Overview

overview

7

Static

static

1

MEMZ 3.0/MEMZ.bat

windows10-1703-x64

7

MEMZ 3.0/MEMZ.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    297s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-03-2023 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MEMZ 3.0/MEMZ.exe

  • Size

    12KB

  • MD5

    a7bcf7ea8e9f3f36ebfb85b823e39d91

  • SHA1

    761168201520c199dba68add3a607922d8d4a86e

  • SHA256

    3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

  • SHA512

    89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

  • SSDEEP

    192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 59 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4236
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3964
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4616
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4556
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3960
    • C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
      "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main
      2⤵
      • Checks computer location settings
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\notepad.exe
        "C:\Windows\System32\notepad.exe" \note.txt
        3⤵
          PID:3084
        • C:\Windows\SysWOW64\regedit.exe
          "C:\Windows\System32\regedit.exe"
          3⤵
          • Runs regedit.exe
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3504
        • C:\Windows\SysWOW64\calc.exe
          "C:\Windows\System32\calc.exe"
          3⤵
            PID:3880
          • C:\Windows\SysWOW64\mspaint.exe
            "C:\Windows\System32\mspaint.exe"
            3⤵
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:1520
          • C:\Windows\SysWOW64\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
            3⤵
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3012
            • C:\Windows\system32\mmc.exe
              "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
              4⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3544
          • C:\Windows\SysWOW64\notepad.exe
            "C:\Windows\System32\notepad.exe"
            3⤵
              PID:1016
            • C:\Windows\SysWOW64\regedit.exe
              "C:\Windows\System32\regedit.exe"
              3⤵
              • Runs regedit.exe
              • Suspicious behavior: GetForegroundWindowSpam
              PID:3628
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2900
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
          1⤵
            PID:4504
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
            1⤵
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3372
          • C:\Windows\system32\browser_broker.exe
            C:\Windows\system32\browser_broker.exe -Embedding
            1⤵
            • Modifies Internet Explorer settings
            PID:4956
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2076
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:1100
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2592
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x348
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1480
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies registry class
            PID:3892
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            PID:3260
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies registry class
            PID:2456
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies registry class
            PID:5012
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies registry class
            PID:4208
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Drops file in Windows directory
            • Modifies registry class
            PID:1136
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
              PID:4084

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Bootkit

            1
            T1067

            Privilege Escalation

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            Peripheral Device Discovery

            1
            T1120

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\edgecompatviewlist[1].xml
              Filesize

              74KB

              MD5

              d4fc49dc14f63895d997fa4940f24378

              SHA1

              3efb1437a7c5e46034147cbbc8db017c69d02c31

              SHA256

              853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

              SHA512

              cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0K1VPCNX\favicon[1].ico
              Filesize

              5KB

              MD5

              f3418a443e7d841097c714d69ec4bcb8

              SHA1

              49263695f6b0cdd72f45cf1b775e660fdc36c606

              SHA256

              6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

              SHA512

              82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8B1NBJ5L\suggestions[1].en-US
              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
              Filesize

              207KB

              MD5

              e2b88765ee31470114e866d939a8f2c6

              SHA1

              e0a53b8511186ff308a0507b6304fb16cabd4e1f

              SHA256

              523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

              SHA512

              462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
              Filesize

              1KB

              MD5

              a371c997de65fa1d0c1c6e2d862593f7

              SHA1

              2cf4f67996db546829222259c361d0f3f91d8718

              SHA256

              f3e826add98dc2b453bad19a6492b09b9faef9de7651197314ad673583db5458

              SHA512

              b986495e52fa6d9472fcdf7fea433e24a4acc0ff29734455d722e233737de199c2ee32788facb98de681ca4fba985783d736acfb028e0d5b53399687022a6811

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
              Filesize

              724B

              MD5

              f569e1d183b84e8078dc456192127536

              SHA1

              30c537463eed902925300dd07a87d820a713753f

              SHA256

              287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

              SHA512

              49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_3B19E079B02C6E9472149DB847F37EF9
              Filesize

              472B

              MD5

              01dec6104ef463d96442a8770eed9efd

              SHA1

              aa2b574c90a9cf761437a445601672b4d5f44305

              SHA256

              074646cf44812ff410b1e71224bc69214999105760b3bd2f138bf30a2cc5459a

              SHA512

              5b0863303be78dd7604537e003d4237441465995112d2be61f770f6539d6aef47e8f422079e46239c02e0d200d7994fc1081cfc9064dcbfd8b96423c45ef741e

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_5C0FECF3E49EA4DC8292F821F42A2CB1
              Filesize

              472B

              MD5

              fdbc8e153c1bda0b5876b789404a18c4

              SHA1

              fe9e0df803b2f4028f47bf111e6d571730c87f84

              SHA256

              effdec2f1f1dddee58840580382425d98ba3bb1eebc6e0acc8df0fb006cc063f

              SHA512

              14d179f9bd4b7788b9cd123f309c4d096200d0534268ea5b21ebe5925a3317b21516d3f166782cc8be945b0385fd2e85e5cf41b7d5fecd627ec7fddc04888247

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
              Filesize

              410B

              MD5

              3a95c37f8d7a75708ad03f74d92a2a99

              SHA1

              437665a096a3966b2a802018ab72e59ae1e9cae4

              SHA256

              2ae74cb4d7572cc2849e7bcdf888889bcd308086e974871bcb4145af72f81f1d

              SHA512

              864e60269fcd3b8a80c888d4f600ee97f4f1286050068710acad1df1cb21bb00ae900c9e8037d8776c0d88f3c40bad90940b2fee8993636403d2ff098d71da45

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
              Filesize

              392B

              MD5

              a11f3494404f900d9d6d3193b4b1476a

              SHA1

              67caa541e6b246411518095ad82e83912c077156

              SHA256

              56f39c679ef3d8dcdba98572b78cb449a3896afd595602cf73828c4315e5c30e

              SHA512

              1c355e4e114630eafa94cbb77a3dfa848322ed4565ca5ad95e07440804487490a658ad01d3f1a967a498f282c79ed5a6784a45c9218e175be059d73de4a625b3

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_3B19E079B02C6E9472149DB847F37EF9
              Filesize

              410B

              MD5

              10584fe931b39d10263f3aa3ca446829

              SHA1

              472183559590035d2d5672b2441b223869f261b5

              SHA256

              acacd100c55425fe3e9a8943c172d9969b66e5ced09ed80f19bda85860a5e3b7

              SHA512

              8bfa5e5dbb3287cab0f8a096b7837a9dad7ece091cf3ecd6c9e83b614e0b66c17761be4754349a334c5946038a66eae473c666c8d37008f67de1826cb902c562

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_5C0FECF3E49EA4DC8292F821F42A2CB1
              Filesize

              402B

              MD5

              1d204ac4e11ea25488b34f80d7161fdf

              SHA1

              d64af769a3bb3cfae37485f8192bc28ab043ba51

              SHA256

              f9c29e0a2c42f1a667b68d90e996e8ec51d31cddfad1ec142f1be28983993a53

              SHA512

              a39d494f7b990f12d8fe3670a18395708eb032c5d3c254cd516a1564068476a677349663ea200bbd16b2c3236a6bcdf8309e67a96ca19e14f2bb879c71bfa0c4

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
              Filesize

              207KB

              MD5

              e2b88765ee31470114e866d939a8f2c6

              SHA1

              e0a53b8511186ff308a0507b6304fb16cabd4e1f

              SHA256

              523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

              SHA512

              462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

              Download Submit
            • C:\note.txt
              Filesize

              218B

              MD5

              afa6955439b8d516721231029fb9ca1b

              SHA1

              087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

              SHA256

              8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

              SHA512

              5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

              Download Submit
            • memory/1100-191-0x0000021DD3980000-0x0000021DD3982000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-305-0x0000021DD34E0000-0x0000021DD34E2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-207-0x0000021DD42E0000-0x0000021DD42E2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-209-0x0000021DD4410000-0x0000021DD4412000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-187-0x0000021DD3940000-0x0000021DD3942000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-189-0x0000021DD3960000-0x0000021DD3962000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-203-0x0000021DD42A0000-0x0000021DD42A2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-198-0x0000021DD3CA0000-0x0000021DD3CA2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-200-0x0000021DD3CF0000-0x0000021DD3D10000-memory.dmp
              Filesize

              128KB

              Download
            • memory/1100-195-0x0000021DD39C0000-0x0000021DD39C2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-303-0x0000021DC2910000-0x0000021DC2912000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-205-0x0000021DD42C0000-0x0000021DD42C2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1100-193-0x0000021DD39A0000-0x0000021DD39A2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/3372-225-0x00000224B1220000-0x00000224B1221000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3372-224-0x00000224B1210000-0x00000224B1211000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3372-164-0x00000224AF820000-0x00000224AF822000-memory.dmp
              Filesize

              8KB

              Download
            • memory/3372-163-0x00000224AF750000-0x00000224AF752000-memory.dmp
              Filesize

              8KB

              Download
            • memory/3372-161-0x00000224A81D0000-0x00000224A81D2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/3372-159-0x00000224A8180000-0x00000224A8181000-memory.dmp
              Filesize

              4KB

              Download
            • memory/3372-138-0x00000224AB400000-0x00000224AB410000-memory.dmp
              Filesize

              64KB

              Download
            • memory/3372-122-0x00000224AAC20000-0x00000224AAC30000-memory.dmp
              Filesize

              64KB

              Download
            • memory/3892-337-0x00000203E6590000-0x00000203E65B0000-memory.dmp
              Filesize

              128KB

              Download