8045c954475f76556ef8c7b3305af51f5c7c8359a527404266c9e980527c4396

Analysis

max time kernel
92s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ConsoleApplication2.exe
Size 4.4MB
Sample240608-qyf1qsda43
SHA256 8045c954475f76556ef8c7b3305af51f5c7c8359a527404266c9e980527c4396
MD5 72f73734bb6dbf6381815d85d680fb8e
SHA1 2a7c3855fc0e4a0813631946684a4173c425a266
SHA512 96c3e0bef2224d5f5ebfe1d3880ecec1e120cfc56d6d978b91916332313e70c9167ed38204486640937912dff591e3e6faa72737e5e7a0441069087679e5b6f3
SSDEEP 49152:d9vRNVGsS21WaeQc+4Vg/95kVM04UwF7mwY/yg57/7AxcH7snP3kPOxrKPG+OzX2:d9vRNVVtpvagb0kqIcPM+H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
8	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
10	ipinfo.io
1	ipinfo.io
2	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3184	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5040	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2764	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2760	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4752	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe
4128	powershell.exe
4128	powershell.exe
3184	powershell.exe
3184	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe
Token: SeSecurityPrivilege	2240	WMIC.exe
Token: SeTakeOwnershipPrivilege	2240	WMIC.exe
Token: SeLoadDriverPrivilege	2240	WMIC.exe
Token: SeSystemProfilePrivilege	2240	WMIC.exe
Token: SeSystemtimePrivilege	2240	WMIC.exe
Token: SeProfSingleProcessPrivilege	2240	WMIC.exe
Token: SeIncBasePriorityPrivilege	2240	WMIC.exe
Token: SeCreatePagefilePrivilege	2240	WMIC.exe
Token: SeBackupPrivilege	2240	WMIC.exe
Token: SeRestorePrivilege	2240	WMIC.exe
Token: SeShutdownPrivilege	2240	WMIC.exe
Token: SeDebugPrivilege	2240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2240	WMIC.exe
Token: SeRemoteShutdownPrivilege	2240	WMIC.exe
Token: SeUndockPrivilege	2240	WMIC.exe
Token: SeManageVolumePrivilege	2240	WMIC.exe
Token: 33	2240	WMIC.exe
Token: 34	2240	WMIC.exe
Token: 35	2240	WMIC.exe
Token: 36	2240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe
Token: SeSecurityPrivilege	2240	WMIC.exe
Token: SeTakeOwnershipPrivilege	2240	WMIC.exe
Token: SeLoadDriverPrivilege	2240	WMIC.exe
Token: SeSystemProfilePrivilege	2240	WMIC.exe
Token: SeSystemtimePrivilege	2240	WMIC.exe
Token: SeProfSingleProcessPrivilege	2240	WMIC.exe
Token: SeIncBasePriorityPrivilege	2240	WMIC.exe
Token: SeCreatePagefilePrivilege	2240	WMIC.exe
Token: SeBackupPrivilege	2240	WMIC.exe
Token: SeRestorePrivilege	2240	WMIC.exe
Token: SeShutdownPrivilege	2240	WMIC.exe
Token: SeDebugPrivilege	2240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2240	WMIC.exe
Token: SeRemoteShutdownPrivilege	2240	WMIC.exe
Token: SeUndockPrivilege	2240	WMIC.exe
Token: SeManageVolumePrivilege	2240	WMIC.exe
Token: 33	2240	WMIC.exe
Token: 34	2240	WMIC.exe
Token: 35	2240	WMIC.exe
Token: 36	2240	WMIC.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeIncreaseQuotaPrivilege	5040	WMIC.exe
Token: SeSecurityPrivilege	5040	WMIC.exe
Token: SeTakeOwnershipPrivilege	5040	WMIC.exe
Token: SeLoadDriverPrivilege	5040	WMIC.exe
Token: SeSystemProfilePrivilege	5040	WMIC.exe
Token: SeSystemtimePrivilege	5040	WMIC.exe
Token: SeProfSingleProcessPrivilege	5040	WMIC.exe
Token: SeIncBasePriorityPrivilege	5040	WMIC.exe
Token: SeCreatePagefilePrivilege	5040	WMIC.exe
Token: SeBackupPrivilege	5040	WMIC.exe
Token: SeRestorePrivilege	5040	WMIC.exe
Token: SeShutdownPrivilege	5040	WMIC.exe
Token: SeDebugPrivilege	5040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5040	WMIC.exe
Token: SeRemoteShutdownPrivilege	5040	WMIC.exe
Token: SeUndockPrivilege	5040	WMIC.exe
Token: SeManageVolumePrivilege	5040	WMIC.exe
Token: 33	5040	WMIC.exe
Token: 34	5040	WMIC.exe
Token: 35	5040	WMIC.exe
Token: 36	5040	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 5016	3700	ConsoleApplication2.exe	78
PID 3700 wrote to memory of 5016	3700	ConsoleApplication2.exe	78
PID 3700 wrote to memory of 5016	3700	ConsoleApplication2.exe	78
PID 5016 wrote to memory of 4752	5016	cmd.exe	79
PID 5016 wrote to memory of 4752	5016	cmd.exe	79
PID 5016 wrote to memory of 4752	5016	cmd.exe	79
PID 3700 wrote to memory of 4728	3700	ConsoleApplication2.exe	80
PID 3700 wrote to memory of 4728	3700	ConsoleApplication2.exe	80
PID 3700 wrote to memory of 4728	3700	ConsoleApplication2.exe	80
PID 4728 wrote to memory of 2240	4728	cmd.exe	81
PID 4728 wrote to memory of 2240	4728	cmd.exe	81
PID 4728 wrote to memory of 2240	4728	cmd.exe	81
