ragnarlocker | 60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128

Analysis

max time kernel
112s
max time network
139s
platform
windows7_x64
resource
win7
submitted
01-10-2020 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Size

200KB
MD5

c2c82616348e40bd2ce31d4c32be4a7e
SHA1

2a378a324967be184225d50687a77221fe672595
SHA256

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128
SHA512

4b04c8ec077cf568908afb50ff67fbf9051fdd9f797bd969e9bcef43518d6f83e1ac184a860de1f3a3bc52940599f1d81efa8eff2d8cfff09fdc676fc9d331e6

Score

10^/10

ransomware evasion bootkit persistence ragnarlocker

Malware Config

Extracted

Path

C:\Users\Public\Documents\!$R4GN4R_F0C1BF83$!.txt

Family

ragnarlocker

Ransom Note

***************************************************************************************************************** HELLO mapfree.com ! IF YOU ARE READING THIS, IT'S MEAN YOUR DATA WAS ENCRYPTED AND YOU SENSITIVE PRIVATE INFORMATION WAS STOLEN! READ CAREFULLY THE WHOLE INSTRUCTION NOTES TO AVOID DIFFICULTIES WITH YOUR DATA by RAGNAR_LOCKER ! ***************************************************************************************************************** *YOU HAVE TO CONTACT US via LIVE CHAT IMMEDIATELY TO RESOLVE THIS CASE AND MAKE A DEAL* (contact information you will find at the bottom of this notes) !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT Use any third-party or public Decryption software, it also may DAMAGE files. DO NOT Shutdown or Reset your system, it can DAMAGE files ------------------------------------- There is ONLY ONE possible way to get back your files - contact us via LIVE CHAT and pay for the special DECRYPTION KEY ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, to show that it Works. Don't waste your TIME, the link for contact us will be deleted if there is no contact made in closest time and you will NEVER restore your DATA. !!! HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ! WARNING ! Whole your network was fully COMPROMISED! We BREACHED your security perimeter and get ACCESS to your PRIVATE SENSITIVE Data, including your Insuranse cases, Financial reports, Business audit reports, Non-Disclosure Agreements, Confidential files, DataBase files, Administrators directories and etc.! Also we have access to corporate correspondence, personal information about your clients and even more about your partners and your staff. - There are some screenshots just as a proofs of what we got on you. Screenshots: http://prnt.sc/tz6u6u http://prnt.sc/tz6uq9 http://prnt.sc/tz6uz9 http://prnt.sc/tz6w7x http://prnt.sc/tzoumv ------------------------------------- Whole data that gathered from your private files and directories could be published in MASS MEDIA for BREAKING NEWS! Yours partners, clients and investors would be notified about LEAK, the consequences will have a DISASTROUS effect on your company's STOCK PRICES! However if we make a deal everything would be kept in secret and all your data will be restored, so it is much cheaper and easier way than lawsuits expenses for you. You can take a look for some more examples of what we have, right now it's a private, temporary and hidden page, but it could become permanent and accessable for Public View if you decide NOT pay. Use Tor Browser to open the link: http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m to view the page's content use password: mNn36C6GOf ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?E5AddcB5e33bF83b3e3e23ef7fD9Dc28eAe4CA0f2D0992AC4d688A35eB5c543F c) To visit our NEWS LEAK BLOG with your data, open this website : http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m ( password: mNn36C6GOf ) d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---BEGIN KEY R_R--- RTVBZGRjQjVlMzNiRjgzYjNlM2UyM2VmN2ZEOURjMjhlQWU0Q0EwZjJEMDk5MkFDNGQ2ODhBMzVlQjVjNTQzRg== ---END KEY R_R--- ***********************************************************************************

URLs

http://prnt.sc/tz6u6u

http://prnt.sc/tz6uq9

http://prnt.sc/tz6uz9

http://prnt.sc/tz6w7x

http://prnt.sc/tzoumv

http://p6o7m73ujalhgkiv.onion/?J0gYIisP3R7m

http://rgngerzxui2kizq6h5ekefneizmn54n4bcjjthyvdir22orayuya5zad.onion/client/?E5AddcB5e33bF83b3e3e23ef7fD9Dc28eAe4CA0f2D0992AC4d688A35eB5c543F

