f64bc188c245bf2bc9f191521eaeec61a67429feaddf08e9706e2c00f9608fbb

Analysis

max time kernel
131s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AaronGiles(1).exe
Size 10.0MB
Sample241120-mchewsvemd
SHA256 f64bc188c245bf2bc9f191521eaeec61a67429feaddf08e9706e2c00f9608fbb
MD5 9d50768008ef3b4a56cd4c55c94c01f5
SHA1 72603776ad0ebb0032df02a73529b0beaf39ced0
SHA512 8df9c787d69d0038ecd3def1537e78c87f868d0d26c78593e5db0e2fa7fefb24cc7cc92a1214301e13d1a4450e3b6e8f195fbd41dc4436bdd7163e70481c5ec0
SSDEEP 196608:6eBlkqgUIrUuerlNUutjH0UdWSsmTSHKAK/9XLCnR:6qlFgU7rtz0Ud0SEK39XLE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	AaronGiles(1).tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Updater.exe

Executes dropped EXE 4 IoCs

pid	Process
1856	AaronGiles(1).tmp
1668	AaronGiles(1).tmp
2476	Updater.exe
2612	Updater.exe

Loads dropped DLL 4 IoCs

pid	Process
1856	AaronGiles(1).tmp
1856	AaronGiles(1).tmp
1668	AaronGiles(1).tmp
1668	AaronGiles(1).tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\aeahfaf = "\"C:\\feddcdc\\AutoIt3.exe\" C:\\feddcdc\\aeahfaf.a3x"	Updater.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
856	tasklist.exe
1700	tasklist.exe
2168	tasklist.exe
3984	tasklist.exe
4320	tasklist.exe
904	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 4560	2612	Updater.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AaronGiles(1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AaronGiles(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AaronGiles(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AaronGiles(1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1588	cmd.exe
3048	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Updater.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3048	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	AaronGiles(1).tmp
1668	AaronGiles(1).tmp

