a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123

Resubmissions

18-10-2024 17:25

241018-vzl1la1cqq 10

18-10-2024 16:26

241018-txhdyswgqh 10

18-10-2024 16:25

241018-tw78zsydrp 3

18-10-2024 16:22

241018-tvh8gawfqa 3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6812964531.exe
Size

67KB
MD5

7de65122a13ab9d81368ee3dff3cc80a
SHA1

ecbb4db641431d4d672e4b88e8d309419fd32f04
SHA256

a73a05a4b6ec6ae1c1ba6d3d12b68cc52b899e2a6dbbaaa1f48f2c260a733123
SHA512

b156d77a665c3256ddfd016e46105b6e87db6a4c1ca77e9bb25b221c368f3cc53dddc7159602cfb926ef0cc9bacac57b6bd41e7e28998883c996727d58d29401
SSDEEP

1536:pr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EXyBej:h7PEg3qcv5PvB/EVj

Score

10^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

cheat_master_install.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cheat_master_install.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

cheat_master_install.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	cheat_master_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	cheat_master_install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cheat_master_install.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheat_master_install.exe"	cheat_master_install.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

cheat_master_install.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cheat_master_install.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6812964531.execheat_master_install.execheat_master_install.exe3mb_online_install.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6812964531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cheat_master_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cheat_master_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3mb_online_install.exe

Modifies registry class 1 IoCs

Processes:

java.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	java.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
3092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cheat_master_install.exe

pid	Process
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe
3496	cheat_master_install.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	800	WMIC.exe
Token: SeSecurityPrivilege	800	WMIC.exe
Token: SeTakeOwnershipPrivilege	800	WMIC.exe
Token: SeLoadDriverPrivilege	800	WMIC.exe
Token: SeSystemProfilePrivilege	800	WMIC.exe
Token: SeSystemtimePrivilege	800	WMIC.exe
Token: SeProfSingleProcessPrivilege	800	WMIC.exe
Token: SeIncBasePriorityPrivilege	800	WMIC.exe
Token: SeCreatePagefilePrivilege	800	WMIC.exe
Token: SeBackupPrivilege	800	WMIC.exe
Token: SeRestorePrivilege	800	WMIC.exe
Token: SeShutdownPrivilege	800	WMIC.exe
Token: SeDebugPrivilege	800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	800	WMIC.exe
Token: SeRemoteShutdownPrivilege	800	WMIC.exe
Token: SeUndockPrivilege	800	WMIC.exe
Token: SeManageVolumePrivilege	800	WMIC.exe
Token: 33	800	WMIC.exe
Token: 34	800	WMIC.exe
Token: 35	800	WMIC.exe
Token: 36	800	WMIC.exe
Token: SeIncreaseQuotaPrivilege	800	WMIC.exe
Token: SeSecurityPrivilege	800	WMIC.exe
Token: SeTakeOwnershipPrivilege	800	WMIC.exe
Token: SeLoadDriverPrivilege	800	WMIC.exe
Token: SeSystemProfilePrivilege	800	WMIC.exe
Token: SeSystemtimePrivilege	800	WMIC.exe
Token: SeProfSingleProcessPrivilege	800	WMIC.exe
Token: SeIncBasePriorityPrivilege	800	WMIC.exe
Token: SeCreatePagefilePrivilege	800	WMIC.exe
Token: SeBackupPrivilege	800	WMIC.exe
Token: SeRestorePrivilege	800	WMIC.exe
Token: SeShutdownPrivilege	800	WMIC.exe
Token: SeDebugPrivilege	800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	800	WMIC.exe
Token: SeRemoteShutdownPrivilege	800	WMIC.exe
Token: SeUndockPrivilege	800	WMIC.exe
Token: SeManageVolumePrivilege	800	WMIC.exe
Token: 33	800	WMIC.exe
Token: 34	800	WMIC.exe
Token: 35	800	WMIC.exe
Token: 36	800	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2644	WMIC.exe
Token: SeSecurityPrivilege	2644	WMIC.exe
Token: SeTakeOwnershipPrivilege	2644	WMIC.exe
Token: SeLoadDriverPrivilege	2644	WMIC.exe
Token: SeSystemProfilePrivilege	2644	WMIC.exe
Token: SeSystemtimePrivilege	2644	WMIC.exe
Token: SeProfSingleProcessPrivilege	2644	WMIC.exe
Token: SeIncBasePriorityPrivilege	2644	WMIC.exe
Token: SeCreatePagefilePrivilege	2644	WMIC.exe
Token: SeBackupPrivilege	2644	WMIC.exe
Token: SeRestorePrivilege	2644	WMIC.exe
Token: SeShutdownPrivilege	2644	WMIC.exe
Token: SeDebugPrivilege	2644	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2644	WMIC.exe
Token: SeRemoteShutdownPrivilege	2644	WMIC.exe
Token: SeUndockPrivilege	2644	WMIC.exe
Token: SeManageVolumePrivilege	2644	WMIC.exe
Token: 33	2644	WMIC.exe
Token: 34	2644	WMIC.exe
Token: 35	2644	WMIC.exe
Token: 36	2644	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2644	WMIC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

