masslogger | 70502bb6c9fd88cdce1092f83ef2f6408a039c7b9de5652cd22087159dd8ba28

Analysis

max time kernel
139s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
09-11-2020 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cxaunOASPiVka6y.exe
Size

958KB
MD5

25f14213809e9a73bb703503fdd72df7
SHA1

79eea20c462aba792a1f0eca0d23c76f954a3c8b
SHA256

70502bb6c9fd88cdce1092f83ef2f6408a039c7b9de5652cd22087159dd8ba28
SHA512

b087edb0563ad6110be8fac0cb20113e28b7c3b0e60bb017b6ab28cfeae47f9a36fd8644ba3c56bb49d88ccdcc24594e623795a897ec64f430671d472e4f8dd6

Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\109933CE9F\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/10/2020 8:20:07 PM MassLogger Started: 11/10/2020 8:20:03 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\cxaunOASPiVka6y.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
accounting@americantrevalerinc.com
Password:
1q2w3e4r5t

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral2/memory/4800-7-0x0000000002DE0000-0x0000000002DE2000-memory.dmp	coreentity

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.

Processes:

yara_rule

masslogger_log_file

yara_rule
masslogger_log_file

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/4800-8-0x00000000054B0000-0x0000000005562000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cxaunOASPiVka6y.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	cxaunOASPiVka6y.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

cxaunOASPiVka6y.exe

description pid process target process

PID 4800 set thread context of 652 4800 cxaunOASPiVka6y.exe cxaunOASPiVka6y.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

584 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

cxaunOASPiVka6y.exe

pid process

652 cxaunOASPiVka6y.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

cxaunOASPiVka6y.execxaunOASPiVka6y.exe

pid process

4800 cxaunOASPiVka6y.exe
4800 cxaunOASPiVka6y.exe
652 cxaunOASPiVka6y.exe
652 cxaunOASPiVka6y.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cxaunOASPiVka6y.execxaunOASPiVka6y.exe

description pid process

Token: SeDebugPrivilege 4800 cxaunOASPiVka6y.exe
Token: SeDebugPrivilege 652 cxaunOASPiVka6y.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cxaunOASPiVka6y.exe

pid process

652 cxaunOASPiVka6y.exe

flow	ioc
18	api.ipify.org

description	pid	process	target process
PID 4800 set thread context of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe

pid	process
584	schtasks.exe

pid	process
652	cxaunOASPiVka6y.exe

pid	process
4800	cxaunOASPiVka6y.exe
4800	cxaunOASPiVka6y.exe
652	cxaunOASPiVka6y.exe
652	cxaunOASPiVka6y.exe

description	pid	process
Token: SeDebugPrivilege	4800	cxaunOASPiVka6y.exe
Token: SeDebugPrivilege	652	cxaunOASPiVka6y.exe

pid	process
652	cxaunOASPiVka6y.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

cxaunOASPiVka6y.exe

description	pid	process	target process
PID 4800 wrote to memory of 584	4800	cxaunOASPiVka6y.exe	schtasks.exe
PID 4800 wrote to memory of 584	4800	cxaunOASPiVka6y.exe	schtasks.exe
PID 4800 wrote to memory of 584	4800	cxaunOASPiVka6y.exe	schtasks.exe
PID 4800 wrote to memory of 1004	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 1004	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 1004	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe
PID 4800 wrote to memory of 652	4800	cxaunOASPiVka6y.exe	cxaunOASPiVka6y.exe

C:\Users\Admin\AppData\Local\Temp\cxaunOASPiVka6y.exe
"C:\Users\Admin\AppData\Local\Temp\cxaunOASPiVka6y.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LSBoZRAg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2E83.tmp"
2⤵
- Creates scheduled task(s)
PID:584

C:\Users\Admin\AppData\Local\Temp\cxaunOASPiVka6y.exe
"{path}"
2⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\cxaunOASPiVka6y.exe
"{path}"
2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cxaunOASPiVka6y.exe.log
MD5
df5e4d5b51d7f383ba5952118373f00d

SHA1
4f66b6a5a5d79226c327833570315c1c299f9783

SHA256
8309f1008720221269d7e532141f0df688df00959fae7d5ab46dd9ebef0fd1c7

SHA512
cdbbcd33408126a2a4408cd8ae3113d930af993ac0f45f545101a2018aa2015b44b4559c6f742fa8b3b38366274fbb966346b0e11bc6cfa95861408e438069b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2E83.tmp
MD5
d70230492d3ff24726527630339cc3db