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	4320	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	856	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	4560	MSBuild.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	AaronGiles(1).tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1856	224	AaronGiles(1).exe	85
PID 224 wrote to memory of 1856	224	AaronGiles(1).exe	85
PID 224 wrote to memory of 1856	224	AaronGiles(1).exe	85
PID 1856 wrote to memory of 4604	1856	AaronGiles(1).tmp	87
PID 1856 wrote to memory of 4604	1856	AaronGiles(1).tmp	87
PID 1856 wrote to memory of 4604	1856	AaronGiles(1).tmp	87
PID 4604 wrote to memory of 1668	4604	AaronGiles(1).exe	88
PID 4604 wrote to memory of 1668	4604	AaronGiles(1).exe	88
PID 4604 wrote to memory of 1668	4604	AaronGiles(1).exe	88
PID 1668 wrote to memory of 3676	1668	AaronGiles(1).tmp	94
PID 1668 wrote to memory of 3676	1668	AaronGiles(1).tmp	94
PID 3676 wrote to memory of 2168	3676	cmd.exe	96
PID 3676 wrote to memory of 2168	3676	cmd.exe	96
PID 3676 wrote to memory of 1576	3676	cmd.exe	97
PID 3676 wrote to memory of 1576	3676	cmd.exe	97
PID 1668 wrote to memory of 3096	1668	AaronGiles(1).tmp	98
PID 1668 wrote to memory of 3096	1668	AaronGiles(1).tmp	98
PID 3096 wrote to memory of 3984	3096	cmd.exe	100
PID 3096 wrote to memory of 3984	3096	cmd.exe	100
PID 3096 wrote to memory of 1868	3096	cmd.exe	101
PID 3096 wrote to memory of 1868	3096	cmd.exe	101
PID 1668 wrote to memory of 3520	1668	AaronGiles(1).tmp	102
PID 1668 wrote to memory of 3520	1668	AaronGiles(1).tmp	102
PID 3520 wrote to memory of 4320	3520	cmd.exe	104
PID 3520 wrote to memory of 4320	3520	cmd.exe	104
PID 3520 wrote to memory of 4856	3520	cmd.exe	105
PID 3520 wrote to memory of 4856	3520	cmd.exe	105
PID 1668 wrote to memory of 3964	1668	AaronGiles(1).tmp	106
PID 1668 wrote to memory of 3964	1668	AaronGiles(1).tmp	106
PID 3964 wrote to memory of 904	3964	cmd.exe	108
PID 3964 wrote to memory of 904	3964	cmd.exe	108
PID 3964 wrote to memory of 3308	3964	cmd.exe	109
PID 3964 wrote to memory of 3308	3964	cmd.exe	109
PID 1668 wrote to memory of 3488	1668	AaronGiles(1).tmp	110
PID 1668 wrote to memory of 3488	1668	AaronGiles(1).tmp	110
PID 3488 wrote to memory of 856	3488	cmd.exe	112
PID 3488 wrote to memory of 856	3488	cmd.exe	112
PID 3488 wrote to memory of 2900	3488	cmd.exe	113
PID 3488 wrote to memory of 2900	3488	cmd.exe	113
PID 1668 wrote to memory of 4460	1668	AaronGiles(1).tmp	114
PID 1668 wrote to memory of 4460	1668	AaronGiles(1).tmp	114
PID 4460 wrote to memory of 1700	4460	cmd.exe	116
PID 4460 wrote to memory of 1700	4460	cmd.exe	116
PID 4460 wrote to memory of 1636	4460	cmd.exe	117
PID 4460 wrote to memory of 1636	4460	cmd.exe	117
PID 1668 wrote to memory of 2476	1668	AaronGiles(1).tmp	118
PID 1668 wrote to memory of 2476	1668	AaronGiles(1).tmp	118
PID 1668 wrote to memory of 2476	1668	AaronGiles(1).tmp	118
PID 2476 wrote to memory of 1588	2476	Updater.exe	121
PID 2476 wrote to memory of 1588	2476	Updater.exe	121
PID 2476 wrote to memory of 1588	2476	Updater.exe	121
PID 1588 wrote to memory of 3048	1588	cmd.exe	123
PID 1588 wrote to memory of 3048	1588	cmd.exe	123
PID 1588 wrote to memory of 3048	1588	cmd.exe	123
PID 1588 wrote to memory of 2612	1588	cmd.exe	126
PID 1588 wrote to memory of 2612	1588	cmd.exe	126
PID 1588 wrote to memory of 2612	1588	cmd.exe	126
PID 2612 wrote to memory of 3480	2612	Updater.exe	127
PID 2612 wrote to memory of 3480	2612	Updater.exe	127
PID 2612 wrote to memory of 3480	2612	Updater.exe	127
PID 2612 wrote to memory of 4560	2612	Updater.exe	128
PID 2612 wrote to memory of 4560	2612	Updater.exe	128
PID 2612 wrote to memory of 4560	2612	Updater.exe	128
PID 2612 wrote to memory of 4560	2612	Updater.exe	128

C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe
"C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\is-LA7DH.tmp\AaronGiles(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LA7DH.tmp\AaronGiles(1).tmp" /SL5="$80236,2983660,873472,C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe
    "C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\is-A6KOG.tmp\AaronGiles(1).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-A6KOG.tmp\AaronGiles(1).tmp" /SL5="$90236,2983660,873472,C:\Users\Admin\AppData\Local\Temp\AaronGiles(1).exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3676
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:1576
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:1868
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3520
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:4856
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3964
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:3308
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:2900
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Aaron\Updater.exe
        
        "C:\Users\Admin\AppData\Local\Aaron\\Updater.exe" "C:\Users\Admin\AppData\Local\Aaron\\invalidship.csv"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\eMOpGpWw7.a3x && del C:\ProgramData\\eMOpGpWw7.a3x
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Aaron\Updater.exe
        
        updater.exe C:\ProgramData\\eMOpGpWw7.a3x
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updater.exe

