Overview

overview

8

Static

static

1

filmora_se...98.exe

windows10-1703-x64

8

filmora_se...98.exe

windows7-x64

8

filmora_se...98.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    210s
  • max time network
    178s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13-02-2023 23:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    filmora_setup_full7598.exe

  • Size

    1.2MB

  • MD5

    0f31bd7bd185bcdb23fd724cfa14e240

  • SHA1

    40a0212e1d8fff17b59bd4866bc4394ce844eb10

  • SHA256

    c442f8cbf49f1fa10b31c765812ed6a65169baecefb751b4ed46175db852de15

  • SHA512

    bf0422a9dfa9d0a3a266976dfe6263fd90024666aff3a54cb10a2df292387ed8b78a82b62b3e955fac40e24a8b8647b94a39c596a2bd7d1d979688749d89b1f4

  • SSDEEP

    24576:KPx2Qnyr4NvGXVT/H2HCmUykZgV88UA3fx6aNjLSHTV2WwqNqGZHLCmN:3Qnyr4NeX5/2HCmUykuie3f9NncLNTZB

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 39 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\filmora_setup_full7598.exe
    "C:\Users\Admin\AppData\Local\Temp\filmora_setup_full7598.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Public\Documents\Wondershare\NFWCHK.exe
      C:\Users\Public\Documents\Wondershare\NFWCHK.exe
      2⤵
      • Executes dropped EXE
      PID:3720
    • C:\Users\Public\Documents\Wondershare\filmora_64bit_full7598.exe
      "C:\Users\Public\Documents\Wondershare\filmora_64bit_full7598.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-Wondershare Filmora (Spanish ES)(CPC).log" /installpath: "C:\Program Files\Wondershare\Wondershare Filmora (Spanish ES)(CPC)\" /DIR="C:\Program Files\Wondershare\Wondershare Filmora (Spanish ES)(CPC)\" /WAEWIN=601C4
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4684
      • C:\Users\Admin\AppData\Local\Temp\is-56KRF.tmp\filmora_64bit_full7598.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-56KRF.tmp\filmora_64bit_full7598.tmp" /SL5="$90058,502310801,421888,C:\Users\Public\Documents\Wondershare\filmora_64bit_full7598.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-Wondershare Filmora (Spanish ES)(CPC).log" /installpath: "C:\Program Files\Wondershare\Wondershare Filmora (Spanish ES)(CPC)\" /DIR="C:\Program Files\Wondershare\Wondershare Filmora (Spanish ES)(CPC)\" /WAEWIN=601C4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Filmora9.exe
          4⤵
          • Kills process with taskkill
          PID:3284
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Filmora X.exe
          4⤵
          • Kills process with taskkill
          PID:2300
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Filmora 11.exe
          4⤵
          • Kills process with taskkill
          PID:3084
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Filmora.exe
          4⤵
          • Kills process with taskkill
          PID:4020
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM EffectsInstaller.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2640
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FCreatorAcademy.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4664
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM CheckGraphicsType.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FilmoraExportEngine.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1076
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM ImageHost.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:304
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FRecorder.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3096
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Screen Recorder.exe
          4⤵
          • Kills process with taskkill
          PID:2664
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Filmora Core UX Service.exe
          4⤵
          • Kills process with taskkill
          PID:4256
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Wondershare Filmora Update(x64).exe
          4⤵
          • Kills process with taskkill
          PID:3748
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FilmStockService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3772
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM CreatorAcademy.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4840
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM ScreenRecorder.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1076
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM AlgorithmRunTest.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:304
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM AudioPlayer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3096
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM bspatch.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4552
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM CefViewWing.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3800
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM cmdCheckATI.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:528
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM cmdCheckHEVC.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM coremediaserver.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2816
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM CrashReporter.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1796
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM DataReporting.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2596
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM DownloadCenter.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4132
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM Filmora.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4908
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FilmoraNPS.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4976
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM FilmoraPlayer.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3288
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM gpu_check.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2504
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM magic_xe_supported_detect.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5072
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM MessageService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2892
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM ocl_check.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3844
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM ofx_check.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:416
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM perf_check.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:204
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM RenewService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3944
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM senseTimeGlDetect.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1464
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM SupportService.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3720
        • C:\Windows\SysWOW64\TASKKILL.exe
          "C:\Windows\system32\TASKKILL.exe" /F /IM WebBrowser.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" [Environment]::GetFolderPath('MyDocuments') | Out-File "C:\Users\Public\Documents\B30281EA-BA02-4586-86F8-C9BE813884C1.txt" -Encoding UTF8
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3128
        • C:\Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\_isetup\_setup64.tmp
          helper 105 0x4BC
          4⤵
          • Executes dropped EXE
          PID:1960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-56KRF.tmp\filmora_64bit_full7598.tmp
    Filesize

    1.4MB

    MD5

    cd9ef191ff21166a34f366e57ba6ab63

    SHA1

    37b0954449e592e1cbe895ebef543aa44a2d4916

    SHA256

    18f921ca0d6913ff30a84053730885e581097468f00e7a91e686d4ae87d72b4f

    SHA512

    3a01cd26033967e219b8c34b202d0f8260ae5d93062ab1a5d1c824d5cfc368d4ceb346c4698060a993e611000cde5a174354bf93c4d8574fbd64771dd2e11301