java.execheat_master_install.execheat_master_install.exe

pid	Process
4548	java.exe
3496	cheat_master_install.exe
2940	cheat_master_install.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6812964531.exejavaw.exejava.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 4156 wrote to memory of 1060	4156	6812964531.exe	84
PID 4156 wrote to memory of 1060	4156	6812964531.exe	84
PID 1060 wrote to memory of 4548	1060	javaw.exe	98
PID 1060 wrote to memory of 4548	1060	javaw.exe	98
PID 4548 wrote to memory of 4924	4548	java.exe	100
PID 4548 wrote to memory of 4924	4548	java.exe	100
PID 4924 wrote to memory of 4836	4924	cmd.exe	102
PID 4924 wrote to memory of 4836	4924	cmd.exe	102
PID 4548 wrote to memory of 1232	4548	java.exe	103
PID 4548 wrote to memory of 1232	4548	java.exe	103
PID 1232 wrote to memory of 3092	1232	cmd.exe	105
PID 1232 wrote to memory of 3092	1232	cmd.exe	105
PID 4548 wrote to memory of 2456	4548	java.exe	106
PID 4548 wrote to memory of 2456	4548	java.exe	106
PID 1280 wrote to memory of 800	1280	cmd.exe	111
PID 1280 wrote to memory of 800	1280	cmd.exe	111
PID 3820 wrote to memory of 2644	3820	cmd.exe	114
PID 3820 wrote to memory of 2644	3820	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6812964531.exe
"C:\Users\Admin\AppData\Local\Temp\6812964531.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\6812964531.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    java -jar C:\Users\Admin\download_libra.jar
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\system32\cacls.exe
        
        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
        5⤵
        
        PID:4836
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c SCHTASKS /CREATE /F /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /CREATE /F /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3092
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar"
      4⤵
      PID:2456

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\cache.jar"
1⤵
PID:1668
- C:\Windows\system32\cmd.exe
  cmd /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- C:\Windows\system32\cmd.exe
  cmd /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe
  "C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe"
  2⤵
  - UAC bypass
  - Event Triggered Execution: Image File Execution Options Injection
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\3mb_online_install.exe
  "C:\Users\Admin\AppData\Local\Temp\3mb_online_install.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264

C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe
C:\Users\Admin\AppData\Local\Temp\cheat_master_install.exe explorer.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
80073fb35176b7db23fba8f36b5176bb

SHA1
8b01c2cbd4a61e4411f7c29e2fbe1c9c7b662f27

SHA256
df009c7355d8c1d58d0c598fa50cae813b11c5484cd868125a47977befe08f44

SHA512
290a109cc61f4e67e3b1ca0b4ad6d2213060b3070a03402ae8b3bdb9f7c92542f259ac843e0aec00057bbb6b873259db69cb58e4078c24354c9bad77fd3459ae

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1c8682260807ff0cf220519480e203f0

SHA1
85ab626819f00e6396f4ce3ed65b6e822802d317

SHA256
44d2ce4f022c30ede8bee4f3403136741e6c7c7caf01a4b6c704411fe12092b8

SHA512
8b69648d729b70e582b672ff69dcc744f27a3e20c2a6caa27f5e092a8666ad70073bc9a9f7fe748af6a1dd46f9feb0e73a6becd2f6dd59678f3e68cbba76301c