Path C:\Users\Admin\AppData\Local\Aaron\Updater.exe
Size 921KB
SHA256 1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48
MD5 3f58a517f1f4796225137e7659ad2adb
SHA1 e264ba0e9987b0ad0812e5dd4dd3075531cfe269
SHA512 acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634
SSDEEP 24576:MghN1a6pzWZ12+f+Qa7N4nEIRQ1hOOLkF6av8uh:vhN1aQzJD4BuTxavfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

invalidship.csv

Path C:\Users\Admin\AppData\Local\Aaron\invalidship.csv
Size 59KB
SHA256 395fb848248b5439a5512d28f523c6d845c14aa6b8095efeaa9746da04a51100
MD5 12673ebf028db60480eab93e8ca86346
SHA1 08ca40788ea495b6d275dc8b304925ee884ed084
SHA512 9901f09d69f11c3d5ecede3fd87ba6e9b4f731190c53170e24dedd225d3e16f8b37bcd4b8e0d42666bcc53b9d08874add8c11a8c8d5317e2d262fd60f69719d4
SSDEEP 1536:DDJTbCqFC3mhFOwLah/4qYkDwlu5mm4wejaJWDo:vtblFbGwLa2kElFZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

invalidship.gif

Path C:\Users\Admin\AppData\Local\Aaron\invalidship.gif
Size 517KB
SHA256 dae7faa86bb0a107867f0b0ac2073574850548c139804fcb9cea2b8f1cc8787f
MD5 f844d8bd22a742db716723be1e763a6c
SHA1 66e8fa3781a04267a69429de3bbdd04bcd0ceeab
SHA512 8e52f57d856b9897f8aefacd7c7b55531c7ba8ef558ce59032b6b6ea5368d50f952bca956b13277ba83ea7b3be32a254719988993a2adfa3ab982f4cdc438655
SSDEEP 12288:m40MCF2RHz84JoHZWqvWmouBfmhcpqEP03cMOkSSeDmsJ:70MCFmuHZZ3ecpqyx+yNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-06GA4.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
MD5 SHA1 SHA512 SSDEEP

Submit Download

AaronGiles(1).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LA7DH.tmp\AaronGiles(1).tmp
Size 3.2MB
SHA256 61a565ce5f393ae29b22cf0d1ce4024a351ec080b849f984fa86d9bbee9af861
MD5 1e6926fa1ac230e8c4ec9e177681e291
SHA1 e6b8d02a45e1093a1cfc829a6d9f53c26eae716e
SHA512 4bf911e4cf40f290af7ac798fa2e191c13a207bd5287e42aadbc84147bb6d3676721227ab7a8d2098f5c465f8fac2592ca3a5bd0ffb25b0ba5909817e17322a4
SSDEEP 49152:ZdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQE3332Olv2:/JYVM+LtVt3P/KuG2ONG9iqLRQE333G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-2-0x0000000000E81000-0x0000000000F29000-memory.dmp

Download

memory/224-0-0x0000000000E80000-0x0000000000F63000-memory.dmp

Download

memory/224-19-0x0000000000E80000-0x0000000000F63000-memory.dmp

Download

memory/1668-23-0x00000000035E0000-0x00000000035E1000-memory.dmp

Download

memory/1668-61-0x0000000000920000-0x0000000000C62000-memory.dmp

Download

memory/1856-17-0x0000000000090000-0x00000000003D2000-memory.dmp

Download

memory/1856-6-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/4560-74-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4560-75-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4560-76-0x0000000005710000-0x00000000057CC000-memory.dmp

Download

memory/4560-77-0x0000000005F00000-0x0000000006518000-memory.dmp

Download

memory/4560-78-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/4604-15-0x0000000000E80000-0x0000000000F63000-memory.dmp

Download

memory/4604-64-0x0000000000E80000-0x0000000000F63000-memory.dmp

Download