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-56KRF.tmp\filmora_64bit_full7598.tmp
    Filesize

    1.4MB

    MD5

    cd9ef191ff21166a34f366e57ba6ab63

    SHA1

    37b0954449e592e1cbe895ebef543aa44a2d4916

    SHA256

    18f921ca0d6913ff30a84053730885e581097468f00e7a91e686d4ae87d72b4f

    SHA512

    3a01cd26033967e219b8c34b202d0f8260ae5d93062ab1a5d1c824d5cfc368d4ceb346c4698060a993e611000cde5a174354bf93c4d8574fbd64771dd2e11301

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\_isetup\_setup64.tmp
    Filesize

    6KB

    MD5

    4ff75f505fddcc6a9ae62216446205d9

    SHA1

    efe32d504ce72f32e92dcf01aa2752b04d81a342

    SHA256

    a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81

    SHA512

    ba0469851438212d19906d6da8c4ae95ff1c0711a095d9f21f13530a6b8b21c3acbb0ff55edb8a35b41c1a9a342f5d3421c00ba395bc13bb1ef5902b979ce824

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\_isetup\_setup64.tmp
    Filesize

    6KB

    MD5

    4ff75f505fddcc6a9ae62216446205d9

    SHA1

    efe32d504ce72f32e92dcf01aa2752b04d81a342

    SHA256

    a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81

    SHA512

    ba0469851438212d19906d6da8c4ae95ff1c0711a095d9f21f13530a6b8b21c3acbb0ff55edb8a35b41c1a9a342f5d3421c00ba395bc13bb1ef5902b979ce824

    Download Submit

  • C:\Users\Public\Documents\B30281EA-BA02-4586-86F8-C9BE813884C1.txt
    Filesize

    29B

    MD5

    feab0c4fdc4baf0deb7fd33695adcbed

    SHA1

    22f35b32c7749e14861168bfe5530e5078bbe6be

    SHA256

    7359b0465d62ec27a67d51fe527f9bf1adf5615a216a75b4f972b4253ba82f37

    SHA512

    75b4064a9c17f12757ac01efa9d9933cf046ca257bd3d37a76862276ea8544d2113a68310ef9a1dcf0d113de1c1ab82de8022ea4ef7dd6ffd634b92a7be33568

    Download Submit

  • C:\Users\Public\Documents\Wondershare\NFWCHK.exe
    Filesize

    7KB

    MD5

    27cfb3990872caa5930fa69d57aefe7b

    SHA1

    5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

    SHA256

    43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

    SHA512

    a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

    Download Submit

  • C:\Users\Public\Documents\Wondershare\NFWCHK.exe
    Filesize

    7KB

    MD5

    27cfb3990872caa5930fa69d57aefe7b

    SHA1

    5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

    SHA256

    43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

    SHA512

    a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

    Download Submit

  • C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config
    Filesize

    229B

    MD5

    ad0967a0ab95aa7d71b3dc92b71b8f7a

    SHA1

    ed63f517e32094c07a2c5b664ed1cab412233ab5

    SHA256

    9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

    SHA512

    85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

    Download Submit

  • C:\Users\Public\Documents\Wondershare\filmora_64bit_full7598.exe
    Filesize

    480.9MB

    MD5

    764a476f3bc5779492b119de916c007e

    SHA1

    933710832a45baa162010bb8205dfc0acce7dd75

    SHA256

    3673fda74762fa5b81c79de9a69e2cf5d467ae708787d0e652524be8f4957210

    SHA512

    7643a9e5c35167ac2eae7ace9be64c53ea5e5844156b506d5877b4d8ea8198a8dac7bc48a02b15a393f92bc3dfa5d3dabe2a1e46e520f6a4deb0044abad730ec

    Download Submit

  • C:\Users\Public\Documents\Wondershare\filmora_64bit_full7598.exe
    Filesize

    480.9MB

    MD5

    764a476f3bc5779492b119de916c007e

    SHA1

    933710832a45baa162010bb8205dfc0acce7dd75

    SHA256

    3673fda74762fa5b81c79de9a69e2cf5d467ae708787d0e652524be8f4957210

    SHA512

    7643a9e5c35167ac2eae7ace9be64c53ea5e5844156b506d5877b4d8ea8198a8dac7bc48a02b15a393f92bc3dfa5d3dabe2a1e46e520f6a4deb0044abad730ec

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\WSUtilities_Setup.dll
    Filesize

    202KB

    MD5

    665603698f4a865a873082309712aae2

    SHA1

    b3f2c3d1d679181d9c080419b1dfe0563c518c67

    SHA256

    b42085777505d324d56122f2bd6195ec3a6ce47030a31f9ce6b853c5fa8cd5a8

    SHA512

    0444b1b63980f9b762e6e01b7cdc4efc2fd6f713887c07d8cf8b20ab2582f611e1c8434f8b59b8ee4fb6dba497c2c1f80fc6e758dc02c07d2964dd6e1f0b6ace