PID 3700 wrote to memory of 3600	3700	ConsoleApplication2.exe	83
PID 3700 wrote to memory of 3600	3700	ConsoleApplication2.exe	83
PID 3700 wrote to memory of 3600	3700	ConsoleApplication2.exe	83
PID 3600 wrote to memory of 2344	3600	cmd.exe	84
PID 3600 wrote to memory of 2344	3600	cmd.exe	84
PID 3600 wrote to memory of 2344	3600	cmd.exe	84
PID 3700 wrote to memory of 4432	3700	ConsoleApplication2.exe	85
PID 3700 wrote to memory of 4432	3700	ConsoleApplication2.exe	85
PID 3700 wrote to memory of 4432	3700	ConsoleApplication2.exe	85
PID 4432 wrote to memory of 5040	4432	cmd.exe	86
PID 4432 wrote to memory of 5040	4432	cmd.exe	86
PID 4432 wrote to memory of 5040	4432	cmd.exe	86
PID 3700 wrote to memory of 4720	3700	ConsoleApplication2.exe	87
PID 3700 wrote to memory of 4720	3700	ConsoleApplication2.exe	87
PID 3700 wrote to memory of 4720	3700	ConsoleApplication2.exe	87
PID 4720 wrote to memory of 3876	4720	cmd.exe	88
PID 4720 wrote to memory of 3876	4720	cmd.exe	88
PID 4720 wrote to memory of 3876	4720	cmd.exe	88
PID 3700 wrote to memory of 2352	3700	ConsoleApplication2.exe	89
PID 3700 wrote to memory of 2352	3700	ConsoleApplication2.exe	89
PID 3700 wrote to memory of 2352	3700	ConsoleApplication2.exe	89
PID 2352 wrote to memory of 3000	2352	cmd.exe	90
PID 2352 wrote to memory of 3000	2352	cmd.exe	90
PID 2352 wrote to memory of 3000	2352	cmd.exe	90
PID 3700 wrote to memory of 2340	3700	ConsoleApplication2.exe	91
PID 3700 wrote to memory of 2340	3700	ConsoleApplication2.exe	91
PID 3700 wrote to memory of 2340	3700	ConsoleApplication2.exe	91
PID 2340 wrote to memory of 3168	2340	cmd.exe	92
PID 2340 wrote to memory of 3168	2340	cmd.exe	92
PID 2340 wrote to memory of 3168	2340	cmd.exe	92
PID 3700 wrote to memory of 4904	3700	ConsoleApplication2.exe	93
PID 3700 wrote to memory of 4904	3700	ConsoleApplication2.exe	93
PID 3700 wrote to memory of 4904	3700	ConsoleApplication2.exe	93
PID 4904 wrote to memory of 4128	4904	cmd.exe	94
PID 4904 wrote to memory of 4128	4904	cmd.exe	94
PID 4904 wrote to memory of 4128	4904	cmd.exe	94
PID 3700 wrote to memory of 2828	3700	ConsoleApplication2.exe	95
PID 3700 wrote to memory of 2828	3700	ConsoleApplication2.exe	95
PID 3700 wrote to memory of 2828	3700	ConsoleApplication2.exe	95
PID 2828 wrote to memory of 2764	2828	cmd.exe	96
PID 2828 wrote to memory of 2764	2828	cmd.exe	96
PID 2828 wrote to memory of 2764	2828	cmd.exe	96
PID 3700 wrote to memory of 3196	3700	ConsoleApplication2.exe	97
PID 3700 wrote to memory of 3196	3700	ConsoleApplication2.exe	97
PID 3700 wrote to memory of 3196	3700	ConsoleApplication2.exe	97
PID 3196 wrote to memory of 2760	3196	cmd.exe	98
PID 3196 wrote to memory of 2760	3196	cmd.exe	98
PID 3196 wrote to memory of 2760	3196	cmd.exe	98
PID 3700 wrote to memory of 2068	3700	ConsoleApplication2.exe	100
PID 3700 wrote to memory of 2068	3700	ConsoleApplication2.exe	100
PID 3700 wrote to memory of 2068	3700	ConsoleApplication2.exe	100
PID 2068 wrote to memory of 2468	2068	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 1.1.1.1
    3⤵
    - Runs ping.exe
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get currentrefreshrate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get currentrefreshrate
    3⤵
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-Content (Get-PSReadlineOption).HistorySavePath
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Content (Get-PSReadlineOption).HistorySavePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
    3⤵
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:1416
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 b5bded6405c397fca522ecfb9688eac0ef1e2e1a18f96c04a50532a4b5b4a026
MD5 c220a7bba5289469a23b22c964faa32c
SHA1 f7f4e9d29f72c0a346d4f9f5671624c103e30c15
SHA512 9ec29a660c62ab15d00a08c80d4cdb2705c71b4f55a0b25f39c9740bfdd7df96af06c2a7393738c2a8f5b48f65b0eff17cb78dc65ce35c3ee9126e12ce348faa
SSDEEP 384:wM3HK62S12GL567XTNslnNzjs2xtg+NoKI59x9minVoFci:552Sf5uTSLzj7xtgGoKax9m45i
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 f5c605d94bb27820cf96c0b40401bdae8e41577301bf84f08ed02352510c2bbd
MD5 8aa5a5b33bb737a8bc7414541b618d59
SHA1 a9f9f31345b59f15e76bffb941e16524adf41d81
SHA512 0eff3bd092aa64fc5470ee9d221301c92f5cb7c532af60258f15ba3e607259cb7c55b1915c4272ebd33460b2e448d1add480a30dae9a35fb81be5b33ade663a8
SSDEEP 384:+QHXh6CSpkj1FDlCEMbRGczNPjsatQdNG+csa4bWsHdqEmjlUBC:jsCSWZDK/xPjNQP6RsUphUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nagogy-Grabber (Admin).zip

