bc77e6254d5b51fbc565a28fd016174736b52ef8f254428e040ef2ba4c943a51

Analysis

max time kernel
90s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ConsoleApplication2.exe
Size 4.4MB
Sample240608-rc975acc51
SHA256 bc77e6254d5b51fbc565a28fd016174736b52ef8f254428e040ef2ba4c943a51
MD5 8e1f20c04032147a7666937b8e4f5ab4
SHA1 cb1d73176367e0f17da6ee35cfd5faac68f05d08
SHA512 24759bfd13fb79130ddba194690393d95ef41432ce4c96cf353bc417fc0ac1645a6be4ec6a3bc041301aa7c59d356af4e8cf48a2bc2acf520781e5a59bfd6780
SSDEEP 49152:WtvS90woveH/WVGYtpli+b3nYy9Oci9rQc7c9l7L3T3GTOhgv/i3MPSunM7ztT2e:WtvS90w2lvIjyvvA/MZsp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
11	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
2	ipinfo.io
5	ipinfo.io
12	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1772	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3996	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3676	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4500	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4808	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
2684	powershell.exe
2684	powershell.exe
1772	powershell.exe
1772	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2056	WMIC.exe
Token: SeSecurityPrivilege	2056	WMIC.exe
Token: SeTakeOwnershipPrivilege	2056	WMIC.exe
Token: SeLoadDriverPrivilege	2056	WMIC.exe
Token: SeSystemProfilePrivilege	2056	WMIC.exe
Token: SeSystemtimePrivilege	2056	WMIC.exe
Token: SeProfSingleProcessPrivilege	2056	WMIC.exe
Token: SeIncBasePriorityPrivilege	2056	WMIC.exe
Token: SeCreatePagefilePrivilege	2056	WMIC.exe
Token: SeBackupPrivilege	2056	WMIC.exe
Token: SeRestorePrivilege	2056	WMIC.exe
Token: SeShutdownPrivilege	2056	WMIC.exe
Token: SeDebugPrivilege	2056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2056	WMIC.exe
Token: SeRemoteShutdownPrivilege	2056	WMIC.exe
Token: SeUndockPrivilege	2056	WMIC.exe
Token: SeManageVolumePrivilege	2056	WMIC.exe
Token: 33	2056	WMIC.exe
Token: 34	2056	WMIC.exe
Token: 35	2056	WMIC.exe
Token: 36	2056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2056	WMIC.exe
Token: SeSecurityPrivilege	2056	WMIC.exe
Token: SeTakeOwnershipPrivilege	2056	WMIC.exe
Token: SeLoadDriverPrivilege	2056	WMIC.exe
Token: SeSystemProfilePrivilege	2056	WMIC.exe
Token: SeSystemtimePrivilege	2056	WMIC.exe
Token: SeProfSingleProcessPrivilege	2056	WMIC.exe
Token: SeIncBasePriorityPrivilege	2056	WMIC.exe
Token: SeCreatePagefilePrivilege	2056	WMIC.exe
Token: SeBackupPrivilege	2056	WMIC.exe
Token: SeRestorePrivilege	2056	WMIC.exe
Token: SeShutdownPrivilege	2056	WMIC.exe
Token: SeDebugPrivilege	2056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2056	WMIC.exe
Token: SeRemoteShutdownPrivilege	2056	WMIC.exe
Token: SeUndockPrivilege	2056	WMIC.exe
Token: SeManageVolumePrivilege	2056	WMIC.exe
Token: 33	2056	WMIC.exe
Token: 34	2056	WMIC.exe
Token: 35	2056	WMIC.exe
Token: 36	2056	WMIC.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	3996	WMIC.exe
Token: SeSecurityPrivilege	3996	WMIC.exe
Token: SeTakeOwnershipPrivilege	3996	WMIC.exe
Token: SeLoadDriverPrivilege	3996	WMIC.exe
Token: SeSystemProfilePrivilege	3996	WMIC.exe
Token: SeSystemtimePrivilege	3996	WMIC.exe
Token: SeProfSingleProcessPrivilege	3996	WMIC.exe
Token: SeIncBasePriorityPrivilege	3996	WMIC.exe
Token: SeCreatePagefilePrivilege	3996	WMIC.exe
Token: SeBackupPrivilege	3996	WMIC.exe
Token: SeRestorePrivilege	3996	WMIC.exe
Token: SeShutdownPrivilege	3996	WMIC.exe
Token: SeDebugPrivilege	3996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3996	WMIC.exe
Token: SeRemoteShutdownPrivilege	3996	WMIC.exe
Token: SeUndockPrivilege	3996	WMIC.exe
Token: SeManageVolumePrivilege	3996	WMIC.exe
Token: 33	3996	WMIC.exe
Token: 34	3996	WMIC.exe
Token: 35	3996	WMIC.exe
Token: 36	3996	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3524	816	ConsoleApplication2.exe	78
PID 816 wrote to memory of 3524	816	ConsoleApplication2.exe	78
PID 816 wrote to memory of 3524	816	ConsoleApplication2.exe	78
PID 3524 wrote to memory of 4808	3524	cmd.exe	79
PID 3524 wrote to memory of 4808	3524	cmd.exe	79
PID 3524 wrote to memory of 4808	3524	cmd.exe	79
PID 816 wrote to memory of 568	816	ConsoleApplication2.exe	80
PID 816 wrote to memory of 568	816	ConsoleApplication2.exe	80
PID 816 wrote to memory of 568	816	ConsoleApplication2.exe	80
PID 568 wrote to memory of 2056	568	cmd.exe	81
PID 568 wrote to memory of 2056	568	cmd.exe	81
PID 568 wrote to memory of 2056	568	cmd.exe	81
PID 816 wrote to memory of 2440	816	ConsoleApplication2.exe	83
PID 816 wrote to memory of 2440	816	ConsoleApplication2.exe	83