SHA1
5e6749b7f86eed05f9e6b6b2327959554ab0d607

SHA256
99ae929c748927c9a384b177f452444fcd3f5974c664306984a68d6cd0166007

SHA512
920a54954be67f1d7bd8324745b3ba0e822e9a3fb839612f2d2a7846a66582d7b3f481749d38fe0379c6c12776d70b0c591aee3746aaade99a4a8881f3dbd46c

Download Submit
memory/584-12-0x0000000000000000-mapping.dmp

Download
memory/652-146-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-31-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-281-0x0000000007090000-0x000000000709F000-memory.dmp

Filesize
60KB

Download
memory/652-280-0x0000000008320000-0x0000000008321000-memory.dmp

Filesize
4KB

Download
memory/652-277-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/652-276-0x0000000005490000-0x00000000054CE000-memory.dmp

Filesize
248KB

Download
memory/652-17-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/652-21-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-22-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-23-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-24-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-25-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-26-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-28-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-27-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-29-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-148-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-32-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-33-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-34-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-35-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-36-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-30-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-20-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-37-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-38-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-39-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-41-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-43-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-45-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-44-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-46-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-47-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-48-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-49-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-51-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-50-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-52-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-54-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-53-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-55-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-56-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-57-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-58-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-63-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-60-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-64-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-65-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-66-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-67-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-68-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-69-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-70-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-71-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-72-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-73-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-75-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-74-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-76-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-77-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-78-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-79-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-81-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-83-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-82-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-80-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-84-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-86-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-85-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-87-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-89-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-88-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-90-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-91-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-92-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-93-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-94-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-95-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-96-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-97-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-99-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-98-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-100-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-101-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-103-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-102-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-104-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-105-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-106-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-107-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-108-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-109-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-110-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-111-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-112-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-113-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-115-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-114-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-116-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-117-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-119-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-120-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-121-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-122-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-118-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-123-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-125-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-124-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-126-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-127-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-128-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-129-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-130-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-131-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-132-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-133-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-134-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-135-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-136-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-137-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-138-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-139-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-141-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-140-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-142-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-143-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-144-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-203-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-15-0x00000000004ABA6E-mapping.dmp

Download
memory/652-265-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-150-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-152-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-153-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-154-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-155-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-156-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-157-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-158-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-159-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-160-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-161-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-162-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-163-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-164-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-165-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-166-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-167-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-169-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-168-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-171-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-172-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-173-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-170-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-174-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-175-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-176-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-177-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-178-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-179-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-180-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-181-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-182-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-183-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-184-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-185-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-186-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-188-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-189-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-191-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-192-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-193-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-194-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-195-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-196-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-190-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-197-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-198-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-199-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-201-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-200-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-202-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-204-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-205-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-206-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-207-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-208-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-209-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-210-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-211-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-212-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-214-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-213-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-215-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-216-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-217-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-218-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-219-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-220-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-221-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-222-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-223-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-224-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-225-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-226-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-227-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-228-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-230-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-231-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-232-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-229-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-233-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-234-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-235-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-236-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-237-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-238-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-239-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-241-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-242-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-243-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-244-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-240-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-246-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-245-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-247-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-248-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-249-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-250-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-251-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-253-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-252-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-254-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-255-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-256-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-257-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-258-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-259-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-260-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-261-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-262-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-263-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-264-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-266-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-267-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-268-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-269-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-270-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-271-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-272-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/652-273-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4800-4-0x000000000A9A0000-0x000000000A9A1000-memory.dmp

Filesize
4KB

Download
memory/4800-3-0x0000000007830000-0x00000000078F6000-memory.dmp

Filesize
792KB

Download
memory/4800-1-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4800-0-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4800-5-0x000000000AF40000-0x000000000AF41000-memory.dmp

Filesize
4KB

Download
memory/4800-6-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/4800-7-0x0000000002DE0000-0x0000000002DE2000-memory.dmp

Filesize
8KB

Download
memory/4800-8-0x00000000054B0000-0x0000000005562000-memory.dmp

Filesize
712KB

Download
memory/4800-9-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download