Signatures

RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exe

pid process

824 bcdedit.exe
1604 bcdedit.exe
2040 bcdedit.exe

pid	process
824	bcdedit.exe
1604	bcdedit.exe
2040	bcdedit.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description ioc process

File opened (read-only) \??\E: 60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description	ioc	process
File opened (read-only)	\??\E:	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 2714 IoCs

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\!$R4GN4R_F0C1BF83$!.txt	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\!$R4GN4R_F0C1BF83$!.txt	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\!$R4GN4R_F0C1BF83$!.txt	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\PREVIEW.GIF	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\BOLDSTRI.INF	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\ECHO.INF	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\THMBNAIL.PNG	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1000 vssadmin.exe

pid	process
1000	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 369 IoCs

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

pid	process
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exewmic.exevssvc.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Token: SeRestorePrivilege	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
Token: SeIncreaseQuotaPrivilege	1792	wmic.exe
Token: SeSecurityPrivilege	1792	wmic.exe
Token: SeTakeOwnershipPrivilege	1792	wmic.exe
Token: SeLoadDriverPrivilege	1792	wmic.exe
Token: SeSystemProfilePrivilege	1792	wmic.exe
Token: SeSystemtimePrivilege	1792	wmic.exe
Token: SeProfSingleProcessPrivilege	1792	wmic.exe
Token: SeIncBasePriorityPrivilege	1792	wmic.exe
Token: SeCreatePagefilePrivilege	1792	wmic.exe
Token: SeBackupPrivilege	1792	wmic.exe
Token: SeRestorePrivilege	1792	wmic.exe
Token: SeShutdownPrivilege	1792	wmic.exe
Token: SeDebugPrivilege	1792	wmic.exe
Token: SeSystemEnvironmentPrivilege	1792	wmic.exe
Token: SeRemoteShutdownPrivilege	1792	wmic.exe
Token: SeUndockPrivilege	1792	wmic.exe
Token: SeManageVolumePrivilege	1792	wmic.exe
Token: 33	1792	wmic.exe
Token: 34	1792	wmic.exe
Token: 35	1792	wmic.exe
Token: SeBackupPrivilege	1952	vssvc.exe
Token: SeRestorePrivilege	1952	vssvc.exe
Token: SeAuditPrivilege	1952	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1792	wmic.exe
Token: SeSecurityPrivilege	1792	wmic.exe
Token: SeTakeOwnershipPrivilege	1792	wmic.exe
Token: SeLoadDriverPrivilege	1792	wmic.exe
Token: SeSystemProfilePrivilege	1792	wmic.exe
Token: SeSystemtimePrivilege	1792	wmic.exe
Token: SeProfSingleProcessPrivilege	1792	wmic.exe
Token: SeIncBasePriorityPrivilege	1792	wmic.exe
Token: SeCreatePagefilePrivilege	1792	wmic.exe
Token: SeBackupPrivilege	1792	wmic.exe
Token: SeRestorePrivilege	1792	wmic.exe
Token: SeShutdownPrivilege	1792	wmic.exe
Token: SeDebugPrivilege	1792	wmic.exe
Token: SeSystemEnvironmentPrivilege	1792	wmic.exe
Token: SeRemoteShutdownPrivilege	1792	wmic.exe
Token: SeUndockPrivilege	1792	wmic.exe
Token: SeManageVolumePrivilege	1792	wmic.exe
Token: 33	1792	wmic.exe
Token: 34	1792	wmic.exe
Token: 35	1792	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe

description	pid	process	target process
PID 1412 wrote to memory of 1792	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	wmic.exe
PID 1412 wrote to memory of 1792	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	wmic.exe
PID 1412 wrote to memory of 1792	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	wmic.exe
PID 1412 wrote to memory of 1792	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	wmic.exe
PID 1412 wrote to memory of 1000	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	vssadmin.exe
PID 1412 wrote to memory of 1000	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	vssadmin.exe
PID 1412 wrote to memory of 1000	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	vssadmin.exe
PID 1412 wrote to memory of 1000	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	vssadmin.exe
PID 1412 wrote to memory of 824	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 824	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 824	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 824	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 1604	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 1604	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 1604	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 1604	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 2040	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 2040	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 2040	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe
PID 1412 wrote to memory of 2040	1412	60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe
"C:\Users\Admin\AppData\Local\Temp\60233700ee64b9e5d054fa551688e8617328b194534a0fe645411685ce467128.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:824
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-106-0x0000000000000000-mapping.dmp

