masslogger | de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78

Analysis

max time kernel
135s
max time network
140s
platform
windows7_x64
resource
win7
submitted
31-07-2020 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Q2020-07-466am.exe
Size

1.4MB
MD5

93a02efc3319e40884d86f0603d6073d
SHA1

df7966c6dda6c785ad4bcf5b7a49f0a99a9bc51e
SHA256

de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78
SHA512

620172b1822721b279eb1b92d288a2ee82056b77c91c59134edc1aa727524bee2e5211cc41d69e67b1dc1caf9c555e5f475b3fca97d3dd3b94b224443e5fc2c7

Score

10^/10

ransomware persistence spyware stealer masslogger

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.6.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/31/2020 10:19:20 AM MassLogger Started: 7/31/2020 10:19:14 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
ogsteve@airuhomes.com
Password:
y8wG[wgBvT]F

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Q2020-07-466am.exechulo.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 1448 Q2020-07-466am.exe
Token: SeDebugPrivilege 1856 chulo.exe
Token: SeDebugPrivilege 1988 InstallUtil.exe
Loads dropped DLL 2 IoCs

Processes:

Q2020-07-466am.exechulo.exe

pid process

1448 Q2020-07-466am.exe
1856 chulo.exe
Executes dropped EXE 2 IoCs

Processes:

chulo.exeInstallUtil.exe

pid process

1856 chulo.exe
1988 InstallUtil.exe
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

description	pid	process
Token: SeDebugPrivilege	1448	Q2020-07-466am.exe
Token: SeDebugPrivilege	1856	chulo.exe
Token: SeDebugPrivilege	1988	InstallUtil.exe

pid	process
1856	chulo.exe
1988	InstallUtil.exe

yara_rule
masslogger_log_file

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\chulo = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\chulo.exe"	reg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org

flow	ioc
6	api.ipify.org

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Q2020-07-466am.exechulo.exeInstallUtil.exe

pid	process
1448	Q2020-07-466am.exe
1448	Q2020-07-466am.exe
1448	Q2020-07-466am.exe
1856	chulo.exe
1856	chulo.exe
1856	chulo.exe
1988	InstallUtil.exe
1988	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Q2020-07-466am.execmd.exechulo.exe

description	pid	process	target process
PID 1448 wrote to memory of 1656	1448	Q2020-07-466am.exe	cmd.exe
PID 1448 wrote to memory of 1656	1448	Q2020-07-466am.exe	cmd.exe
PID 1448 wrote to memory of 1656	1448	Q2020-07-466am.exe	cmd.exe
PID 1448 wrote to memory of 1656	1448	Q2020-07-466am.exe	cmd.exe
PID 1656 wrote to memory of 1536	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1536	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1536	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1536	1656	cmd.exe	reg.exe
PID 1448 wrote to memory of 1856	1448	Q2020-07-466am.exe	chulo.exe
PID 1448 wrote to memory of 1856	1448	Q2020-07-466am.exe	chulo.exe
PID 1448 wrote to memory of 1856	1448	Q2020-07-466am.exe	chulo.exe
PID 1448 wrote to memory of 1856	1448	Q2020-07-466am.exe	chulo.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe
PID 1856 wrote to memory of 1988	1856	chulo.exe	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chulo.exe

description pid process target process

PID 1856 set thread context of 1988 1856 chulo.exe InstallUtil.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

InstallUtil.exe

pid process

1988 InstallUtil.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

InstallUtil.exe

pid process

1988 InstallUtil.exe
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

description	pid	process	target process
PID 1856 set thread context of 1988	1856	chulo.exe	InstallUtil.exe

pid	process
1988	InstallUtil.exe

pid	process
1988	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe
"C:\Users\Admin\AppData\Local\Temp\Q2020-07-466am.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chulo /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chulo.exe"
3⤵
- Adds Run key to start application
PID:1536

C:\Users\Admin\AppData\Roaming\chulo.exe
"C:\Users\Admin\AppData\Roaming\chulo.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1856

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
C:\Users\Admin\AppData\Roaming\chulo.exe

Download Submit
C:\Users\Admin\AppData\Roaming\chulo.exe

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Download Submit
\Users\Admin\AppData\Roaming\chulo.exe

Download Submit
memory/1448-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1536-4-0x0000000000000000-mapping.dmp

Download
memory/1656-3-0x0000000000000000-mapping.dmp

Download
memory/1856-6-0x0000000000000000-mapping.dmp

Download
memory/1988-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-33-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-19-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-21-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-20-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-24-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-27-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-146-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-35-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-39-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-40-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-42-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-43-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-44-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-45-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-46-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-47-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-48-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-49-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-50-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-51-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-52-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-53-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-86-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-87-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-88-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-89-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-90-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-91-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-92-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-93-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-94-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-95-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-96-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-97-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-98-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-99-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-100-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-101-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-102-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-103-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-104-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-105-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-106-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-107-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-108-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-109-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-110-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-111-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-112-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-113-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-114-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-115-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-116-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-117-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-118-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-119-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-120-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-121-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-122-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-123-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-124-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-125-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-126-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-127-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-128-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-129-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-130-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-131-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-132-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-14-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-140-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-160-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-15-0x00000000004ACB6E-mapping.dmp

Download
memory/1988-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-148-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-149-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-150-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-151-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-152-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-153-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-154-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-155-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-156-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-157-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-158-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-159-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-161-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-162-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-163-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-164-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-165-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-166-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-167-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-168-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-169-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-170-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-171-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-172-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-173-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-174-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-175-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-176-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-177-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-178-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-179-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-180-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-181-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-182-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-183-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-184-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-185-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-186-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-187-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-188-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-189-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-190-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-192-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-193-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-194-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-195-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-196-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-197-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-198-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-199-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-200-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-201-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-202-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-203-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-204-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-205-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-206-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-207-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-208-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-209-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-210-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-211-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-212-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-213-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-214-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-215-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-216-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-217-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-218-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-219-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-220-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-221-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-222-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-223-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-224-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-225-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-226-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-227-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-228-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-229-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-230-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-231-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-232-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-233-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-234-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-235-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-236-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-237-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-238-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-239-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-240-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-241-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-242-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-243-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-244-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-245-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-246-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-247-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-248-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-249-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-250-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-251-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-252-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-253-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-254-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-255-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-256-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-257-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-258-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-259-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-260-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-261-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-262-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-263-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-264-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-265-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-266-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-267-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-268-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-269-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-270-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-271-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-272-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-273-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-274-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-275-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download