PID 816 wrote to memory of 2440	816	ConsoleApplication2.exe	83
PID 2440 wrote to memory of 4836	2440	cmd.exe	84
PID 2440 wrote to memory of 4836	2440	cmd.exe	84
PID 2440 wrote to memory of 4836	2440	cmd.exe	84
PID 816 wrote to memory of 3552	816	ConsoleApplication2.exe	85
PID 816 wrote to memory of 3552	816	ConsoleApplication2.exe	85
PID 816 wrote to memory of 3552	816	ConsoleApplication2.exe	85
PID 3552 wrote to memory of 3996	3552	cmd.exe	86
PID 3552 wrote to memory of 3996	3552	cmd.exe	86
PID 3552 wrote to memory of 3996	3552	cmd.exe	86
PID 816 wrote to memory of 5000	816	ConsoleApplication2.exe	87
PID 816 wrote to memory of 5000	816	ConsoleApplication2.exe	87
PID 816 wrote to memory of 5000	816	ConsoleApplication2.exe	87
PID 5000 wrote to memory of 2700	5000	cmd.exe	88
PID 5000 wrote to memory of 2700	5000	cmd.exe	88
PID 5000 wrote to memory of 2700	5000	cmd.exe	88
PID 816 wrote to memory of 2464	816	ConsoleApplication2.exe	89
PID 816 wrote to memory of 2464	816	ConsoleApplication2.exe	89
PID 816 wrote to memory of 2464	816	ConsoleApplication2.exe	89
PID 2464 wrote to memory of 2672	2464	cmd.exe	90
PID 2464 wrote to memory of 2672	2464	cmd.exe	90
PID 2464 wrote to memory of 2672	2464	cmd.exe	90
PID 816 wrote to memory of 5108	816	ConsoleApplication2.exe	91
PID 816 wrote to memory of 5108	816	ConsoleApplication2.exe	91
PID 816 wrote to memory of 5108	816	ConsoleApplication2.exe	91
PID 5108 wrote to memory of 428	5108	cmd.exe	92
PID 5108 wrote to memory of 428	5108	cmd.exe	92
PID 5108 wrote to memory of 428	5108	cmd.exe	92
PID 816 wrote to memory of 3924	816	ConsoleApplication2.exe	93
PID 816 wrote to memory of 3924	816	ConsoleApplication2.exe	93
PID 816 wrote to memory of 3924	816	ConsoleApplication2.exe	93
PID 3924 wrote to memory of 2684	3924	cmd.exe	94
PID 3924 wrote to memory of 2684	3924	cmd.exe	94
PID 3924 wrote to memory of 2684	3924	cmd.exe	94
PID 816 wrote to memory of 4648	816	ConsoleApplication2.exe	95
PID 816 wrote to memory of 4648	816	ConsoleApplication2.exe	95
PID 816 wrote to memory of 4648	816	ConsoleApplication2.exe	95
PID 4648 wrote to memory of 3676	4648	cmd.exe	96
PID 4648 wrote to memory of 3676	4648	cmd.exe	96
PID 4648 wrote to memory of 3676	4648	cmd.exe	96
PID 816 wrote to memory of 4372	816	ConsoleApplication2.exe	97
PID 816 wrote to memory of 4372	816	ConsoleApplication2.exe	97
PID 816 wrote to memory of 4372	816	ConsoleApplication2.exe	97
PID 4372 wrote to memory of 4500	4372	cmd.exe	98
PID 4372 wrote to memory of 4500	4372	cmd.exe	98
PID 4372 wrote to memory of 4500	4372	cmd.exe	98
PID 816 wrote to memory of 4016	816	ConsoleApplication2.exe	100
PID 816 wrote to memory of 4016	816	ConsoleApplication2.exe	100
PID 816 wrote to memory of 4016	816	ConsoleApplication2.exe	100
PID 4016 wrote to memory of 3048	4016	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 1.1.1.1
    3⤵
    - Runs ping.exe
    PID:4808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get currentrefreshrate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get currentrefreshrate
    3⤵
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-Content (Get-PSReadlineOption).HistorySavePath
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Content (Get-PSReadlineOption).HistorySavePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
    3⤵
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
  2⤵
  PID:328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:4620
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:1712
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
MD5 e080d58e6387c9fd87434a502e1a902e
SHA1 ae76ce6a2a39d79226c343cfe4745d48c7c1a91a
SHA512 6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0bf5769e8f5b916b100fe75194c43064e8e7f0855af71172c2f3609e18eded6a
MD5 3818d9da51f76cfbea704aee5eaf7d69
SHA1 2038662acaa358efd8b6d917b32a3707ec87f223
SHA512 c6a5fd25222163d12db8e76067a5ad6ca21c16ad40320a4f4d473d94ffb272d5f1f8e2a8cf1e11447a97edbcec8c2c4a970f0c25038b7ad119b64a3ae9c9c4bc
SSDEEP 384:TM3HK/SS1z6oW1jEFRty9HnnNvjs2xtgWNZhI59R9m2nVoFcy:4gSScoWCRwxNvj7xtgeZhaR9mM5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4ea12be2caa62035128a3b942d3c165901bdefc27726687c1804a7f6517dc4ba
MD5 6f811d91cebe56885e410a4fdc44bf56
SHA1 d13b672d90011225f539a8b1a32386ba0e009bf2
SHA512 883ed830e9cc640dcfdf1dda44e57ed989ac0b147fee2050fa480225919a12561aa3da30b08eb2f147951779033ec69f1deddb33eea1c104fa6544463bd425ff
SSDEEP 384:1M3HXh6SSp4Sc5/EiGA6z1x7Nzjsaa5bYo6R+jIsRbjsHdbmjlUBC:ansSSqF1LGAAtzj6z69os4hUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

History.db

Path C:\Users\Admin\AppData\Local\Temp\History.db
Size 116KB
SHA256 c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1
MD5 4e2922249bf476fb3067795f2fa5e794
SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2
SHA512 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da
SSDEEP 96:Q/WU+bDoYysX0uhnydVjN9DLjGQLBE3u:Q/l+bDo3irhnydVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_wnnd2n0c.tvq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnnd2n0c.tvq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nagogy-Grabber (Admin).zip

Path C:\Users\Admin\AppData\Local\Temp\nUhPz3icZ7kXnkpW\Nagogy-Grabber (Admin).zip
Size 205KB
SHA256 7acdf539813ad9365185dd026fce52ad3158271c706881b58d2ec4298de15b90
MD5 d0919063987ab8a17000d0445ff55ceb
SHA1 fc035b4b2276e7712f188d43ba62d4620689225a
SHA512 0da177066470e6bc3fcf87ab1f5be3d74a4b35b026b12ca8fb66915d1c70f5ca2393de1cc236d4ad7f685f810630c15ce9485c0d0b83c91eb19a47e0cc97245c
SSDEEP 6144:dQzSWmJKooQWOoDz9kBxB9CLY52sFOhp4n7Ah:dcmJGDOonmxqY6hpYAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1772-63-0x0000000008650000-0x0000000008CCA000-memory.dmp

Download

memory/1772-62-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/1772-52-0x0000000005F00000-0x0000000006257000-memory.dmp

Download

memory/2684-39-0x0000000006BC0000-0x0000000006C06000-memory.dmp

Download

memory/2684-36-0x00000000055A0000-0x00000000058F7000-memory.dmp

Download

memory/2684-38-0x00000000060F0000-0x000000000613C000-memory.dmp

Download

memory/4836-21-0x0000000006D50000-0x0000000006D72000-memory.dmp

Download

memory/4836-16-0x0000000005680000-0x00000000059D7000-memory.dmp

Download

memory/4836-17-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Download

memory/4836-22-0x0000000007330000-0x00000000078D6000-memory.dmp

Download

memory/4836-25-0x0000000074540000-0x0000000074CF1000-memory.dmp

Download

memory/4836-15-0x0000000074540000-0x0000000074CF1000-memory.dmp

Download

memory/4836-19-0x00000000060F0000-0x0000000006186000-memory.dmp

Download

memory/4836-20-0x0000000006080000-0x000000000609A000-memory.dmp

Download

memory/4836-18-0x0000000005C30000-0x0000000005C7C000-memory.dmp

Download

memory/4836-0-0x000000007454E000-0x000000007454F000-memory.dmp

Download

memory/4836-5-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/4836-6-0x0000000005610000-0x0000000005676000-memory.dmp

Download

memory/4836-4-0x0000000004D00000-0x0000000004D22000-memory.dmp

Download

memory/4836-2-0x0000000074540000-0x0000000074CF1000-memory.dmp

Download

memory/4836-3-0x0000000004F00000-0x000000000552A000-memory.dmp

Download

memory/4836-1-0x00000000023A0000-0x00000000023D6000-memory.dmp

Download