Download
memory/1000-105-0x0000000000000000-mapping.dmp

Download
memory/1412-400-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-209-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-2-0x00000000041C0000-0x00000000041D1000-memory.dmp

Filesize
68KB

Download
memory/1412-3-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-4-0x00000000041C0000-0x00000000041D1000-memory.dmp

Filesize
68KB

Download
memory/1412-7-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-11-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-15-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-19-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-23-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-27-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-29-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-33-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-35-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-37-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-41-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-45-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-49-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-57-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-63-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-69-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-71-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-75-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-79-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-87-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-95-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-101-0x00000000045D0000-0x00000000045E1000-memory.dmp

Filesize
68KB

Download
memory/1412-109-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-110-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-111-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-112-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-113-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-114-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-115-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-116-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-117-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-118-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-120-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-122-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-124-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-125-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-126-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-128-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-130-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-131-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-132-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-134-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-136-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-138-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-140-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-142-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-144-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-146-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-148-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-150-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-152-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-154-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-155-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-156-0x00000000056E0000-0x00000000056F1000-memory.dmp

Filesize
68KB

Download
memory/1412-157-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-158-0x00000000052C0000-0x00000000052D1000-memory.dmp

Filesize
68KB

Download
memory/1412-160-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-159-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-161-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-162-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-163-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-164-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-165-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-166-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-167-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-168-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-170-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-172-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-173-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-174-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-176-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-177-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-178-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-179-0x0000000004D20000-0x0000000004D31000-memory.dmp

Filesize
68KB

Download
memory/1412-180-0x0000000005130000-0x0000000005141000-memory.dmp

Filesize
68KB

Download
memory/1412-181-0x0000000004D20000-0x0000000004D31000-memory.dmp

Filesize
68KB

Download
memory/1412-182-0x0000000005130000-0x0000000005141000-memory.dmp

Filesize
68KB

Download
memory/1412-184-0x0000000005130000-0x0000000005141000-memory.dmp

Filesize
68KB

Download
memory/1412-183-0x0000000004D20000-0x0000000004D31000-memory.dmp

Filesize
68KB

Download
memory/1412-185-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-186-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-187-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-188-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-190-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-192-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-193-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-194-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-196-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-197-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-198-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-200-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-201-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-202-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-204-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-206-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-208-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-402-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-210-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-211-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-212-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-213-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-214-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-215-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-216-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-217-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-218-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-219-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-220-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-221-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-222-0x00000000055E0000-0x00000000055F1000-memory.dmp

Filesize
68KB

Download
memory/1412-223-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-224-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-225-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-226-0x00000000055E0000-0x00000000055F1000-memory.dmp

Filesize
68KB

Download
memory/1412-228-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-230-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-232-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-234-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-235-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-236-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-238-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-240-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-242-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-243-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-244-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-246-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-248-0x00000000055E0000-0x00000000055F1000-memory.dmp

Filesize
68KB

Download
memory/1412-250-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-251-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-252-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-253-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-254-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-256-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-257-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-258-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-259-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-260-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-262-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-263-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-264-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-265-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-266-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-267-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-268-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-270-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-271-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-272-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-273-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-278-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-282-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-284-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-286-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-287-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-288-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-290-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-292-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-295-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-296-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-298-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-300-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-302-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-304-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-306-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-308-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-310-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-312-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-313-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-314-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-315-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-316-0x0000000006220000-0x0000000006231000-memory.dmp

Filesize
68KB

Download
memory/1412-317-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-318-0x0000000006220000-0x0000000006231000-memory.dmp

Filesize
68KB

Download
memory/1412-319-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-320-0x0000000005AE0000-0x0000000005AF1000-memory.dmp

Filesize
68KB

Download
memory/1412-321-0x00000000052C0000-0x00000000052D1000-memory.dmp

Filesize
68KB

Download
memory/1412-322-0x00000000056D0000-0x00000000056E1000-memory.dmp

Filesize
68KB

Download
memory/1412-323-0x00000000052C0000-0x00000000052D1000-memory.dmp

Filesize
68KB

Download
memory/1412-324-0x00000000056D0000-0x00000000056E1000-memory.dmp

Filesize
68KB

Download
memory/1412-325-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-326-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-327-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-328-0x0000000005D60000-0x0000000005D71000-memory.dmp

