wannacry | cb6602ec77e62c6f9f37a762870ee8917211d05f9138cf161047842e0eef8092

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10v200722
submitted
17-09-2020 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Size

3.6MB
MD5

d5dcd28612f4d6ffca0cfeaefd606bcf
SHA1

cf60fa60d2f461dddfdfcebf16368e6b539cd9ba
SHA256

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf
SHA512

dbfcf464c3211b7454c406a9f9532c416910ac24ea862d7061e3503f294d690b4957020dcc703984449e0934c7a595cf9061412fa25383850dd86235648ac23b

Score

10^/10

ransomware persistence spyware worm wannacry discovery

Malware Config

Extracted

Path

C:\ProgramData\yitnqofnjvk729\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 18 IoCs

Processes:

tasksche.exetasksche.exetaskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskse.exetaskdl.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskse.exe@WanaDecryptor@.exetaskdl.exe

pid	process
3548	tasksche.exe
2364	tasksche.exe
1316	taskdl.exe
3092	@WanaDecryptor@.exe
2060	@WanaDecryptor@.exe
2704	taskhsvc.exe
3512	taskse.exe
508	taskdl.exe
3504	@WanaDecryptor@.exe
2880	taskdl.exe
2200	taskse.exe
2728	@WanaDecryptor@.exe
2956	taskdl.exe
1268	taskse.exe
3036	@WanaDecryptor@.exe
4016	taskse.exe
2236	@WanaDecryptor@.exe
724	taskdl.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

tasksche.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\ApproveDismount.tif.WNCRYT	tasksche.exe
File renamed	C:\Users\Admin\Pictures\ApproveDismount.tif.WNCRYT => C:\Users\Admin\Pictures\ApproveDismount.tif.WNCRY	tasksche.exe
File opened for modification	C:\Users\Admin\Pictures\ApproveDismount.tif.WNCRY	tasksche.exe
File created	C:\Users\Admin\Pictures\UnblockMount.tif.WNCRYT	tasksche.exe
File renamed	C:\Users\Admin\Pictures\UnblockMount.tif.WNCRYT => C:\Users\Admin\Pictures\UnblockMount.tif.WNCRY	tasksche.exe
File opened for modification	C:\Users\Admin\Pictures\UnblockMount.tif.WNCRY	tasksche.exe

Drops startup file 2 IoCs

Processes:

tasksche.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD863B.tmp	tasksche.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8642.tmp	tasksche.exe

Loads dropped DLL 8 IoCs

Processes:

taskhsvc.exe

pid process

2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

2632 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe

pid	process
2632	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yitnqofnjvk729 = "\"C:\\ProgramData\\yitnqofnjvk729\\tasksche.exe\""	reg.exe

JavaScript code in executable 4 IoCs

Processes:

resource	yara_rule
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\taskhsvc.exe	js
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\taskhsvc.exe	js
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\LIBEAY32.dll	js
\ProgramData\yitnqofnjvk729\TaskData\Tor\libeay32.dll	js

Drops file in System32 directory 11 IoCs

Processes:

taskhsvc.exe32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\unverified-microdesc-consensus.tmp	taskhsvc.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\cached-microdesc-consensus.tmp	taskhsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\cached-microdescs.new	taskhsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\lock	taskhsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\state.tmp	taskhsvc.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tor\cached-certs.tmp	taskhsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

@WanaDecryptor@.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	@WanaDecryptor@.exe

Drops file in Windows directory 1 IoCs

Processes:

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe

description ioc process

File created C:\WINDOWS\tasksche.exe 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3964 vssadmin.exe

description	ioc	process
File created	C:\WINDOWS\tasksche.exe	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe

pid	process
3964	vssadmin.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.execscript.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	cscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	cscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	cscript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3704 reg.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

taskhsvc.exe

pid process

2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe
2704 taskhsvc.exe

pid	process
3704	reg.exe

pid	process
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe
2704	taskhsvc.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

taskse.exevssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeTcbPrivilege	3512	taskse.exe
Token: SeTcbPrivilege	3512	taskse.exe
Token: SeBackupPrivilege	2172	vssvc.exe
Token: SeRestorePrivilege	2172	vssvc.exe
Token: SeAuditPrivilege	2172	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	2408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: SeTcbPrivilege	2200	taskse.exe
Token: SeTcbPrivilege	2200	taskse.exe
Token: SeTcbPrivilege	1268	taskse.exe
Token: SeTcbPrivilege	1268	taskse.exe
Token: SeTcbPrivilege	4016	taskse.exe
Token: SeTcbPrivilege	4016	taskse.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe

pid	process
3092	@WanaDecryptor@.exe
2060	@WanaDecryptor@.exe
3092	@WanaDecryptor@.exe
2060	@WanaDecryptor@.exe
3504	@WanaDecryptor@.exe
3504	@WanaDecryptor@.exe
2728	@WanaDecryptor@.exe
3036	@WanaDecryptor@.exe
2236	@WanaDecryptor@.exe

Suspicious use of WriteProcessMemory 84 IoCs

Processes:

32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.execmd.exetasksche.execmd.execmd.exe@WanaDecryptor@.execmd.exetaskse.exe@WanaDecryptor@.execmd.exetaskse.exe

description	pid	process	target process
PID 3060 wrote to memory of 3548	3060	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe	tasksche.exe
PID 3060 wrote to memory of 3548	3060	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe	tasksche.exe
PID 3060 wrote to memory of 3548	3060	32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe	tasksche.exe
PID 3364 wrote to memory of 2364	3364	cmd.exe	tasksche.exe
PID 3364 wrote to memory of 2364	3364	cmd.exe	tasksche.exe
PID 3364 wrote to memory of 2364	3364	cmd.exe	tasksche.exe
PID 2364 wrote to memory of 2628	2364	tasksche.exe	attrib.exe
PID 2364 wrote to memory of 2628	2364	tasksche.exe	attrib.exe
PID 2364 wrote to memory of 2628	2364	tasksche.exe	attrib.exe
PID 2364 wrote to memory of 2632	2364	tasksche.exe	icacls.exe
PID 2364 wrote to memory of 2632	2364	tasksche.exe	icacls.exe
PID 2364 wrote to memory of 2632	2364	tasksche.exe	icacls.exe
PID 2364 wrote to memory of 1316	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 1316	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 1316	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 580	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 580	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 580	2364	tasksche.exe	cmd.exe
PID 580 wrote to memory of 3840	580	cmd.exe	cscript.exe
PID 580 wrote to memory of 3840	580	cmd.exe	cscript.exe
PID 580 wrote to memory of 3840	580	cmd.exe	cscript.exe
PID 2364 wrote to memory of 3092	2364	tasksche.exe	@WanaDecryptor@.exe
PID 2364 wrote to memory of 3092	2364	tasksche.exe	@WanaDecryptor@.exe
PID 2364 wrote to memory of 3092	2364	tasksche.exe	@WanaDecryptor@.exe
PID 2364 wrote to memory of 3828	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 3828	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 3828	2364	tasksche.exe	cmd.exe
PID 3828 wrote to memory of 2060	3828	cmd.exe	@WanaDecryptor@.exe
PID 3828 wrote to memory of 2060	3828	cmd.exe	@WanaDecryptor@.exe
PID 3828 wrote to memory of 2060	3828	cmd.exe	@WanaDecryptor@.exe
PID 3092 wrote to memory of 2704	3092	@WanaDecryptor@.exe	taskhsvc.exe
PID 3092 wrote to memory of 2704	3092	@WanaDecryptor@.exe	taskhsvc.exe
PID 3092 wrote to memory of 2704	3092	@WanaDecryptor@.exe	taskhsvc.exe
PID 2364 wrote to memory of 3512	2364	tasksche.exe	taskse.exe
PID 2364 wrote to memory of 3512	2364	tasksche.exe	taskse.exe
PID 2364 wrote to memory of 3512	2364	tasksche.exe	taskse.exe
PID 2364 wrote to memory of 508	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 508	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 508	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 3108	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 3108	2364	tasksche.exe	cmd.exe
PID 2364 wrote to memory of 3108	2364	tasksche.exe	cmd.exe
PID 3108 wrote to memory of 3704	3108	cmd.exe	reg.exe
PID 3108 wrote to memory of 3704	3108	cmd.exe	reg.exe
PID 3108 wrote to memory of 3704	3108	cmd.exe	reg.exe
PID 3512 wrote to memory of 3504	3512	taskse.exe	@WanaDecryptor@.exe
PID 3512 wrote to memory of 3504	3512	taskse.exe	@WanaDecryptor@.exe
PID 3512 wrote to memory of 3504	3512	taskse.exe	@WanaDecryptor@.exe
PID 2060 wrote to memory of 2620	2060	@WanaDecryptor@.exe	cmd.exe
PID 2060 wrote to memory of 2620	2060	@WanaDecryptor@.exe	cmd.exe
PID 2060 wrote to memory of 2620	2060	@WanaDecryptor@.exe	cmd.exe
PID 2620 wrote to memory of 3964	2620	cmd.exe	vssadmin.exe
PID 2620 wrote to memory of 3964	2620	cmd.exe	vssadmin.exe
PID 2620 wrote to memory of 3964	2620	cmd.exe	vssadmin.exe
PID 2620 wrote to memory of 2408	2620	cmd.exe	WMIC.exe
PID 2620 wrote to memory of 2408	2620	cmd.exe	WMIC.exe
PID 2620 wrote to memory of 2408	2620	cmd.exe	WMIC.exe
PID 2364 wrote to memory of 2880	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 2880	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 2880	2364	tasksche.exe	taskdl.exe
PID 2364 wrote to memory of 2200	2364	tasksche.exe	taskse.exe
PID 2364 wrote to memory of 2200	2364	tasksche.exe	taskse.exe
PID 2364 wrote to memory of 2200	2364	tasksche.exe	taskse.exe
PID 2200 wrote to memory of 2728	2200	taskse.exe	@WanaDecryptor@.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2628 attrib.exe

