4decebf79d305dd15b222edefa271d353f8c39cf29235ea3a391b234917d4d25

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kwtor.dll
Size 4.2MB
Sample260505-pf13hsfv41
SHA256 4decebf79d305dd15b222edefa271d353f8c39cf29235ea3a391b234917d4d25
MD5 a995f4e3aff2514a01af0f29a0486144
SHA1 bd682060494e0b26af6911795d3529a7c95f53b2
SHA512 55c3a5683462f9ffa28a1c9d568559a1cf44ad91dcab65dc2f9f2ccdc4be50e5adc8869023665c30e832800866b30b73e03b8dc5f1f128b01e1f94cca1e1ef4f
SSDEEP 49152:5j4nm6Wlm9hXoqbCiOxiwKwH84Mm2tNEKoFNTMRiZj2VQcT+9eJt:50XFCV5+ETWo4t
TLSH
T16F264A1BACFD4CDEC0A9F130C4736212FD657840572267C71AE0A6691E677F0AAF6B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4680 created 3104	4680	rundll32.exe	53
PID 5348 created 3104	5348	dllhost.exe	53

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5260	rundll32.exe
3	5260	rundll32.exe
4	5260	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
128	pylupdate6.exe
2492	pylupdate6.exe

Loads dropped DLL 8 IoCs

pid	Process
128	pylupdate6.exe
128	pylupdate6.exe
2492	pylupdate6.exe
2492	pylupdate6.exe
128	pylupdate6.exe
128	pylupdate6.exe
128	pylupdate6.exe
128	pylupdate6.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4680	rundll32.exe
5260	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pylupdate6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pylupdate6.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\ResumeBackup\\Temp\\cb327c37.default-esr"	dllhost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4680	rundll32.exe
4680	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5348	dllhost.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4680	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe
5260	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	5260	rundll32.exe
Token: SeDebugPrivilege	5348	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4100	4680	rundll32.exe	78
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79
PID 4680 wrote to memory of 5260	4680	rundll32.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\kwtor.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\dllhost.exe
    C:\Windows\SysWOW64\dllhost.exe
    3⤵
    PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\pylupdate6.exe
  "C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\pylupdate6.exe" "C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\node_modules.asar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\pylupdate6.exe
C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\pylupdate6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\_ctypes.pyd
Size 123KB
SHA256 09ab59603da0f270c5807d5af756b7dcbfe795a7cf4cb1210d75e602df61f7fa
MD5 21dc72dd47e907e8d899fee445c1baea
SHA1 9c6c6ee6623278d9313bb43c75e0562f8f56ab3b
SHA512 8c7f174b111f5203f1d4a3842872b4196ee99e152881c615ee484fe03886896416486f01ea9baa841eda57f01a006b42a01fcebcfd6fdfe7f453a221dbf52ff2
SSDEEP 3072:S6I0iVTA9Gdw8zuUIkq0vFYyFZ6EI1GPtX:6dwwudB0vpj6K
TLSH
T121C34A53B66CC026D6D400FDE3B996726A2F30B04F76C4D359592C885EA10E3AF7A3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\libffi-8.dll
Size 34KB
SHA256 b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0
MD5 74d2b5e0120a6faae57042a9894c4430
SHA1 592f115016a964b7eb42860b589ed988e9fff314
SHA512 f3c62f270488d224e24e29a078439736fa51c9ac7b0378dd8ac1b6987c8b8942a0131062bd117977a37046d4b1488f0f719f355039692bc21418fdfbb182e231
SSDEEP 768:J4QHHH1n906QVjoPX2onHfQX5YiSyv7JPxWE1f:JDHHH1n28fJU7SyNPxj
TLSH
T18EF29F025F404CA6DEDE993574AA9739CB397B441BD081E3133AE8B50F116E2F5B81DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_modules.asar

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\node_modules.asar
Size 26.8MB
SHA256 1e5f251a796363918c46a44618504464c06de5b6bd05181403deba1dd2230eab
MD5 5c69844aaca512e9cdc803cbb0e90310
SHA1 7f043a6a714b52aa9f8cc6315dfe54e883e6c1c8
SHA512 acc06addd5298143866ead45ce15b951fbc91f7fa2ad858cada9aaa33d51c01e8c39e02d427bc43b9f633ecc47ddfbf5dabf0c0217f3fc8b1fd22d7ad2d165e2
SSDEEP 196608:IiILV2hDRvu39tCqfMpa7gFBpteqhJ1qfdHRlxokNf7wgQ2E:nILyvu/CqIa7gFB7eqkfJRlykNfEgQ2E
TLSH
T1CA57087867ECE6627349D30BDC20C86AA605C93FDB03A2585E676E675887F2F5F81031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pylupdate6.exe

