General
Target

8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe

Filesize

2MB

Completed

21-05-2022 19:16

Task

behavioral1

Score
8/10
MD5

5e4f6f9342dd61cb750a2bf2462e82a9

SHA1

ea85b1c851ec413fb9f7a4df6b7990f67d20a623

SHA256

8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831

SHA512

cba140903fc2a37395feef57732232ffdc8cac5031f79bf0e8c723fba82ebf143ce635906506b0a1c263b72ba17b956849fcc08d1d00f412efbc9ffa0a0a5f1a

Malware Config
Signatures 7

Filter: none

Defense Evasion
Persistence
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1640-55-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-58-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-57-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-59-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-60-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-65-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-69-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-73-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-71-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-77-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-81-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-85-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-89-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-93-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-97-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-101-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-99-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-95-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-91-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-87-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-83-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-79-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-75-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-67-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-63-0x0000000010000000-0x000000001003E000-memory.dmpupx
    behavioral1/memory/1640-61-0x0000000010000000-0x000000001003E000-memory.dmpupx
  • Writes to the Master Boot Record (MBR)
    8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    TTPs

    Bootkit

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\PhysicalDrive08d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
  • Modifies Internet Explorer settings
    IEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000616d05f1bdd149be35120b9a52d21d72279d45b0b3b4d25b213c51e9c2dd46ce000000000e8000000002000020000000a19725e015fcebee66dc659fe4e85c7671df8680e5c367cdaa48f24245db05f5900000001856be3f2c810b8c71d70be33120eeb139bd0be7e58b99ced439811210ff5b0c90e93860b7e98a6227e782f2a80ef00cb9413398eb34ba36d45be9104b29c17a235048c5fd22204c86056efcb4f713599195c22cfd42913b474d06cd76b123ff54e5db98b3982f9a67fd622321e270241033b151f2acda7be37f7491d71ce118b9bab9018eaedc55c8bc24b8f39057314000000030ada107aaed106c3a2d3f095e3cb3bf90ac22b76e388d003562ac70e273216e6d4d69e0cdf80b77bd1c41d8574c13b6080d15ffad59f1ff03c5e7449b4ad5fdIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliFormsIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistryIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\ZoomIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMicIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistryIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d130d8576dd801IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000caa26773564c99d45d32f533100e31731d96434cc4239c010550e3ed8b524ab8000000000e8000000002000020000000e4a5ae48c0baf3046a3ec94cf3193fdf55a4c2548cf64d04df2671ff23870e2c20000000e07c8822eed7de46f3daded1cedb19544e97394784c0aa03c894053be5ff542a40000000bfe3eb903f943ba5f9954f1db8b50af56bed8a637590cc43b692dda976479fccd4af7049894fb69bb5e8ac1fa2561261843fc3786739cd288db423023ddf7541IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPUIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetupIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowserIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDE01861-D94A-11EC-B705-D6AF54037788} = "0"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMicIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestionIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359932641"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNamesIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\ToolbarIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"IEXPLORE.EXE
  • Suspicious use of FindShellTrayWindow
    8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    1048IEXPLORE.EXE
  • Suspicious use of SendNotifyMessage
    8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe

    Reported IOCs

    pidprocess
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
  • Suspicious use of SetWindowsHookEx
    8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXEIEXPLORE.EXE

    Reported IOCs

    pidprocess
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    16408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    1048IEXPLORE.EXE
    1048IEXPLORE.EXE
    1980IEXPLORE.EXE
    1980IEXPLORE.EXE
    1980IEXPLORE.EXE
    1980IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1640 wrote to memory of 104816408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE
    PID 1640 wrote to memory of 104816408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE
    PID 1640 wrote to memory of 104816408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE
    PID 1640 wrote to memory of 104816408d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exeIEXPLORE.EXE
    PID 1048 wrote to memory of 19801048IEXPLORE.EXEIEXPLORE.EXE
    PID 1048 wrote to memory of 19801048IEXPLORE.EXEIEXPLORE.EXE
    PID 1048 wrote to memory of 19801048IEXPLORE.EXEIEXPLORE.EXE
    PID 1048 wrote to memory of 19801048IEXPLORE.EXEIEXPLORE.EXE
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe
    "C:\Users\Admin\AppData\Local\Temp\8d3e1524f58f0432d0031b49218350faf5f936e1eb7b0394c58e316337e2c831.exe"
    Writes to the Master Boot Record (MBR)
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.tiantusoft.com/
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:275457 /prefetch:2
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        PID:1980
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C

                        MD5

                        9a989f35df80151f4a182d91cfddba1f

                        SHA1

                        1b3615d6d5ef72900488adcbf7a9bad409177683

                        SHA256

                        a592c3bf95e1814bb68d581617ba505ea515e873f5841167990bd733de4bcf1f

                        SHA512

                        c5ffe4ec8d2097338758160d1ae7402258ebec46c382291011fec1fcbaf6a01b5bec2c398c08373f4a3dbfe63d35efccac16c5ad7d5adff006f3377291914532