pid	process
2628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
"C:\Users\Admin\AppData\Local\Temp\32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3060

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
2⤵
- Executes dropped EXE
PID:3548

C:\Users\Admin\AppData\Local\Temp\32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe
C:\Users\Admin\AppData\Local\Temp\32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin.exe -m security
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3324

C:\Windows\system32\cmd.exe
cmd.exe /c "C:\ProgramData\yitnqofnjvk729\tasksche.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\ProgramData\yitnqofnjvk729\tasksche.exe
C:\ProgramData\yitnqofnjvk729\tasksche.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\attrib.exe
attrib +h .
3⤵
- Views/modifies file attributes
PID:2628

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
3⤵
- Modifies file permissions
PID:2632

C:\ProgramData\yitnqofnjvk729\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:1316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 313011600387475.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
4⤵
- Modifies data under HKEY_USERS
PID:3840

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
@WanaDecryptor@.exe co
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092

C:\ProgramData\yitnqofnjvk729\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @WanaDecryptor@.exe vs
3⤵
- Suspicious use of WriteProcessMemory
PID:3828

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
@WanaDecryptor@.exe vs
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
5⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
6⤵
- Interacts with shadow copies
PID:3964

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\ProgramData\yitnqofnjvk729\taskse.exe
taskse.exe C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
"C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe"
4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3504

C:\ProgramData\yitnqofnjvk729\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yitnqofnjvk729" /t REG_SZ /d "\"C:\ProgramData\yitnqofnjvk729\tasksche.exe\"" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yitnqofnjvk729" /t REG_SZ /d "\"C:\ProgramData\yitnqofnjvk729\tasksche.exe\"" /f
4⤵
- Adds Run key to start application
- Modifies registry key
PID:3704

C:\ProgramData\yitnqofnjvk729\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:2880

C:\ProgramData\yitnqofnjvk729\taskse.exe
taskse.exe C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
"C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2728

C:\ProgramData\yitnqofnjvk729\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:2956

C:\ProgramData\yitnqofnjvk729\taskse.exe
taskse.exe C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
"C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3036

C:\ProgramData\yitnqofnjvk729\taskse.exe
taskse.exe C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe
"C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236

C:\ProgramData\yitnqofnjvk729\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

File Deletion

T1107

File Permissions Modification

T1222

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\yitnqofnjvk729\00000000.res

Download Submit
C:\ProgramData\yitnqofnjvk729\00000000.res

Download Submit
C:\ProgramData\yitnqofnjvk729\313011600387475.bat

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\@WanaDecryptor@.exe.lnk

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\LIBEAY32.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\SSLEAY32.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\libevent-2-0-5.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\libssp-0.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\taskhsvc.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\taskhsvc.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\TaskData\Tor\zlib1.dll