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\WS_Log_Setup.dll
    Filesize

    104KB

    MD5

    943e0025c5b5c4e0cddb7a9cc7b7d123

    SHA1

    5dd92f9fa572eac7ebc467d8835c64af77dd37a2

    SHA256

    43391e665a63b5e9e1288a3c608691f73ece57478e0655363918e8195d85cf81

    SHA512

    cb42c329e0d5f01a224e4e5b89b4ccc54fefc658d37caea40198f4483e5387f08cbdd0e85af7b0618e6ec72c5e5874098c5946bf749c218978003ad99c5fa852

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-CBMV2.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • memory/204-1862-0x0000000000000000-mapping.dmp

    Download

  • memory/304-1052-0x0000000000000000-mapping.dmp

    Download

  • memory/304-704-0x0000000000000000-mapping.dmp

    Download

  • memory/416-1817-0x0000000000000000-mapping.dmp

    Download

  • memory/528-1232-0x0000000000000000-mapping.dmp

    Download

  • memory/1076-1007-0x0000000000000000-mapping.dmp

    Download

  • memory/1076-659-0x0000000000000000-mapping.dmp

    Download

  • memory/1464-1952-0x0000000000000000-mapping.dmp

    Download

  • memory/1796-1367-0x0000000000000000-mapping.dmp

    Download

  • memory/1960-2112-0x0000000000000000-mapping.dmp

    Download

  • memory/2108-1277-0x0000000000000000-mapping.dmp

    Download

  • memory/2300-401-0x0000000000000000-mapping.dmp

    Download

  • memory/2456-172-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-133-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-138-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-139-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-140-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-141-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-143-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-142-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-144-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-145-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-146-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-147-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-148-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-149-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-150-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-151-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-152-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-153-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-154-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-155-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-156-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-157-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-158-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-159-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-160-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-161-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-162-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-163-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-164-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-165-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-166-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-167-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-168-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-169-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-170-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-171-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-136-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-173-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-174-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-175-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-176-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-177-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-178-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-115-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-116-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-117-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-118-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-135-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-134-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-119-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-137-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-132-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-131-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-129-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-120-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-130-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-121-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-122-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-123-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-124-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-126-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-128-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-127-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2456-125-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2504-1637-0x0000000000000000-mapping.dmp

    Download

  • memory/2596-1412-0x0000000000000000-mapping.dmp

    Download

  • memory/2640-524-0x0000000000000000-mapping.dmp

    Download

  • memory/2664-794-0x0000000000000000-mapping.dmp

    Download

  • memory/2816-1322-0x0000000000000000-mapping.dmp

    Download

  • memory/2892-1727-0x0000000000000000-mapping.dmp

    Download

  • memory/3084-442-0x0000000000000000-mapping.dmp

    Download

  • memory/3096-1097-0x0000000000000000-mapping.dmp

    Download

  • memory/3096-749-0x0000000000000000-mapping.dmp

    Download

  • memory/3128-2087-0x0000000000000000-mapping.dmp

    Download

  • memory/3128-2093-0x00000252785E0000-0x0000025278602000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3128-2096-0x0000025278790000-0x0000025278806000-memory.dmp

    Filesize

    472KB

    Download

  • memory/3284-360-0x0000000000000000-mapping.dmp

    Download

  • memory/3288-1592-0x0000000000000000-mapping.dmp

    Download

  • memory/3468-2042-0x0000000000000000-mapping.dmp

    Download

  • memory/3720-1997-0x0000000000000000-mapping.dmp

    Download

  • memory/3720-211-0x0000000000000000-mapping.dmp

    Download

  • memory/3748-876-0x0000000000000000-mapping.dmp

    Download

  • memory/3772-917-0x0000000000000000-mapping.dmp

    Download

  • memory/3800-1187-0x0000000000000000-mapping.dmp

    Download

  • memory/3844-1772-0x0000000000000000-mapping.dmp

    Download

  • memory/3944-1907-0x0000000000000000-mapping.dmp

    Download

  • memory/4020-483-0x0000000000000000-mapping.dmp

    Download

  • memory/4132-1457-0x0000000000000000-mapping.dmp

    Download

  • memory/4256-835-0x0000000000000000-mapping.dmp

    Download

  • memory/4552-1142-0x0000000000000000-mapping.dmp

    Download

  • memory/4664-569-0x0000000000000000-mapping.dmp

    Download

  • memory/4684-339-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download

  • memory/4684-284-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

    Download

  • memory/4684-245-0x0000000000000000-mapping.dmp

    Download

  • memory/4800-614-0x0000000000000000-mapping.dmp

    Download

  • memory/4840-962-0x0000000000000000-mapping.dmp

    Download

  • memory/4876-288-0x0000000000000000-mapping.dmp

    Download

  • memory/4908-1502-0x0000000000000000-mapping.dmp

    Download

  • memory/4976-1547-0x0000000000000000-mapping.dmp

    Download

  • memory/5072-1682-0x0000000000000000-mapping.dmp

    Download