-83-0x0000000008A00000-0x0000000008A1A000-memory.dmp

Filesize
104KB

Download
memory/4308-84-0x0000000008A60000-0x0000000008A82000-memory.dmp

Filesize
136KB

Download
memory/4308-85-0x0000000009320000-0x000000000981E000-memory.dmp

Filesize
5.0MB

Download
memory/4308-88-0x00000000065D0000-0x00000000065E0000-memory.dmp

Filesize
64KB

Download
memory/4564-24-0x000001E6503F0000-0x000001E6503F1000-memory.dmp

Filesize
4KB

Download