Path C:\Users\Admin\AppData\Local\Temp\NxtbWyCy04VZYAlM\Nagogy-Grabber (Admin).zip
Size 203KB
SHA256 de29740cf1828d10874a2556d3760254b95025d5d6a4873e0c1a9b7653b0664c
MD5 1399ee8cdec565ebb80f2b5acb97e843
SHA1 b067495cf2e7d11913ad025d19ab745b0055167e
SHA512 a233bc3a99a4407e9954b2440e3c37afc3ce8b76994c833c1c423c60c4fd93cad470de53a506a25d9a0987da6872ac528c0dc7eef01cc786e8b5e9bb5e7191b6
SSDEEP 6144:dQ+C8Aa/ufQmxYNLza3IHdMjZQfKxlU3FyY:dVx/QhkK3cCWKx4yY
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xsnk04z4.jdv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xsnk04z4.jdv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2344-7-0x00000000063F0000-0x0000000006456000-memory.dmp

Download

memory/2344-25-0x0000000074E30000-0x00000000755E1000-memory.dmp

Download

memory/2344-6-0x0000000006380000-0x00000000063E6000-memory.dmp

Download

memory/2344-5-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

Download

memory/2344-16-0x0000000006460000-0x00000000067B7000-memory.dmp

Download

memory/2344-17-0x0000000006920000-0x000000000693E000-memory.dmp

Download

memory/2344-18-0x0000000006960000-0x00000000069AC000-memory.dmp

Download

memory/2344-21-0x0000000006E80000-0x0000000006EA2000-memory.dmp

Download

memory/2344-20-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Download

memory/2344-19-0x0000000007AE0000-0x0000000007B76000-memory.dmp

Download

memory/2344-22-0x0000000008130000-0x00000000086D6000-memory.dmp

Download

memory/2344-0-0x0000000074E3E000-0x0000000074E3F000-memory.dmp

Download

memory/2344-4-0x0000000074E30000-0x00000000755E1000-memory.dmp

Download

memory/2344-3-0x0000000074E30000-0x00000000755E1000-memory.dmp

Download

memory/2344-1-0x00000000054B0000-0x00000000054E6000-memory.dmp

Download

memory/2344-2-0x0000000005C50000-0x000000000627A000-memory.dmp

Download

memory/3184-52-0x0000000005F70000-0x00000000062C7000-memory.dmp

Download

memory/3184-62-0x0000000006B50000-0x0000000006B9C000-memory.dmp

Download

memory/3184-63-0x0000000008B40000-0x00000000091BA000-memory.dmp

Download

memory/4128-39-0x0000000006C50000-0x0000000006C96000-memory.dmp

Download

memory/4128-38-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Download

memory/4128-36-0x0000000006320000-0x0000000006677000-memory.dmp

Download