Download Submit
C:\Users\Admin\download_libra.jar

Filesize
25.9MB

MD5
d33f1dd43fbfa6439a67e89c2cdf8f7f

SHA1
d84179f551939149bedd0fedd8d2f9d00f119ce4

SHA256
cd7af2789ff94fb2ee15de35c3181d54c14ae8ff6ae6c2cd5912cd897da75648

SHA512
81b5e596b61aef451b14f472dfad825ab8d223cd3e4fb48490ff0d7134a6ab3a2d0baa395c82916a914d669f9adecea0284de82f1d4b3ea09558c4066b3e0446

Download Submit
memory/1060-99-0x00000204003A0000-0x00000204003B0000-memory.dmp

Filesize
64KB

Download
memory/1060-26-0x00000204002D0000-0x00000204002E0000-memory.dmp

Filesize
64KB

Download
memory/1060-18-0x0000020400290000-0x00000204002A0000-memory.dmp

Filesize
64KB

Download
memory/1060-15-0x0000020400270000-0x0000020400280000-memory.dmp

Filesize
64KB

Download
memory/1060-20-0x00000204002A0000-0x00000204002B0000-memory.dmp

Filesize
64KB

Download
memory/1060-22-0x00000204002B0000-0x00000204002C0000-memory.dmp

Filesize
64KB

Download
memory/1060-24-0x00000204002C0000-0x00000204002D0000-memory.dmp

Filesize
64KB

Download
memory/1060-100-0x00000204003B0000-0x00000204003C0000-memory.dmp

Filesize
64KB

Download
memory/1060-30-0x00000204002F0000-0x0000020400300000-memory.dmp

Filesize
64KB

Download
memory/1060-29-0x00000204002E0000-0x00000204002F0000-memory.dmp

Filesize
64KB

Download
memory/1060-37-0x0000020400270000-0x0000020400280000-memory.dmp

Filesize
64KB

Download
memory/1060-39-0x0000020400320000-0x0000020400330000-memory.dmp

Filesize
64KB

Download
memory/1060-38-0x0000020400280000-0x0000020400290000-memory.dmp

Filesize
64KB

Download
memory/1060-42-0x0000020400330000-0x0000020400340000-memory.dmp

Filesize
64KB

Download
memory/1060-41-0x0000020400290000-0x00000204002A0000-memory.dmp

Filesize
64KB

Download
memory/1060-35-0x0000020400300000-0x0000020400310000-memory.dmp

Filesize
64KB

Download
memory/1060-34-0x0000020400000000-0x0000020400270000-memory.dmp

Filesize
2.4MB

Download
memory/1060-36-0x0000020400310000-0x0000020400320000-memory.dmp

Filesize
64KB

Download
memory/1060-46-0x0000020400340000-0x0000020400350000-memory.dmp

Filesize
64KB

Download
memory/1060-50-0x00000204002A0000-0x00000204002B0000-memory.dmp

Filesize
64KB

Download
memory/1060-51-0x0000020400350000-0x0000020400360000-memory.dmp

Filesize
64KB

Download
memory/1060-55-0x0000020400360000-0x0000020400370000-memory.dmp

Filesize
64KB

Download
memory/1060-54-0x00000204002B0000-0x00000204002C0000-memory.dmp

Filesize
64KB

Download
memory/1060-59-0x0000020400370000-0x0000020400380000-memory.dmp

Filesize
64KB

Download
memory/1060-61-0x00000204002D0000-0x00000204002E0000-memory.dmp

Filesize
64KB

Download
memory/1060-60-0x0000020400380000-0x0000020400390000-memory.dmp

Filesize
64KB

Download
memory/1060-58-0x00000204002C0000-0x00000204002D0000-memory.dmp

Filesize
64KB

Download
memory/1060-64-0x00000204002F0000-0x0000020400300000-memory.dmp

Filesize
64KB

Download
memory/1060-65-0x0000020400390000-0x00000204003A0000-memory.dmp

Filesize
64KB

Download
memory/1060-63-0x00000204002E0000-0x00000204002F0000-memory.dmp

Filesize
64KB

Download
memory/1060-71-0x0000020400310000-0x0000020400320000-memory.dmp

Filesize
64KB

Download
memory/1060-70-0x0000020400300000-0x0000020400310000-memory.dmp

Filesize
64KB

Download