Download Submit
C:\ProgramData\yitnqofnjvk729\b.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\c.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\c.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\f.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\m.vbs

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_bulgarian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_chinese (simplified).wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_chinese (traditional).wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_croatian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_czech.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_danish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_dutch.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_english.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_filipino.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_finnish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_french.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_german.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_greek.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_indonesian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_italian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_japanese.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_korean.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_latvian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_norwegian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_polish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_portuguese.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_romanian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_russian.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_slovak.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_spanish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_swedish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_turkish.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\msg\m_vietnamese.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\r.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\s.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\t.wnry

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskdl.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\tasksche.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\tasksche.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskse.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskse.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskse.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskse.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\taskse.exe

Download Submit
C:\ProgramData\yitnqofnjvk729\u.wnry

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\SolutionPackages\768e9479ae61c33b34e4a8f79ac4a76c\PackageResources\cardview\lib\native-common\assets\cardview-checkmark@4x.png.WNCRY

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\SolutionPackages\c5708ec8928d13607e6de397e5fb932d\PackageResources\OfflineFiles\jquery.min_a9aa74d836a33524bde3e897ad35f5f9.js.WNCRY

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.WNCRY

Download Submit
C:\Users\Admin\Desktop\@WanaDecryptor@.bmp

Download Submit
C:\Users\Admin\Documents\Opened.docx.WNCRY

Download Submit
C:\WINDOWS\tasksche.exe

Download Submit
C:\Windows\TEMP\0.WNCRYT

Download Submit
C:\Windows\TEMP\1.WNCRYT

Download Submit
C:\Windows\TEMP\10.WNCRYT

Download Submit
C:\Windows\TEMP\11.WNCRYT

Download Submit
C:\Windows\TEMP\12.WNCRYT

Download Submit
C:\Windows\TEMP\13.WNCRYT

Download Submit
C:\Windows\TEMP\14.WNCRYT

Download Submit
C:\Windows\TEMP\15.WNCRYT

Download Submit
C:\Windows\TEMP\16.WNCRYT

Download Submit
C:\Windows\TEMP\17.WNCRYT

Download Submit
C:\Windows\TEMP\18.WNCRYT

Download Submit
C:\Windows\TEMP\19.WNCRYT

Download Submit
C:\Windows\TEMP\2.WNCRYT

Download Submit
C:\Windows\TEMP\3.WNCRYT

Download Submit
C:\Windows\TEMP\4.WNCRYT

Download Submit
C:\Windows\TEMP\5.WNCRYT

Download Submit
C:\Windows\TEMP\6.WNCRYT

Download Submit
C:\Windows\TEMP\7.WNCRYT

Download Submit
C:\Windows\TEMP\8.WNCRYT

Download Submit
C:\Windows\TEMP\9.WNCRYT

Download Submit
C:\Windows\tasksche.exe

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libeay32.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libevent-2-0-5.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\libssp-0.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\ssleay32.dll

Download Submit
\ProgramData\yitnqofnjvk729\TaskData\Tor\zlib1.dll

Download Submit
memory/508-564-0x0000000000000000-mapping.dmp

Download
memory/580-47-0x0000000000000000-mapping.dmp

Download
memory/724-938-0x0000000000000000-mapping.dmp

Download
memory/1268-922-0x0000000000000000-mapping.dmp

Download
memory/1316-45-0x0000000000000000-mapping.dmp

Download
memory/2060-57-0x0000000000000000-mapping.dmp

Download
memory/2060-56-0x0000000000000000-mapping.dmp

Download
memory/2200-904-0x0000000000000000-mapping.dmp

Download
memory/2236-936-0x0000000000000000-mapping.dmp

Download
memory/2364-3-0x0000000000000000-mapping.dmp

Download
memory/2364-44-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2408-901-0x0000000000000000-mapping.dmp