Filesize
68KB

Download
memory/1412-330-0x00000000056D0000-0x00000000056E1000-memory.dmp

Filesize
68KB

Download
memory/1412-331-0x00000000052C0000-0x00000000052D1000-memory.dmp

Filesize
68KB

Download
memory/1412-332-0x00000000056D0000-0x00000000056E1000-memory.dmp

Filesize
68KB

Download
memory/1412-333-0x00000000052C0000-0x00000000052D1000-memory.dmp

Filesize
68KB

Download
memory/1412-334-0x00000000056D0000-0x00000000056E1000-memory.dmp

Filesize
68KB

Download
memory/1412-335-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-336-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-337-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-338-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-339-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-340-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-341-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-342-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-343-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-344-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-346-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-347-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-348-0x00000000056E0000-0x00000000056F1000-memory.dmp

Filesize
68KB

Download
memory/1412-349-0x00000000056E0000-0x00000000056F1000-memory.dmp

Filesize
68KB

Download
memory/1412-350-0x0000000005BF0000-0x0000000005C01000-memory.dmp

Filesize
68KB

Download
memory/1412-351-0x0000000005BF0000-0x0000000005C01000-memory.dmp

Filesize
68KB

Download
memory/1412-352-0x0000000006280000-0x0000000006291000-memory.dmp

Filesize
68KB

Download
memory/1412-354-0x0000000006690000-0x00000000066A1000-memory.dmp

Filesize
68KB

Download
memory/1412-353-0x0000000006280000-0x0000000006291000-memory.dmp

Filesize
68KB

Download
memory/1412-355-0x0000000006280000-0x0000000006291000-memory.dmp

Filesize
68KB

Download
memory/1412-357-0x0000000005CF0000-0x0000000005D01000-memory.dmp

Filesize
68KB

Download
memory/1412-358-0x0000000006100000-0x0000000006111000-memory.dmp

Filesize
68KB

Download
memory/1412-359-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-360-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-362-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-363-0x00000000060E0000-0x00000000060F1000-memory.dmp

Filesize
68KB

Download
memory/1412-0-0x0000000001BCC000-0x0000000001BCD000-memory.dmp

Filesize
4KB

Download
memory/1412-365-0x0000000006360000-0x0000000006371000-memory.dmp

Filesize
68KB

Download
memory/1412-366-0x0000000007040000-0x0000000007051000-memory.dmp

Filesize
68KB

Download
memory/1412-368-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/1412-367-0x0000000007040000-0x0000000007051000-memory.dmp

Filesize
68KB

Download
memory/1412-370-0x0000000008420000-0x0000000008431000-memory.dmp

Filesize
68KB

Download
memory/1412-369-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/1412-371-0x0000000007A10000-0x0000000007A21000-memory.dmp

Filesize
68KB

Download
memory/1412-372-0x0000000008420000-0x0000000008431000-memory.dmp

Filesize
68KB

Download
memory/1412-373-0x0000000007550000-0x0000000007561000-memory.dmp

Filesize
68KB

Download
memory/1412-374-0x0000000007960000-0x0000000007971000-memory.dmp

Filesize
68KB

Download
memory/1412-375-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-376-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-377-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-378-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-380-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-381-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-382-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-384-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-388-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-390-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-392-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-396-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-398-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-364-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-1-0x00000000036C0000-0x00000000036D1000-memory.dmp

Filesize
68KB

Download
memory/1412-461-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-406-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-407-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-408-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-410-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-411-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-412-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-413-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-414-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-416-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-417-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-418-0x0000000005820000-0x0000000005831000-memory.dmp

Filesize
68KB

Download
memory/1412-419-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-420-0x0000000005820000-0x0000000005831000-memory.dmp

Filesize
68KB

Download
memory/1412-422-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-423-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-424-0x00000000064A0000-0x00000000064B1000-memory.dmp

Filesize
68KB

Download
memory/1412-425-0x00000000064A0000-0x00000000064B1000-memory.dmp

Filesize
68KB

Download
memory/1412-426-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1412-427-0x00000000064A0000-0x00000000064B1000-memory.dmp