memory/1060-69-0x00000204003B0000-0x00000204003C0000-memory.dmp

Filesize
64KB

Download
memory/1060-68-0x00000204003A0000-0x00000204003B0000-memory.dmp

Filesize
64KB

Download
memory/1060-75-0x00000204003C0000-0x00000204003D0000-memory.dmp

Filesize
64KB

Download
memory/1060-74-0x0000020400320000-0x0000020400330000-memory.dmp

Filesize
64KB

Download
memory/1060-77-0x0000020400330000-0x0000020400340000-memory.dmp

Filesize
64KB

Download
memory/1060-78-0x00000204003D0000-0x00000204003E0000-memory.dmp

Filesize
64KB

Download
memory/1060-79-0x0000020477880000-0x0000020477881000-memory.dmp

Filesize
4KB

Download
memory/1060-82-0x00000204003E0000-0x00000204003F0000-memory.dmp

Filesize
64KB

Download
memory/1060-81-0x0000020400340000-0x0000020400350000-memory.dmp

Filesize
64KB

Download
memory/1060-84-0x0000020400350000-0x0000020400360000-memory.dmp

Filesize
64KB

Download
memory/1060-85-0x00000204003F0000-0x0000020400400000-memory.dmp

Filesize
64KB

Download
memory/1060-88-0x0000020400360000-0x0000020400370000-memory.dmp

Filesize
64KB

Download
memory/1060-90-0x0000020400380000-0x0000020400390000-memory.dmp

Filesize
64KB

Download
memory/1060-89-0x0000020400370000-0x0000020400380000-memory.dmp

Filesize
64KB

Download
memory/1060-91-0x0000020400400000-0x0000020400410000-memory.dmp

Filesize
64KB

Download
memory/1060-94-0x0000020400410000-0x0000020400420000-memory.dmp

Filesize
64KB

Download
memory/1060-103-0x0000020400430000-0x0000020400440000-memory.dmp

Filesize
64KB

Download
memory/1060-12-0x0000020477880000-0x0000020477881000-memory.dmp

Filesize
4KB

Download
memory/1060-135-0x0000020400470000-0x0000020400480000-memory.dmp

Filesize
64KB

Download
memory/1060-16-0x0000020400280000-0x0000020400290000-memory.dmp

Filesize
64KB

Download
memory/1060-96-0x0000020400390000-0x00000204003A0000-memory.dmp

Filesize
64KB

Download
memory/1060-105-0x00000204003C0000-0x00000204003D0000-memory.dmp

Filesize
64KB

Download
memory/1060-106-0x00000204003D0000-0x00000204003E0000-memory.dmp

Filesize
64KB

Download
memory/1060-109-0x0000020400440000-0x0000020400450000-memory.dmp

Filesize
64KB

Download
memory/1060-108-0x00000204003E0000-0x00000204003F0000-memory.dmp

Filesize
64KB

Download
memory/1060-111-0x00000204003F0000-0x0000020400400000-memory.dmp

Filesize
64KB

Download
memory/1060-114-0x0000020400400000-0x0000020400410000-memory.dmp

Filesize
64KB

Download
memory/1060-115-0x0000020400450000-0x0000020400460000-memory.dmp

Filesize
64KB

Download
memory/1060-116-0x0000020400410000-0x0000020400420000-memory.dmp

Filesize
64KB

Download
memory/1060-117-0x0000020400420000-0x0000020400430000-memory.dmp

Filesize
64KB

Download
memory/1060-118-0x0000020400430000-0x0000020400440000-memory.dmp

Filesize
64KB

Download
memory/1060-119-0x0000020400440000-0x0000020400450000-memory.dmp

Filesize
64KB

Download
memory/1060-124-0x0000020400450000-0x0000020400460000-memory.dmp

Filesize
64KB

Download
memory/1060-133-0x0000020400460000-0x0000020400470000-memory.dmp

Filesize
64KB

Download
memory/1060-101-0x0000020400420000-0x0000020400430000-memory.dmp

Filesize
64KB

Download
memory/1060-137-0x0000020400480000-0x0000020400490000-memory.dmp

Filesize
64KB

Download
