33c1eb45e8e828534b580ab6d1cc35d4afe358664986ef1445ed9ac35e2d387b

Analysis

max time kernel
91s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ConsoleApplication2.exe
Size 4.4MB
Sample240608-q737macb9y
SHA256 33c1eb45e8e828534b580ab6d1cc35d4afe358664986ef1445ed9ac35e2d387b
MD5 fff59059fa031b92be336c2cf08f300f
SHA1 a8dd26abdadb49c50de05dea9d0d06445d1f075c
SHA512 2833fce892be6506a734c8010cfddc0ea68e2c82434c9d9df15745e500b22ad47f45005b7ce1cb78939ed155fc0793a84a609c218bf4961025752f2244afc14b
SSDEEP 49152:DtvRpO1EzFoYHobTIE7ZgTEjwh9MAG6BPJnWqfwDgy5YcS/w9QdHPh2zzCx74N+h:DtvRpO1MFCcKZc8dbK/wC2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	discord.com
1	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
2	ipinfo.io
5	ipinfo.io
12	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4424	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4256	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2184	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3132	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
248	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4140	powershell.exe
4140	powershell.exe
3704	powershell.exe
3704	powershell.exe
4424	powershell.exe
4424	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1360	WMIC.exe
Token: SeSecurityPrivilege	1360	WMIC.exe
Token: SeTakeOwnershipPrivilege	1360	WMIC.exe
Token: SeLoadDriverPrivilege	1360	WMIC.exe
Token: SeSystemProfilePrivilege	1360	WMIC.exe
Token: SeSystemtimePrivilege	1360	WMIC.exe
Token: SeProfSingleProcessPrivilege	1360	WMIC.exe
Token: SeIncBasePriorityPrivilege	1360	WMIC.exe
Token: SeCreatePagefilePrivilege	1360	WMIC.exe
Token: SeBackupPrivilege	1360	WMIC.exe
Token: SeRestorePrivilege	1360	WMIC.exe
Token: SeShutdownPrivilege	1360	WMIC.exe
Token: SeDebugPrivilege	1360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1360	WMIC.exe
Token: SeRemoteShutdownPrivilege	1360	WMIC.exe
Token: SeUndockPrivilege	1360	WMIC.exe
Token: SeManageVolumePrivilege	1360	WMIC.exe
Token: 33	1360	WMIC.exe
Token: 34	1360	WMIC.exe
Token: 35	1360	WMIC.exe
Token: 36	1360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1360	WMIC.exe
Token: SeSecurityPrivilege	1360	WMIC.exe
Token: SeTakeOwnershipPrivilege	1360	WMIC.exe
Token: SeLoadDriverPrivilege	1360	WMIC.exe
Token: SeSystemProfilePrivilege	1360	WMIC.exe
Token: SeSystemtimePrivilege	1360	WMIC.exe
Token: SeProfSingleProcessPrivilege	1360	WMIC.exe
Token: SeIncBasePriorityPrivilege	1360	WMIC.exe
Token: SeCreatePagefilePrivilege	1360	WMIC.exe
Token: SeBackupPrivilege	1360	WMIC.exe
Token: SeRestorePrivilege	1360	WMIC.exe
Token: SeShutdownPrivilege	1360	WMIC.exe
Token: SeDebugPrivilege	1360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1360	WMIC.exe
Token: SeRemoteShutdownPrivilege	1360	WMIC.exe
Token: SeUndockPrivilege	1360	WMIC.exe
Token: SeManageVolumePrivilege	1360	WMIC.exe
Token: 33	1360	WMIC.exe
Token: 34	1360	WMIC.exe
Token: 35	1360	WMIC.exe
Token: 36	1360	WMIC.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4256	WMIC.exe
Token: SeSecurityPrivilege	4256	WMIC.exe
Token: SeTakeOwnershipPrivilege	4256	WMIC.exe
Token: SeLoadDriverPrivilege	4256	WMIC.exe
Token: SeSystemProfilePrivilege	4256	WMIC.exe
Token: SeSystemtimePrivilege	4256	WMIC.exe
Token: SeProfSingleProcessPrivilege	4256	WMIC.exe
Token: SeIncBasePriorityPrivilege	4256	WMIC.exe
Token: SeCreatePagefilePrivilege	4256	WMIC.exe
Token: SeBackupPrivilege	4256	WMIC.exe
Token: SeRestorePrivilege	4256	WMIC.exe
Token: SeShutdownPrivilege	4256	WMIC.exe
Token: SeDebugPrivilege	4256	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4256	WMIC.exe
Token: SeRemoteShutdownPrivilege	4256	WMIC.exe
Token: SeUndockPrivilege	4256	WMIC.exe
Token: SeManageVolumePrivilege	4256	WMIC.exe
Token: 33	4256	WMIC.exe
Token: 34	4256	WMIC.exe
Token: 35	4256	WMIC.exe
Token: 36	4256	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4788	1220	ConsoleApplication2.exe	79
PID 1220 wrote to memory of 4788	1220	ConsoleApplication2.exe	79
PID 1220 wrote to memory of 4788	1220	ConsoleApplication2.exe	79
PID 4788 wrote to memory of 248	4788	cmd.exe	80
PID 4788 wrote to memory of 248	4788	cmd.exe	80
PID 4788 wrote to memory of 248	4788	cmd.exe	80
PID 1220 wrote to memory of 1980	1220	ConsoleApplication2.exe	81
PID 1220 wrote to memory of 1980	1220	ConsoleApplication2.exe	81
PID 1220 wrote to memory of 1980	1220	ConsoleApplication2.exe	81
PID 1980 wrote to memory of 1360	1980	cmd.exe	82
PID 1980 wrote to memory of 1360	1980	cmd.exe	82
PID 1980 wrote to memory of 1360	1980	cmd.exe	82
