82732e47492148243ee3fb338c93d43b9a9984f39e3409327600cffc5766af1b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220331-en
submitted
11-04-2022 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mvs.exe
Size

476KB
MD5

faf25564825a05a4c01870cdc0535525
SHA1

54d7f92637e31e4c1aed0a58b690d7d99886c380
SHA256

82732e47492148243ee3fb338c93d43b9a9984f39e3409327600cffc5766af1b
SHA512

b44be2421a074ea986336b0c179a6d416c845ae44b4ca67d31594506bd79a3fdfa2907d7bcf7b3c46f1d942e0b057fbd8bce3a02bceb5bf91e1e70c30a57f0db

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

a.exe

pid process

904 a.exe
Loads dropped DLL 3 IoCs

Processes:

mvs.exe

pid process

1368 mvs.exe
1368 mvs.exe
1368 mvs.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
904	a.exe

pid	process
1368	mvs.exe
1368	mvs.exe
1368	mvs.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

reg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe

Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

2008 systeminfo.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1548 reg.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1932 NOTEPAD.EXE

pid	process
2008	systeminfo.exe

pid	process
1548	reg.exe

pid	process
1932	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mvs.exea.execmd.exe

description	pid	process	target process
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 1368 wrote to memory of 904	1368	mvs.exe	a.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 904 wrote to memory of 2004	904	a.exe	cmd.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 2008	2004	cmd.exe	systeminfo.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 624	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1520	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1532	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1248	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1980	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1928	2004	cmd.exe	find.exe
PID 2004 wrote to memory of 1500	2004	cmd.exe	find.exe

C:\Users\Admin\AppData\Local\Temp\mvs.exe
"C:\Users\Admin\AppData\Local\Temp\mvs.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368
- C:\windows\temp\a.exe
  "C:\windows\temp\a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\DF48.tmp\a.bat" "C:\windows\temp\a.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo /fo list
      4⤵
      Gathers system information
      PID:2008
  - - C:\Windows\SysWOW64\find.exe
      Find /i "OS Name: "
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\find.exe
      Find /i "OS Version: "
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\find.exe
      Find /i "System Model:"
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\find.exe
      Find /i "System Manufacturer: "
      4⤵
      PID:1248
  - - C:\Windows\SysWOW64\find.exe
      Find /i "BIOS Version:"
      4⤵
      PID:1980
  - - C:\Windows\SysWOW64\find.exe
      Find /i "Total Physical Memory: "
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\find.exe
      Find /i "Time Zone:"
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\find.exe
      Find /i "DHCP Server:"
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\find.exe
      Find /i "Connection Name:"
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\find.exe
      Find /i "Original Install Date: "
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKLM\Hardware\Description\System\CentralProcessor\0 /v Identifier
      4⤵
      Checks processor information in registry
      Modifies registry key
      PID:1548
  - - C:\Windows\SysWOW64\find.exe
      Find /i "x86"
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\getmac.exe
      getmac /nh
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      Reg query "HKEY_CLASSES_ROOT\http\shell\open\command" /ve
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\findstr.exe
      Findstr /i "Program Files" c:\windows\temp\c.txt
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\reg.exe
      Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion
      4⤵
      PID:1884
    - - C:\Windows\SysWOW64\reg.exe
        
        Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion
        5⤵
        
        PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\reg.exe
        
        Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
        5⤵
        
        PID:952
  - - C:\Windows\SysWOW64\reg.exe
      Reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin" /v DisplayVersion
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\findstr.exe
      Findstr /i "REG_SZ" c:\windows\temp\123.txt
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\SOFTWARE\Adobe\Acrobat Reader"
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Plug-in"
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\findstr.exe
      Findstr /i "1" c:\windows\temp\123.txt
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "5\.1\."
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query mpssvc | findstr /i "STATE"
      4⤵
      PID:388
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query mpssvc
        5⤵
        
        PID:656
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "STATE"
        5⤵
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query mpssvc | findstr /i "installed"
      4⤵
      PID:604
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query mpssvc
        5⤵
        
        PID:1616
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "installed"
        5⤵
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query wuauserv | findstr /i "STATE"
      4⤵
      PID:668
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query wuauserv
        5⤵
        
        PID:700
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "STATE"
        5⤵
        
        PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query wuauserv | findstr /i "installed"
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query wuauserv
        5⤵
        
        PID:336
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "installed"
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query wscsvc | findstr /i "STATE"
      4⤵
      PID:556
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query wscsvc
        5⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "STATE"
        5⤵
        
        PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query wscsvc | findstr /i "installed"
      4⤵
      PID:984
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query wscsvc
        5⤵
        
        PID:1736
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "installed"
        5⤵
        
        PID:1740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query msiserver | findstr /i "STATE"
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query msiserver
        5⤵
        
        PID:2044
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "STATE"
        5⤵
        
        PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc query msiserver | findstr /i "installed"
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query msiserver
        5⤵
        
        PID:1776
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "installed"
        5⤵
        
        PID:1188
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\windows\temp\Report.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DF48.tmp\a.bat

Filesize
7KB

MD5
121b06bb9a454fcd9c1c618c25f193dc

SHA1
59b3de866e3848e48e877d7c115e64cb725c4c7e

SHA256
81800740d6cc41785cd030ca001d2182b0ef21bb3b4ec5054fe152e8e783ca47

SHA512
0d30cb02f589cfe315091c24421467d35e2490cd10009b88d3664e0e65c02723634fd62444412a45e67affa1352a3352d09bd871d19a2100d8fc5e72fd6bd9ab

Download Submit
C:\Windows\Temp\a.exe

Filesize
216KB

MD5
6b2c8c3958f0e87c1b111390127eaff8

SHA1
4e7089791266f8daf2cf47a47db7cd2ad117bd8e

SHA256
adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0

SHA512
b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12

Download Submit
C:\windows\temp\Report.txt

Filesize
1KB

MD5
ae7d2c1162b6f34fb81168bd164d7f0c

SHA1
d31176bfa707ae7b6d0a67cbb37ac3c84a3bcb78

SHA256
21a0903d5dd715576788fa75d091f6f6caa13037a5505bcd2dd8f917457a2f6a

SHA512
eeb8dc2d4e14e83600ae1a9f908ce109cf7a14823af5450f2d8d7340b723f2ea4dabfe24ccfb90a8829c05be3bdccb74ed3376780b2e6b3576821b114e3d7231

Download Submit
\??\c:\windows\temp\a.exe

Filesize
216KB

MD5
6b2c8c3958f0e87c1b111390127eaff8

SHA1
4e7089791266f8daf2cf47a47db7cd2ad117bd8e

SHA256
adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0

SHA512
b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12

Download Submit
\??\c:\windows\temp\b.exe

Filesize
211KB

MD5
ee8eeff90bf2db3a002a27990a82cb19

SHA1
647c8de3585d87b8c297fe2bd0f54e8e4460aa55

SHA256
2dc4292328bbd11f3142311145ec6a78247d244a53d67be5c8d4b66584a5fdc5

SHA512
39325f0465d081b270debe39531337b99d01a1806c842f82e4ed922122865ba1f02ccca37fde8613dc9de4a46ba5cb5255126d56b44495dfdd36b723cf65d761

Download Submit
\??\c:\windows\temp\c.txt

Filesize
128B

MD5
628d983719759839517e5efe60f5f0d3

SHA1
4ffb5d09376b369071da2c2ec75f6e3f44d11502

SHA256
13fc04ef802cc8ba2926ccee55b7e4d8b13db1d22545ab123ca29fd61e7a71de

SHA512
37bbbd28b99eaec98de63b12cdbcc55fac73258f69dabe68cff8d33c47f41eee7175c14f09d9baae5fe17dd6e7360a3f132aba5ad46e79de55fd7324bddcc07c

Download Submit
\??\c:\windows\temp\sc.exe

Filesize
30KB

MD5
a48b1c06219a01a60cd8d4d45440bde9

SHA1
34af23607ad5afa9e61b6a96cec811e6bdc50b4a

SHA256
5c3736e37168dae7e431a31d5c4e0d351271d37804787ee3b8fa6e46413ba880

SHA512
8f6b29be451582e47743009d95637f540dea4d7c93e685687e8b8f130a1cf535a4030722367fd4ac49639c19ce35c779c0cfef315eea038d9a4434474c7690f4

Download Submit
\??\c:\windows\temp\systeminfo.exe

Filesize
70KB

MD5
a279f4091f940c15a288767f4285c0ff

SHA1
4572dc2ae3cdc4d7ea75249037bdb2d394d7ec83

SHA256
7852ee782a6310be5d1b94df136299060ddff820dbe8bb2a2b79fe92eec0b7c0

SHA512
2f3a448a8491add4c43e3d059f89db94fdb988f9930b8b79cc231b865d3d5007c62a54c08416814b73bad98ace63df6788c8887d1c2458250b37c628797f70a9