Filesize
68KB

Download
memory/1412-428-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1412-430-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1412-431-0x0000000006360000-0x0000000006371000-memory.dmp

Filesize
68KB

Download
memory/1412-432-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1412-433-0x0000000006360000-0x0000000006371000-memory.dmp

Filesize
68KB

Download
memory/1412-434-0x0000000007EF0000-0x0000000007F01000-memory.dmp

Filesize
68KB

Download
memory/1412-436-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-438-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-442-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-444-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-446-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-448-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-450-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-452-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-453-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-454-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-455-0x0000000005300000-0x0000000005311000-memory.dmp

Filesize
68KB

Download
memory/1412-456-0x0000000006C20000-0x0000000006C31000-memory.dmp

Filesize
68KB

Download
memory/1412-457-0x0000000006C20000-0x0000000006C31000-memory.dmp

Filesize
68KB

Download
memory/1412-458-0x0000000007B30000-0x0000000007B41000-memory.dmp

Filesize
68KB

Download
memory/1412-459-0x0000000007B30000-0x0000000007B41000-memory.dmp

Filesize
68KB

Download
memory/1412-460-0x0000000008BC0000-0x0000000008BD1000-memory.dmp

Filesize
68KB

Download
memory/1412-405-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-462-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-463-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-465-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-466-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-467-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-468-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-469-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-470-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-471-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-472-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-473-0x0000000009450000-0x0000000009461000-memory.dmp

Filesize
68KB

Download
memory/1412-474-0x0000000009860000-0x0000000009871000-memory.dmp

Filesize
68KB

Download
memory/1412-475-0x0000000009210000-0x0000000009221000-memory.dmp

Filesize
68KB

Download
memory/1412-476-0x0000000009620000-0x0000000009631000-memory.dmp

Filesize
68KB

Download
memory/1412-477-0x0000000005040000-0x0000000005051000-memory.dmp

Filesize
68KB

Download
memory/1412-478-0x0000000005450000-0x0000000005461000-memory.dmp

Filesize
68KB

Download
memory/1412-480-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-482-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-483-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-484-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-486-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-490-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-492-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-494-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-496-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-497-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-498-0x0000000005BE0000-0x0000000005BF1000-memory.dmp

Filesize
68KB

Download
memory/1412-499-0x0000000005BE0000-0x0000000005BF1000-memory.dmp

Filesize
68KB

Download
memory/1412-500-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-501-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-502-0x0000000006900000-0x0000000006911000-memory.dmp

Filesize
68KB

Download
memory/1412-503-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-504-0x0000000006900000-0x0000000006911000-memory.dmp

Filesize
68KB

Download
memory/1412-505-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-506-0x0000000006900000-0x0000000006911000-memory.dmp

Filesize
68KB

Download
memory/1412-507-0x0000000006130000-0x0000000006141000-memory.dmp

Filesize
68KB

Download
memory/1412-508-0x0000000006540000-0x0000000006551000-memory.dmp

Filesize
68KB

Download
memory/1412-510-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-511-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-514-0x00000000063B0000-0x00000000063C1000-memory.dmp

Filesize
68KB

Download
memory/1412-515-0x00000000063B0000-0x00000000063C1000-memory.dmp

Filesize
68KB

Download
memory/1412-516-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/1412-518-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-522-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-524-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-526-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-528-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-530-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-531-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-532-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-534-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-535-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-536-0x00000000051D0000-0x00000000051E1000-memory.dmp

Filesize
68KB

Download
memory/1412-538-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-537-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-539-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-540-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-541-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-542-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-544-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-545-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-546-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-550-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-552-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-554-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-556-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-558-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-560-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-562-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-564-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-566-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-568-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-572-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-574-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-576-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-578-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-580-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-582-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-584-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-586-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-588-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-590-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-592-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-593-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-594-0x0000000005090000-0x00000000050A1000-memory.dmp

Filesize
68KB

Download
memory/1412-596-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-598-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-600-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-602-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-604-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-606-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-608-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-610-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-611-0x0000000004C40000-0x0000000004C51000-memory.dmp

Filesize
68KB

Download
memory/1412-614-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-616-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-618-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-620-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-621-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-622-0x0000000005E60000-0x0000000005E71000-memory.dmp