PID 1220 wrote to memory of 3916	1220	ConsoleApplication2.exe	84
PID 1220 wrote to memory of 3916	1220	ConsoleApplication2.exe	84
PID 1220 wrote to memory of 3916	1220	ConsoleApplication2.exe	84
PID 3916 wrote to memory of 4140	3916	cmd.exe	85
PID 3916 wrote to memory of 4140	3916	cmd.exe	85
PID 3916 wrote to memory of 4140	3916	cmd.exe	85
PID 1220 wrote to memory of 1636	1220	ConsoleApplication2.exe	86
PID 1220 wrote to memory of 1636	1220	ConsoleApplication2.exe	86
PID 1220 wrote to memory of 1636	1220	ConsoleApplication2.exe	86
PID 1636 wrote to memory of 4256	1636	cmd.exe	87
PID 1636 wrote to memory of 4256	1636	cmd.exe	87
PID 1636 wrote to memory of 4256	1636	cmd.exe	87
PID 1220 wrote to memory of 3392	1220	ConsoleApplication2.exe	88
PID 1220 wrote to memory of 3392	1220	ConsoleApplication2.exe	88
PID 1220 wrote to memory of 3392	1220	ConsoleApplication2.exe	88
PID 3392 wrote to memory of 4572	3392	cmd.exe	89
PID 3392 wrote to memory of 4572	3392	cmd.exe	89
PID 3392 wrote to memory of 4572	3392	cmd.exe	89
PID 1220 wrote to memory of 2952	1220	ConsoleApplication2.exe	90
PID 1220 wrote to memory of 2952	1220	ConsoleApplication2.exe	90
PID 1220 wrote to memory of 2952	1220	ConsoleApplication2.exe	90
PID 2952 wrote to memory of 3572	2952	cmd.exe	91
PID 2952 wrote to memory of 3572	2952	cmd.exe	91
PID 2952 wrote to memory of 3572	2952	cmd.exe	91
PID 1220 wrote to memory of 760	1220	ConsoleApplication2.exe	92
PID 1220 wrote to memory of 760	1220	ConsoleApplication2.exe	92
PID 1220 wrote to memory of 760	1220	ConsoleApplication2.exe	92
PID 760 wrote to memory of 4964	760	cmd.exe	93
PID 760 wrote to memory of 4964	760	cmd.exe	93
PID 760 wrote to memory of 4964	760	cmd.exe	93
PID 1220 wrote to memory of 1104	1220	ConsoleApplication2.exe	94
PID 1220 wrote to memory of 1104	1220	ConsoleApplication2.exe	94
PID 1220 wrote to memory of 1104	1220	ConsoleApplication2.exe	94
PID 1104 wrote to memory of 3704	1104	cmd.exe	95
PID 1104 wrote to memory of 3704	1104	cmd.exe	95
PID 1104 wrote to memory of 3704	1104	cmd.exe	95
PID 1220 wrote to memory of 5016	1220	ConsoleApplication2.exe	96
PID 1220 wrote to memory of 5016	1220	ConsoleApplication2.exe	96
PID 1220 wrote to memory of 5016	1220	ConsoleApplication2.exe	96
PID 5016 wrote to memory of 2184	5016	cmd.exe	97
PID 5016 wrote to memory of 2184	5016	cmd.exe	97
PID 5016 wrote to memory of 2184	5016	cmd.exe	97
PID 1220 wrote to memory of 2864	1220	ConsoleApplication2.exe	98
PID 1220 wrote to memory of 2864	1220	ConsoleApplication2.exe	98
PID 1220 wrote to memory of 2864	1220	ConsoleApplication2.exe	98
PID 2864 wrote to memory of 3132	2864	cmd.exe	99
PID 2864 wrote to memory of 3132	2864	cmd.exe	99
PID 2864 wrote to memory of 3132	2864	cmd.exe	99
PID 1220 wrote to memory of 1580	1220	ConsoleApplication2.exe	101
PID 1220 wrote to memory of 1580	1220	ConsoleApplication2.exe	101
PID 1220 wrote to memory of 1580	1220	ConsoleApplication2.exe	101
PID 1580 wrote to memory of 1436	1580	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 1.1.1.1
    3⤵
    - Runs ping.exe
    PID:248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get currentrefreshrate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get currentrefreshrate
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-Content (Get-PSReadlineOption).HistorySavePath
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Content (Get-PSReadlineOption).HistorySavePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
    3⤵
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
  2⤵
  PID:3272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c4495660ccbec131a9d9a4af4d1ff91d00ba3777ffd788b17e4ac9e2eee8e398
MD5 432a285e3a9d698d88ffc477ad65a8ae
SHA1 4829c0c8ac4e04c2c175dac2a2f9fee2329a845f
SHA512 61a711e50d681418912acd218d6cb1885493f067504062853709a53acc444af4617be5bd4efdaa30f74341196d123880715a799f4382b33c3e413e254a26dfe9
SSDEEP 384:wM3HK6mS1ZpAPFRHEMEGHYnNzjs2xtg+NoKI59x9minVoFci:55mS5GRPEW2zj7xtgGoKax9m45i
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e9d674b33ca2cd5ec80938d782e385eff57a7f706369e11925560b46cbcaaa47
MD5 febebc1c70392ed173456f7ea7fdb74a
SHA1 a0898d3de2ed7b8b67c6c28d228871b817130b9a
SHA512 7562797fad2b6f14ea4fdeb0163f0bef8918114d4d3bfd73542483d3d45a24b43354c2d25b98e7636c23f5932c4405900572b6d5f8a8e4c8d1ea3958c6c4cdca
SSDEEP 384:nM3HXh6SG5uUdRhAxDje7vjsat+Na+csaIb/sHdqEDMlUBC:MnsS/cRMqvjNC+0sU3UA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nagogy-Grabber (Admin).zip