memory/1060-141-0x00000204004A0000-0x00000204004B0000-memory.dmp

Filesize
64KB

Download
memory/1060-140-0x0000020400490000-0x00000204004A0000-memory.dmp

Filesize
64KB

Download
memory/1060-143-0x00000204004B0000-0x00000204004C0000-memory.dmp

Filesize
64KB

Download
memory/1060-145-0x00000204004C0000-0x00000204004D0000-memory.dmp

Filesize
64KB

Download
memory/1060-147-0x00000204004D0000-0x00000204004E0000-memory.dmp

Filesize
64KB

Download
memory/1060-153-0x00000204004E0000-0x00000204004F0000-memory.dmp

Filesize
64KB

Download
memory/1060-155-0x0000020400460000-0x0000020400470000-memory.dmp

Filesize
64KB

Download
memory/1060-157-0x0000020400470000-0x0000020400480000-memory.dmp

Filesize
64KB

Download
memory/1060-159-0x00000204004F0000-0x0000020400500000-memory.dmp

Filesize
64KB

Download
memory/1060-158-0x0000020400480000-0x0000020400490000-memory.dmp

Filesize
64KB

Download
memory/1060-166-0x0000020400500000-0x0000020400510000-memory.dmp

Filesize
64KB

Download
memory/1060-165-0x00000204004A0000-0x00000204004B0000-memory.dmp

Filesize
64KB

Download
memory/1060-164-0x0000020400490000-0x00000204004A0000-memory.dmp

Filesize
64KB

Download
memory/1060-179-0x00000204004B0000-0x00000204004C0000-memory.dmp

Filesize
64KB

Download
memory/1060-191-0x00000204004C0000-0x00000204004D0000-memory.dmp

Filesize
64KB

Download
memory/1060-194-0x00000204004D0000-0x00000204004E0000-memory.dmp

Filesize
64KB

Download
memory/1060-220-0x0000020400000000-0x0000020400270000-memory.dmp

Filesize
2.4MB

Download
memory/1060-221-0x0000020400270000-0x0000020400280000-memory.dmp

Filesize
64KB

Download
memory/1060-222-0x0000020400280000-0x0000020400290000-memory.dmp

Filesize
64KB

Download
memory/1060-223-0x0000020400320000-0x0000020400330000-memory.dmp

Filesize
64KB

Download
memory/1060-3-0x0000020400000000-0x0000020400270000-memory.dmp

Filesize
2.4MB

Download
memory/1060-214-0x00000204004E0000-0x00000204004F0000-memory.dmp

Filesize
64KB

Download
memory/1060-224-0x00000204002A0000-0x00000204002B0000-memory.dmp

Filesize
64KB

Download
memory/1060-225-0x00000204002B0000-0x00000204002C0000-memory.dmp

Filesize
64KB

Download
memory/1060-219-0x0000020477880000-0x0000020477881000-memory.dmp

Filesize
4KB

Download
memory/1060-229-0x00000204002F0000-0x0000020400300000-memory.dmp

Filesize
64KB

Download
memory/1060-228-0x00000204002E0000-0x00000204002F0000-memory.dmp

Filesize
64KB

Download
memory/1060-227-0x00000204002D0000-0x00000204002E0000-memory.dmp

Filesize
64KB

Download
memory/1060-226-0x00000204002C0000-0x00000204002D0000-memory.dmp

Filesize
64KB

Download
memory/2456-217-0x000001780DA00000-0x000001780DA01000-memory.dmp

Filesize
4KB

Download
memory/2940-261-0x0000000000400000-0x00000000006CC000-memory.dmp

Filesize
2.8MB

Download
memory/4156-0-0x0000000000C90000-0x0000000000CAF000-memory.dmp

Filesize
124KB

Download
memory/4548-218-0x000001264BC20000-0x000001264BE90000-memory.dmp

Filesize
2.4MB

Download
memory/4548-201-0x000001264A430000-0x000001264A431000-memory.dmp

Filesize
4KB

Download
memory/4548-192-0x000001264A430000-0x000001264A431000-memory.dmp

Filesize
4KB

Download
memory/4548-180-0x000001264BC20000-0x000001264BE90000-memory.dmp

Filesize
2.4MB

Download