Filesize
68KB

Download
memory/1412-623-0x0000000005E60000-0x0000000005E71000-memory.dmp

Filesize
68KB

Download
memory/1412-624-0x00000000063B0000-0x00000000063C1000-memory.dmp

Filesize
68KB

Download
memory/1412-625-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-626-0x0000000005D20000-0x0000000005D31000-memory.dmp

Filesize
68KB

Download
memory/1412-627-0x0000000004C80000-0x0000000004C91000-memory.dmp

Filesize
68KB

Download
memory/1412-628-0x0000000005D20000-0x0000000005D31000-memory.dmp

Filesize
68KB

Download
memory/1412-630-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-632-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-633-0x0000000004E40000-0x0000000004E51000-memory.dmp

Filesize
68KB

Download
memory/1412-634-0x0000000005820000-0x0000000005831000-memory.dmp

Filesize
68KB

Download
memory/1412-635-0x0000000004D40000-0x0000000004D51000-memory.dmp

Filesize
68KB

Download
memory/1412-636-0x00000000056E0000-0x00000000056F1000-memory.dmp

Filesize
68KB

Download
memory/1412-637-0x0000000005400000-0x0000000005411000-memory.dmp

Filesize
68KB

Download
memory/1412-638-0x0000000005810000-0x0000000005821000-memory.dmp

Filesize
68KB

Download
memory/1412-639-0x0000000005540000-0x0000000005551000-memory.dmp

Filesize
68KB

Download
memory/1412-640-0x00000000064E0000-0x00000000064F1000-memory.dmp

Filesize
68KB

Download
memory/1412-641-0x00000000064E0000-0x00000000064F1000-memory.dmp

Filesize
68KB

Download
memory/1412-642-0x0000000006AF0000-0x0000000006B01000-memory.dmp

Filesize
68KB

Download
memory/1412-643-0x00000000064E0000-0x00000000064F1000-memory.dmp

Filesize
68KB

Download
memory/1412-644-0x0000000006AF0000-0x0000000006B01000-memory.dmp

Filesize
68KB

Download
memory/1412-645-0x00000000063A0000-0x00000000063B1000-memory.dmp

Filesize
68KB

Download
memory/1412-646-0x00000000067B0000-0x00000000067C1000-memory.dmp

Filesize
68KB

Download
memory/1412-647-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-648-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-650-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-651-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-652-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-653-0x0000000004F00000-0x0000000004F11000-memory.dmp

Filesize
68KB

Download
memory/1412-654-0x0000000005310000-0x0000000005321000-memory.dmp

Filesize
68KB

Download
memory/1412-656-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-658-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-660-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-661-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-662-0x0000000005AA0000-0x0000000005AB1000-memory.dmp

Filesize
68KB

Download
memory/1412-663-0x0000000005AA0000-0x0000000005AB1000-memory.dmp

Filesize
68KB

Download
memory/1412-664-0x0000000006130000-0x0000000006141000-memory.dmp

Filesize
68KB

Download
memory/1412-665-0x0000000006D80000-0x0000000006D91000-memory.dmp

Filesize
68KB

Download
memory/1412-666-0x0000000007190000-0x00000000071A1000-memory.dmp

Filesize
68KB

Download
memory/1412-667-0x0000000006E80000-0x0000000006E91000-memory.dmp

Filesize
68KB

Download
memory/1412-668-0x0000000007290000-0x00000000072A1000-memory.dmp

Filesize
68KB

Download
memory/1412-670-0x0000000005720000-0x0000000005731000-memory.dmp

Filesize
68KB

Download
memory/1412-672-0x0000000005720000-0x0000000005731000-memory.dmp

Filesize
68KB

Download
memory/1412-674-0x0000000005720000-0x0000000005731000-memory.dmp

Filesize
68KB

Download
memory/1412-676-0x0000000005720000-0x0000000005731000-memory.dmp

Filesize
68KB

Download
memory/1412-678-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-680-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-684-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-685-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-686-0x00000000064A0000-0x00000000064B1000-memory.dmp