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\pylupdate6.exe
Size 100KB
SHA256 8f5dcca6baf511ac49393dff90b4bb666274a7640ef3c79cb28aaeb81b7f4e52
MD5 f258109158af499b3ca733299bd62280
SHA1 c6f996ebe5e690e9f4af38915415344c2fd4e073
SHA512 885e4222961194026341ec6ec7d05ff4d573b547df45aab88232d150bbc33c4614bf7db5931014ec6b142542417ea1bfe2330952b4ec4774c6ac5a3ad5dc87c3
SSDEEP 1536:3o2k7CIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/84skZyvcvR9CfIL3u:QBwMpdCq/IM8uIGfV/84sIi
TLSH
T103A3F741E62DBDCEE548D4314A75E0F25E24ED723580A51EB7F37F062875293FA0A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\python3.dll
Size 71KB
SHA256 3e64f37a59274b8960c1d96b268934ed052eacfc885ce2ca85754c8ea80cf3f8
MD5 8f79895709f19a9a4e922781dbacd6ad
SHA1 aa944741dafa060611ab63b8172a34d490807a43
SHA512 f5860ee564ad3e8d2ecd9f7520f24c8b6121ea09dc3750bdcd52035913005f570044a6dbb9029e86a9f56af30199a1df16778eaa8060a23f4cb40128248eb003
SSDEEP 768:tQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIJ:gbTrnXngXMZEI1G0uyvcvR9lfILLEU
TLSH
T1B0734D5E6B54F8A2D6F629FC78D199CE242B12FC5F2984DFA47CD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314._pth

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\python314._pth
Size 80B
SHA256 2ed7ccda80e9e28ab5877902a9a325586c8a7b7b3e6731d944565bee082e216c
MD5 fd5220307b5be48ceb9092be8b37598c
SHA1 11c7160d662e3452c23aebf14fa6a0326283a39c
SHA512 031dee74946f3c8146e35d07dd976971299eeb836d41d4c4992e504089fda3ae15de9451915bdcc3062d6b10c6aa6f6315a5d6db5dbe80d9a9b1d1d547fa3f21
TLSH
T1A3A0220208A30080002020283FE000F88F32330C8F20320E8AC0AE380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\python314.dll
Size 5.6MB
SHA256 20d2e71df41ceb8a7d6f6c9777b7306deec91b74c2aa350d0ad02ebf5d7008ec
MD5 4ddaa84d929f0c161693a5e0f791df05
SHA1 53fb6153c259fc1d48e47603b73d8cd03c856abb
SHA512 4b98354d1324ccb2a813d0d3c95fe1dba8521acf729ba26cb51b1b46aa8c274c1242f9613399241fe66a34e40ad49517a13baec6d709c344236590fabed164fa
SSDEEP 98304:Bn+YrvybTDhTSSTSaQz+fAWBfVrc5r4HeMeGq6Q2wU:BnPvuhTSSIc+Ye4wU
TLSH
T194466C30F5B68469ECED00F1A2BB59775A6D1D04773484D3A8947C983C701E2A3FAEDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.zip

Path C:\Users\Admin\AppData\Roaming\ResumeBackup\Temp\cb327c37.default-esr\python314.zip
Size 3.9MB
SHA256 ee641e97ca4a0f948308a4991662aa44907d5e92806bf04e1798105e7aa938e3
MD5 6f4344feff8e22cee47b04b6583b45da
SHA1 814e99ae34bb0d28f6ffe5e93c07b9a622005e5b
SHA512 210cd9402c4d1e3b1b91ee7b28455e4a83a0614a8e5fd8db785c4a4bd833c40696398c1a90d55f5749f3ec70532c8a2737bc989d8511e67f8b18632b31c332a7
SSDEEP 98304:D7NTpJLBkBI/NYoVF91dG2H0wTot4YdqoM:HNTsIXF91dG2UwTot4YdqoM
TLSH
T13B163361DB7E0623FA63BB787A57CD09101E83A03104B53EDC0C9AE59C5539E877EB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4680-37-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-25-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-4-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-3-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-13-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-12-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-22-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-28-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-32-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-31-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-29-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-27-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-30-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-26-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-36-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-51-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-50-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-49-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-48-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-47-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-46-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-45-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-44-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-43-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-42-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-41-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-40-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-39-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-38-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-6-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-35-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-34-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-33-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-5-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-24-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-21-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-20-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-19-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-18-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-17-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-16-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-15-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-14-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-23-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-11-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-10-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-9-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-8-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-52-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-63-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-62-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-61-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-59-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-58-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-57-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-54-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-56-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-55-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-60-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-7-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-1-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-2-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/4680-0-0x000001DC49AC0000-0x000001DC49AC1000-memory.dmp

Download

memory/4680-53-0x000001DC49AE0000-0x000001DC49AE1000-memory.dmp

Download

memory/5348-2334-0x0000000004F80000-0x0000000004FCA000-memory.dmp

Download

memory/5348-2335-0x00000000051C0000-0x0000000005236000-memory.dmp

Download

memory/5348-2336-0x00000000055D0000-0x00000000055EE000-memory.dmp

Download

memory/5348-2341-0x0000000005830000-0x0000000005842000-memory.dmp

Download