Download Submit
\Windows\Temp\a.exe

Filesize
216KB

MD5
6b2c8c3958f0e87c1b111390127eaff8

SHA1
4e7089791266f8daf2cf47a47db7cd2ad117bd8e

SHA256
adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0

SHA512
b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12

Download Submit
\Windows\Temp\a.exe

Filesize
216KB

MD5
6b2c8c3958f0e87c1b111390127eaff8

SHA1
4e7089791266f8daf2cf47a47db7cd2ad117bd8e

SHA256
adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0

SHA512
b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12

Download Submit
\Windows\Temp\a.exe

Filesize
216KB

MD5
6b2c8c3958f0e87c1b111390127eaff8

SHA1
4e7089791266f8daf2cf47a47db7cd2ad117bd8e

SHA256
adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0

SHA512
b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12

Download Submit
memory/316-149-0x0000000000000000-mapping.dmp

Download
memory/336-141-0x0000000000000000-mapping.dmp

Download
memory/388-121-0x0000000000000000-mapping.dmp

Download
memory/392-118-0x0000000000000000-mapping.dmp

Download
memory/544-139-0x0000000000000000-mapping.dmp

Download
memory/556-145-0x0000000000000000-mapping.dmp

Download
memory/604-127-0x0000000000000000-mapping.dmp

Download
memory/624-66-0x0000000000000000-mapping.dmp

Download
memory/656-123-0x0000000000000000-mapping.dmp

Download
memory/668-133-0x0000000000000000-mapping.dmp

Download
memory/700-135-0x0000000000000000-mapping.dmp

Download
memory/796-94-0x0000000000000000-mapping.dmp

Download
memory/824-82-0x0000000000000000-mapping.dmp

Download
memory/892-157-0x0000000000000000-mapping.dmp

Download
memory/904-58-0x0000000000000000-mapping.dmp

Download
memory/924-97-0x0000000000000000-mapping.dmp

Download
memory/932-80-0x0000000000000000-mapping.dmp

Download
memory/952-105-0x0000000000000000-mapping.dmp

Download
memory/984-151-0x0000000000000000-mapping.dmp

Download
memory/1188-166-0x0000000000000000-mapping.dmp

Download
memory/1248-125-0x0000000000000000-mapping.dmp

Download
memory/1248-72-0x0000000000000000-mapping.dmp

Download
memory/1256-115-0x0000000000000000-mapping.dmp

Download
memory/1368-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1484-90-0x0000000000000000-mapping.dmp

Download
memory/1500-78-0x0000000000000000-mapping.dmp

Download
memory/1520-68-0x0000000000000000-mapping.dmp

Download
memory/1532-70-0x0000000000000000-mapping.dmp

Download
memory/1548-86-0x0000000000000000-mapping.dmp

Download
memory/1572-109-0x0000000000000000-mapping.dmp

Download
memory/1600-161-0x0000000000000000-mapping.dmp

Download
memory/1616-129-0x0000000000000000-mapping.dmp

Download
memory/1660-111-0x0000000000000000-mapping.dmp

Download
memory/1660-163-0x0000000000000000-mapping.dmp

Download
memory/1668-103-0x0000000000000000-mapping.dmp

Download
memory/1688-147-0x0000000000000000-mapping.dmp

Download
memory/1692-137-0x0000000000000000-mapping.dmp

Download
memory/1736-101-0x0000000000000000-mapping.dmp

Download
memory/1736-153-0x0000000000000000-mapping.dmp

Download
memory/1740-154-0x0000000000000000-mapping.dmp

Download
memory/1764-88-0x0000000000000000-mapping.dmp

Download
memory/1776-113-0x0000000000000000-mapping.dmp

Download
memory/1776-165-0x0000000000000000-mapping.dmp

Download
memory/1792-143-0x0000000000000000-mapping.dmp

Download
memory/1828-92-0x0000000000000000-mapping.dmp

Download
memory/1872-84-0x0000000000000000-mapping.dmp

Download
memory/1884-99-0x0000000000000000-mapping.dmp

Download
memory/1928-76-0x0000000000000000-mapping.dmp

Download
memory/1932-178-0x0000000000000000-mapping.dmp

Download
memory/1964-131-0x0000000000000000-mapping.dmp

Download
memory/1980-74-0x0000000000000000-mapping.dmp

Download
memory/2004-61-0x0000000000000000-mapping.dmp

Download
memory/2008-117-0x0000000000000000-mapping.dmp

Download
memory/2008-64-0x0000000000000000-mapping.dmp

Download
memory/2032-107-0x0000000000000000-mapping.dmp

Download
memory/2044-159-0x0000000000000000-mapping.dmp

Download