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_4526C34C7242D5286A61D28DFF0D2161

                        MD5

                        45866f7f8a503ad0dc2fbe5d6638cbf8

                        SHA1

                        0d76fada82bd84785be3d22baa15f5a3f15e195b

                        SHA256

                        c0260d382d68fd5666a9d0046c7d425f35cc6c0ac667b0e1b9a96cdac224daa0

                        SHA512

                        7d768fd325b40d6fdc3d60058dfea0192c79edae511d1adb7ad11efcd4ac730ea4af69b90b480cd0bb53ca7af1633433c5358c4feb87c013a5e6d89cc5d40340

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_BDB52D4A140D226319D8CF4CEA8486D7

                        MD5

                        33c270707c7ee3e4aa46a7770e4bf7d5

                        SHA1

                        2264fa2004ecf16b04f69e76ceb1613a0ea281e8

                        SHA256

                        115de087a412bb9819a94d2ddbe6fbe1e3a4af964539d8b42b7dc1ba47b77de2

                        SHA512

                        583f31b1ccb598bebcd53bd54ebb3eb87070b688ebf8b35a9721f2fdde4e24341021d21fb85a765e980365c6a1478f6b52bc724b9e9857d81f49a41c0d63f3c1

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C

                        MD5

                        19bf5085b0a2fa113d13b9a70e9b6d52

                        SHA1

                        cfad7146558b13f844479851bc630331b99a3cb9

                        SHA256

                        9c8917e4bc7653b8350c23c190f81da655ab19f08035961926c2cf2e0e28c905

                        SHA512

                        c627251b1089ba9c396e749293705caa1e98940063b0e89326a23446f3be1d34884b1498ac1266803de3db611e68bc96f1148759b6779d2c7dc1d9596db4b2f0

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        MD5

                        9a74e41aea9bf404932fce86603ae2d5

                        SHA1

                        4e5268e980806a1793ba5c8a07334e54c86c5d5c

                        SHA256

                        a4ba197de8d24467301c313a43413525d2496cae1a891acec1e2a986d02e14ac

                        SHA512

                        c2560aeb9214de1497126d27ffab61093ae5cd799fa0ee8da5a7cd594f1d332c0ad6bbb20984a478b81481acb6240a76bea5e59020798b787c438613c0c3c904

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_4526C34C7242D5286A61D28DFF0D2161

                        MD5

                        a6fe23146e4b91875de915cc18675319

                        SHA1

                        ee5ef0e0d18e3fb56865b0531bfde5d6f353f414

                        SHA256

                        2355168893967cf9de69d87a61bd2188610c4a81b4a3cb5948969ec873287684

                        SHA512

                        51d432557e5aeca84b64b327baa47e338d3d2707bd9cf46d03962afd6c7c8fd50eba391e6fafbff41c1138f8af48f94dc6caeaed76ee8097349563183e7a4c71

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_BDB52D4A140D226319D8CF4CEA8486D7

                        MD5

                        8068eefda324cec0ea64346f535b906b

                        SHA1

                        c6bdb02f43c051fbdd3eec10295e5509715c368f

                        SHA256

                        d3c3d3a55cd11eb21d8d10b306b710b13eb705a9fe650d789a14946d0e5b69af

                        SHA512

                        4de966a2a02f14e128b76b05a74fb1bab034029f175361c4293d31a58e2e4124404334f85de73362070997f8599329b0616b2f79e5cbd2ec8ac970609edb54b3

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1b4wh1e\imagestore.dat

                        MD5

                        42bfe1a96b846f81702116e5272ea2f7

                        SHA1

                        43188dde1f0aaffedc30c7c25923270290056e6e

                        SHA256

                        b4077a6f378067300f98a7e0b38948ff86855099e1cf6e51a7b7c3674e04d2ea

                        SHA512

                        324fcc73bc1d75d38308c9d0c5aab4bb55f3a85eb98f5f45fef6fe4fb5b9ada0dd7b6b343093d13545d6ce1258df609dd80ca2d3afe348428f098777514ca6ff

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8VTEASET.txt

                        MD5

                        4832453234afd6b91d3e0fd59a94a2f3

                        SHA1

                        574d1fb2084906a8644d3fc9ea09ebb0b4a08d98

                        SHA256

                        0a49e4189b5cf7a467d5473f56334d396cd159cf29c8327800cafa3033e52743

                        SHA512

                        85a222862191ec1179dda2ab536da7e006330ba15b0ef150d9575ab54384cfcad3aa9ecfc25745080d5f663730dc065d97fc4b7bd1b7283c5f7e3f4ae50e5cad

                      • memory/1640-95-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-77-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-81-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-85-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-89-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-93-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-97-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-101-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-99-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-71-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-91-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-87-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-83-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-79-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-75-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-67-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-63-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-61-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-73-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-69-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-65-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-60-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-59-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-57-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-58-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-55-0x0000000010000000-0x000000001003E000-memory.dmp

                      • memory/1640-54-0x0000000076241000-0x0000000076243000-memory.dmp