Download
memory/2620-899-0x0000000000000000-mapping.dmp

Download
memory/2628-5-0x0000000000000000-mapping.dmp

Download
memory/2632-6-0x0000000000000000-mapping.dmp

Download
memory/2704-714-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-774-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-604-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-605-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-606-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-607-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-608-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-609-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-610-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-611-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-612-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-613-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-614-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-615-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-616-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-617-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-618-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-619-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-620-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-621-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-622-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-623-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-624-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-625-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-626-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-627-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-628-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-629-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-630-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-631-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-632-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-633-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-634-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-635-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-636-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-637-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-638-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-639-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-640-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-641-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-642-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-643-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-644-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-645-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-646-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-647-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-648-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-649-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-650-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-651-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-653-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-654-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-655-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-656-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-657-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-658-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-659-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-660-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-661-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-662-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-663-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-664-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-665-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-666-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-667-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-668-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-669-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-670-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-671-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-672-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-673-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-674-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-60-0x0000000000000000-mapping.dmp

Download
memory/2704-676-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-677-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-678-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-679-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-680-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-681-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-682-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-683-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-684-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-685-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-686-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-687-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-688-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-689-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-690-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-691-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-692-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-693-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-694-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-695-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-696-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-697-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-698-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-699-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-700-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-701-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-702-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-703-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-704-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-705-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-706-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-707-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-708-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-709-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-710-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-711-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-712-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-713-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-602-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-715-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-716-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-717-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-718-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-719-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-720-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-721-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-722-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-723-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-724-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-725-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-726-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-727-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-728-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-729-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-730-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-731-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-732-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-733-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-734-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-735-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-736-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-737-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-738-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-739-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-740-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-741-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-742-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-743-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-744-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-745-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-746-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-747-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-748-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-749-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-750-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-752-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-751-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-753-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-754-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-755-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-756-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-757-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-758-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-759-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-760-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-761-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-762-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-763-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-764-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-765-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-766-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-767-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-768-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-770-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-769-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-771-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-772-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-773-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-603-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-775-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-776-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-777-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-778-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-779-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-780-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-781-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-782-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-783-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-784-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-785-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-786-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-787-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-77-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2704-789-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-790-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-601-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-792-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-794-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-793-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-795-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-796-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-798-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-797-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-799-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-800-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-801-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-802-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-803-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-804-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-805-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-806-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-807-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-808-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-809-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-810-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-811-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-812-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-813-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-814-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-815-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-816-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-817-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-818-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-820-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-819-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-821-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-822-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-823-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-824-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-825-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-826-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-827-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-828-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-829-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-830-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-831-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-832-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-833-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-834-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-835-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-836-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-837-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-838-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-600-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-598-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-841-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-842-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-843-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-844-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-845-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-846-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-847-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-848-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-849-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-850-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-851-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-852-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-853-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-854-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-855-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-856-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-857-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-858-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-860-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-859-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-861-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-862-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-863-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-864-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-865-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-866-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-867-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-868-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-869-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-870-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-871-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-872-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-873-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-874-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-875-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-876-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-877-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-878-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-879-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-880-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-881-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-882-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-883-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-884-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-885-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-886-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-887-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-888-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-889-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-890-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-891-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-892-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-893-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-894-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-895-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-896-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-897-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-599-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-78-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/2704-597-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-79-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2704-596-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-595-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-594-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-241-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2704-593-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-242-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/2704-592-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-591-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-590-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-589-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-588-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-587-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-586-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-585-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-584-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-583-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-582-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-581-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-580-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-579-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-578-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-577-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-243-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2704-405-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2704-527-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-489-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-406-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/2704-408-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2704-407-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/2728-906-0x0000000000000000-mapping.dmp

Download
memory/2880-902-0x0000000000000000-mapping.dmp

Download
memory/2956-908-0x0000000000000000-mapping.dmp

Download
memory/3036-928-0x0000000000000000-mapping.dmp

Download
memory/3092-53-0x0000000000000000-mapping.dmp

Download
memory/3108-565-0x0000000000000000-mapping.dmp

Download
memory/3504-788-0x0000000000000000-mapping.dmp

Download
memory/3512-563-0x0000000000000000-mapping.dmp

Download
memory/3548-0-0x0000000000000000-mapping.dmp

Download
memory/3704-675-0x0000000000000000-mapping.dmp

Download
memory/3828-55-0x0000000000000000-mapping.dmp

Download
memory/3840-49-0x0000000000000000-mapping.dmp

Download
memory/3964-900-0x0000000000000000-mapping.dmp

Download
memory/4016-934-0x0000000000000000-mapping.dmp

Download