Path C:\Users\Admin\AppData\Local\Temp\LyuH736bPEFc6tXX\Nagogy-Grabber (Admin).zip
Size 195KB
SHA256 9f567aaf6e13866b722b26906801fdd8a4573481dbf0ef1f811e9125c4fb8be6
MD5 d964fcc275b97d6cfda564e36295b5a8
SHA1 3712c653cfb82ee5f3e31ceed65b177817aaad66
SHA512 9966eb81ef2ee33e52dd5f36544a0d4fde85739a9c507401fd98201acf10e3743dc8a50fb0cb6ef98b98c626b56356eb5f2816e3c7b3fa43bcd5f253c6773b36
SSDEEP 6144:NDOqgNBJoE3AUjkijP6c1n+B1b2grivDY0M:NDe39AU4ijP6cJM9ri/M
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2hpwane3.byr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hpwane3.byr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3704-39-0x00000000063E0000-0x0000000006426000-memory.dmp

Download

memory/3704-38-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Download

memory/3704-28-0x0000000005910000-0x0000000005C67000-memory.dmp

Download

memory/4140-6-0x00000000053D0000-0x0000000005436000-memory.dmp

Download

memory/4140-7-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/4140-17-0x0000000005A50000-0x0000000005A6E000-memory.dmp

Download

memory/4140-18-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Download

memory/4140-19-0x0000000005FD0000-0x0000000006066000-memory.dmp

Download

memory/4140-20-0x0000000005F60000-0x0000000005F7A000-memory.dmp

Download

memory/4140-21-0x0000000006A20000-0x0000000006A42000-memory.dmp

Download

memory/4140-22-0x0000000007000000-0x00000000075A6000-memory.dmp

Download

memory/4140-25-0x00000000748E0000-0x0000000075091000-memory.dmp

Download

memory/4140-16-0x00000000055B0000-0x0000000005907000-memory.dmp

Download

memory/4140-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Download

memory/4140-5-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Download

memory/4140-4-0x00000000748E0000-0x0000000075091000-memory.dmp

Download

memory/4140-3-0x00000000748E0000-0x0000000075091000-memory.dmp

Download

memory/4140-1-0x0000000002290000-0x00000000022C6000-memory.dmp

Download

memory/4140-2-0x0000000004D30000-0x000000000535A000-memory.dmp

Download

memory/4424-62-0x00000000062A0000-0x00000000062EC000-memory.dmp

Download

memory/4424-63-0x00000000081D0000-0x000000000884A000-memory.dmp

Download

memory/4424-60-0x0000000005940000-0x0000000005C97000-memory.dmp

Download