Filesize
68KB

Download
memory/1412-687-0x00000000064A0000-0x00000000064B1000-memory.dmp

Filesize
68KB

Download
memory/1412-688-0x0000000007030000-0x0000000007041000-memory.dmp

Filesize
68KB

Download
memory/1412-689-0x0000000007640000-0x0000000007651000-memory.dmp

Filesize
68KB

Download
memory/1412-690-0x0000000007A50000-0x0000000007A61000-memory.dmp

Filesize
68KB

Download
memory/1412-691-0x0000000007640000-0x0000000007651000-memory.dmp

Filesize
68KB

Download
memory/1412-692-0x00000000080A0000-0x00000000080B1000-memory.dmp

Filesize
68KB

Download
memory/1412-693-0x0000000007640000-0x0000000007651000-memory.dmp

Filesize
68KB

Download
memory/1412-694-0x00000000080A0000-0x00000000080B1000-memory.dmp

Filesize
68KB

Download
memory/1412-695-0x00000000080A0000-0x00000000080B1000-memory.dmp

Filesize
68KB

Download
memory/1412-696-0x0000000008E70000-0x0000000008E81000-memory.dmp

Filesize
68KB

Download
memory/1412-697-0x0000000008E70000-0x0000000008E81000-memory.dmp

Filesize
68KB

Download
memory/1412-698-0x00000000099C0000-0x00000000099D1000-memory.dmp

Filesize
68KB

Download
memory/1412-699-0x0000000008E70000-0x0000000008E81000-memory.dmp

Filesize
68KB

Download
memory/1412-700-0x00000000099C0000-0x00000000099D1000-memory.dmp

Filesize
68KB

Download
memory/1412-701-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-702-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-704-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-706-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-707-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-708-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-709-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-710-0x00000000054A0000-0x00000000054B1000-memory.dmp

Filesize
68KB

Download
memory/1412-713-0x00000000064F0000-0x0000000006501000-memory.dmp

Filesize
68KB

Download
memory/1412-714-0x0000000006B10000-0x0000000006B21000-memory.dmp

Filesize
68KB

Download
memory/1412-715-0x0000000006B10000-0x0000000006B21000-memory.dmp

Filesize
68KB

Download
memory/1412-717-0x0000000004B40000-0x0000000004B51000-memory.dmp

Filesize
68KB

Download
memory/1412-718-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-720-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-722-0x0000000004F50000-0x0000000004F61000-memory.dmp

Filesize
68KB

Download
memory/1412-723-0x0000000004F40000-0x0000000004F51000-memory.dmp

Filesize
68KB

Download
memory/1412-724-0x00000000065E0000-0x00000000065F1000-memory.dmp

Filesize
68KB

Download
memory/1412-725-0x00000000065E0000-0x00000000065F1000-memory.dmp

Filesize
68KB

Download
memory/1412-726-0x00000000078F0000-0x0000000007901000-memory.dmp

Filesize
68KB

Download
memory/1412-727-0x00000000065E0000-0x00000000065F1000-memory.dmp

Filesize
68KB

Download
memory/1412-728-0x00000000078F0000-0x0000000007901000-memory.dmp

Filesize
68KB

Download
memory/1412-729-0x0000000005720000-0x0000000005731000-memory.dmp

Filesize
68KB

Download
memory/1412-730-0x00000000065E0000-0x00000000065F1000-memory.dmp

Filesize
68KB

Download
memory/1412-731-0x0000000005E00000-0x0000000005E11000-memory.dmp

Filesize
68KB

Download
memory/1412-732-0x0000000006210000-0x0000000006221000-memory.dmp

Filesize
68KB

Download
memory/1412-733-0x0000000006200000-0x0000000006211000-memory.dmp

Filesize
68KB

Download
memory/1412-734-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/1412-735-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/1412-736-0x0000000008F30000-0x0000000008F41000-memory.dmp

Filesize
68KB

Download
memory/1412-737-0x0000000008F30000-0x0000000008F41000-memory.dmp

Filesize
68KB

Download
memory/1412-738-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/1412-739-0x0000000004DC0000-0x0000000004DD1000-memory.dmp

Filesize
68KB

Download
memory/1412-740-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/1412-741-0x00000000073E0000-0x00000000073F1000-memory.dmp

Filesize
68KB

Download
memory/1412-742-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/1604-107-0x0000000000000000-mapping.dmp

Download
memory/1792-104-0x0000000000000000-mapping.dmp

Download
memory/2040-108-0x0000000000000000-mapping.dmp

Download