Overview

overview

10

Static

static

10

m1f1f3a069...5d.exe

windows7-x64

10

m1f1f3a069...5d.exe

windows10-1703-x64

10

m1f1f3a069...5d.exe

windows10-2004-x64

10

m1f1f3a069...5d.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:28

240410-cyaxtsca4310

10/04/2024, 02:28

240410-cx45aaca3610

10/04/2024, 02:28

240410-cx4hrafc6110

10/04/2024, 02:28

240410-cx37zsfc6y10

14/10/2023, 01:16

231014-bm3ysshd6t10

Analysis

  • max time kernel
    1191s
  • max time network
    1204s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/04/2024, 02:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    m1f1f3a069223072f8d6802a079235d.exe
  • Size 306KB
  • Sample240410-cx45aaca36
  • SHA256 c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot6209822134:AAHQxD-CI1YDVcNbXijXHlonsEUgv3dfYtg/sendMessage?chat_id=-1001529292045

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 42 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe
    "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1460
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2980
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1164
        • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:232
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp96C2.tmp" -C "C:\Users\Admin\AppData\Local\d67800nkmj"
            4⤵
              PID:4272
            • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
              "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1392
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:964
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3016
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:5072
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4684
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:452
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1176
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3020
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:816
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:984
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4872
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2816
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3740
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4672
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3576
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3516
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3440
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2220
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3696
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1028
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3236
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:760
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4244
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2012

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            m1f1f3a069223072f8d6802a079235d.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\m1f1f3a069223072f8d6802a079235d.exe.log
            • Size 847B
            • SHA256 50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d
            • MD5 SHA1 SHA512
            Submit Download

            m1f1f3a069223072f8d6802a079235d.exe
            • Path C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
            • Size 306KB
            • SHA256 c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp96C2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp96C2.tmp
            • Size 13.3MB
            • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdesc-consensus
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdesc-consensus
            • Size 2.7MB
            • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdescs.new
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdescs.new
            • Size 7.2MB
            • SHA256 65070ace6c81eec8b9ff7273d48f4d9969864a8b9e280f36bfe10ef55b3957a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hostname
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\host\hostname
            • Size 64B
            • SHA256 181f4bbba27d9a4ed57c33e98a5fefbcb26c06582ad662c0189943a5a3c55e0b
            • MD5 SHA1 SHA512
            Submit Download

            port.dat
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\port.dat
            • Size 4B
            • SHA256 7db08657e1d436883b51a6385ab896e95b3ffc1a7e4591b644b0e8aa49360c97
            • MD5 SHA1 SHA512
            Submit Download

            tor.exe
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
            • Size 7.4MB
            • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            torrc.txt
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt
            • Size 218B
            • SHA256 657d98eea3ac545be3dec8bf2a3f2f60f9b562ff9c4e8146f0ca51bee967c071
            • MD5 SHA1 SHA512
            Submit Download

            memory/232-12-0x000001A0D5E80000-0x000001A0D5E90000-memory.dmp
            Download

            memory/232-64-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/232-11-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/984-153-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/984-155-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1000-192-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1000-186-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1676-176-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1676-173-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1676-175-0x000002192FDE0000-0x000002192FDF0000-memory.dmp
            Download

            memory/1904-244-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1904-242-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1948-230-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/1948-232-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2168-133-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2168-135-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2412-82-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2412-76-0x000001B8935D0000-0x000001B8935E0000-memory.dmp
            Download

            memory/2412-75-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2488-260-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/2488-258-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3140-127-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3140-125-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3372-119-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3372-117-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3396-167-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3396-165-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3576-198-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3576-200-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3760-224-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/3760-222-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4056-254-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4056-256-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4204-1-0x00007FFB1CA40000-0x00007FFB1D502000-memory.dmp
            Download

            memory/4204-0-0x000002235BE70000-0x000002235BEC2000-memory.dmp
            Download

            memory/4204-2-0x000002235DDB0000-0x000002235DDC0000-memory.dmp
            Download

            memory/4204-6-0x00007FFB1CA40000-0x00007FFB1D502000-memory.dmp
            Download

            memory/4244-272-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4244-270-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4388-88-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4388-90-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4540-210-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4540-212-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4600-143-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4600-141-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4916-102-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4916-100-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4996-104-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download

            memory/4996-105-0x0000022E838A0000-0x0000022E838B0000-memory.dmp
            Download

            memory/4996-107-0x00007FFB1BC80000-0x00007FFB1C742000-memory.dmp
            Download