Analysis

  • max time kernel
    141s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    09-07-2020 13:37

General

  • Target

    PO457812.exe

  • Size

    977KB

  • MD5

    e9be709ac260b6fee77c32cecdea793b

  • SHA1

    636738162a4b5d516c15689152a93dcb4475cef1

  • SHA256

    3ae8eb9d4bc0b3f87a57648f25938b346986101428a5ed2a3f6c6d68bd5f5b4d

  • SHA512

    745faa24e0987c9d87412eec42a24e3e3fe2d926884c9131cb0133a583c43ad486f94f87989f96ce1062bcfce10a50431a1e0bf82083d947fc9a5578cd2f18b9

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/9/2020 3:38:23 PM MassLogger Started: 7/9/2020 3:38:20 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\PO457812.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    jaffinmark@yandex.ru
  • Password:
    @jaffinmarknma@344

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • MassLogger log file 1 IoCs

    Detects a log file produced by MassLogger.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO457812.exe
    "C:\Users\Admin\AppData\Local\Temp\PO457812.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Suspicious use of SetThreadContext
    • Maps connected drives based on registry
    • Suspicious use of WriteProcessMemory
    • Checks BIOS information in registry
    PID:240
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CXWsehPfmjN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC773.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:916
    • C:\Users\Admin\AppData\Local\Temp\PO457812.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1336

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpC773.tmp
  • memory/240-1-0x0000000000000000-0x0000000000000000-disk.dmp
  • memory/916-2-0x0000000000000000-mapping.dmp
  • memory/1336-4-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-5-0x00000000004ACCEE-mapping.dmp
  • memory/1336-6-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-7-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-8-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-9-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-10-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-11-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-12-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-13-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-14-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-15-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-16-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-17-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-18-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-19-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-20-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-21-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-22-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-23-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-24-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-25-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-26-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-27-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-28-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-29-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-30-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-31-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-32-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-33-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-34-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-35-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-36-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-37-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-38-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-39-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-40-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-41-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-42-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-43-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-44-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-45-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-46-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-47-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-48-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-49-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-50-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-51-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-52-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-53-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-54-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-55-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-56-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-57-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-58-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-59-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-60-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-61-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-62-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-63-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-64-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-65-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-66-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-67-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-68-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-69-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-70-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-71-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-72-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-73-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-74-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-75-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-76-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-77-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-78-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-79-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-80-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-81-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-82-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-83-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-84-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-85-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-86-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-87-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-88-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-89-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-90-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-91-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-92-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-93-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-94-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-95-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-96-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-97-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-98-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-99-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-100-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-101-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-102-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-103-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-104-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-105-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-106-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-107-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-108-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-109-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-110-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-111-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-112-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-113-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-114-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-115-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-116-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-117-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-118-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-119-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-120-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-121-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-122-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-123-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-124-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-125-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-126-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-127-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-128-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-129-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-130-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-131-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-132-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-133-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-134-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-135-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-136-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-137-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-138-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-139-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-140-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-141-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-142-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-143-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-144-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-145-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-146-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-147-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-148-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-149-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-150-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-151-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-152-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-153-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-154-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-155-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-156-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-157-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-158-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-159-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-160-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-161-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-162-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-163-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-164-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-165-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-166-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-167-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-168-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-169-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-170-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-171-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-172-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-173-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-174-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-175-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-176-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-177-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-178-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-179-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-180-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-181-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-182-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-183-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-184-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-185-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-186-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-187-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-188-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-189-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-190-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-191-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-192-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-193-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-194-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-195-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-196-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-197-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-198-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-199-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-200-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-201-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-202-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-203-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-204-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-205-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-206-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-207-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-208-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-209-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-210-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-211-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-212-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-213-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-214-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-215-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-216-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-217-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-218-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-219-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-220-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-221-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-222-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-223-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-224-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-225-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-226-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-227-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-228-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-229-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-230-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-231-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-232-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-233-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-234-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-235-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-236-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-237-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-238-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-239-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-240-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-241-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-242-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-243-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-244-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-245-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-246-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-247-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-248-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-249-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-250-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-251-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-252-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-253-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-254-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-255-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-256-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-257-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-258-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-259-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-260-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-261-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-262-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-263-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-264-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1336-265-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB