7dd3f3179b79f35d0006b8561de23b75fd5de295643a48f7f1bbd39fe6ecc06a

Resubmissions

13-03-2024 05:11

240313-fvd2vsfd22 1

13-03-2024 05:09

240313-ftkg9ade61 1

Analysis

max time kernel
260s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloader.bat
Size

269B
MD5

9a75419a719b9724e6c9fea4b01130b0
SHA1

53e20398e830115b07181e79d9d89c56bce3376f
SHA256

7dd3f3179b79f35d0006b8561de23b75fd5de295643a48f7f1bbd39fe6ecc06a
SHA512

ecaf3aebdb6b7c9eddae0c313c7a5b715167b9071e365fb5f53fc3d46906caf0c2fdb6b4e440c0cd1eb8758e1a7c6c094ac89238f51b0eda46035d14daa19782

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b80b21320575da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090d125320575da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004dcfea330575da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056b9c9300575da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3804	NOTEPAD.EXE
1412	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3804	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1796	2228	cmd.exe	89
PID 2228 wrote to memory of 1796	2228	cmd.exe	89
PID 2492 wrote to memory of 4812	2492	SearchIndexer.exe	114
PID 2492 wrote to memory of 4812	2492	SearchIndexer.exe	114
PID 2492 wrote to memory of 3624	2492	SearchIndexer.exe	115
PID 2492 wrote to memory of 3624	2492	SearchIndexer.exe	115
PID 2880 wrote to memory of 1680	2880	cmd.exe	129
PID 2880 wrote to memory of 1680	2880	cmd.exe	129

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Downloader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\curl.exe
  curl -o https://cdn.discordapp.com/attachments/1203539560856821800/1214035019396423690/ValorantSwapper.bat?ex=65f7a538
  2⤵
  PID:1796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4812
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3624

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Downloader.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Downloader.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\curl.exe
  curl -o https://cdn.discordapp.com/attachments/1203539560856821800/1214035019396423690/ValorantSwapper.bat?ex=65f7a538
  2⤵
  PID:1680

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Downloader.bat
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Downloader.bat

Filesize
271B

MD5
6f2206cc7b9a96e6344f987e80988201

SHA1
0980640aaa76a403502678e8b2a887f642268309

SHA256
ec123bbfdab7b401cd31a11f5bf421a0f9e77da22342a6d3a27f7e4f36b67295

SHA512
feb92f3ed5d3a998dda75a8cb9d0192267bf13723f69684d65b91ef2388448f3847cf782fb975a65d6e6276ff2c72e86ed892b64074b92cce9ebe5db99a48037

Download Submit
memory/2492-0-0x000002A1844B0000-0x000002A1844C0000-memory.dmp

Filesize
64KB

Download
memory/2492-16-0x000002A1846E0000-0x000002A1846F0000-memory.dmp

Filesize
64KB

Download
memory/2492-32-0x000002A188AA0000-0x000002A188AA8000-memory.dmp

Filesize
32KB

Download
memory/2492-36-0x000002A189430000-0x000002A189438000-memory.dmp

Filesize
32KB

Download
memory/3624-38-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-39-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-40-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-41-0x0000029433890000-0x00000294338A0000-memory.dmp

Filesize
64KB

Download
memory/3624-42-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-43-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-45-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-44-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-47-0x0000029434620000-0x0000029434621000-memory.dmp

Filesize
4KB

Download
memory/3624-46-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-48-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-49-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-50-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-51-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-52-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-53-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-54-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-55-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-56-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-57-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-58-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-59-0x0000029434640000-0x0000029434650000-memory.dmp

Filesize
64KB

Download
memory/3624-60-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-61-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-63-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-62-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-67-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-68-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-66-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-65-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-69-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-70-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-64-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-71-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-72-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-73-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-74-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-76-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-75-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-79-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-82-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-85-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-88-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-89-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-91-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-92-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-100-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-101-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-104-0x0000029434620000-0x0000029434621000-memory.dmp

Filesize
4KB

Download
memory/3624-105-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-106-0x0000029434640000-0x0000029434650000-memory.dmp

Filesize
64KB

Download
memory/3624-108-0x0000029434640000-0x0000029434650000-memory.dmp

Filesize
64KB

Download
memory/3624-109-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-110-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-113-0x0000029434DC0000-0x0000029434DD0000-memory.dmp

Filesize
64KB

Download
memory/3624-114-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-118-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-119-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-127-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-128-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-129-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-133-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-135-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-139-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-143-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-150-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-151-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-153-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-157-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-160-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-162-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-166-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-168-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-167-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-169-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-170-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-180-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-179-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-181-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-184-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-191-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-192-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-202-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-203-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-204-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-206-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download
memory/3624-207-0x0000029433880000-0x0000029433890000-memory.dmp

Filesize
64KB

Download
memory/3624-210-0x0000029434FF0000-0x0000029435000000-memory.dmp

Filesize
64KB

Download