1ca93fdcc11135777684369edc2bb27d287ffa05d09533c69107e88c153d96c2

Analysis

max time kernel
122s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/04/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave/Wave.exe
Size 7.0MB
Sample240409-asm9vsbg8y
SHA256 2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f
MD5 a8bd4a6b2f1d00928e61870a5688c13d
SHA1 e17646d5279534f2e3eb0e0cfc8b6c536bc0c095
SHA512 6b5175beea4071668c87b16af3177bbb2cbaff6b28909dc1e09ad5b16b449c62d6adc372a0094de627fe9835f0c474d16708c3f698355ba1664bf321fa19f5fb
SSDEEP 98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	SearchProtocolHost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	SearchIndexer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice\Hash = "g50t7UzdcnI="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b8ae5a8158ada01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.MTS = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice\Hash = "A2SNzZXM4Ho="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice\Hash = "Yyxm2MSukss="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice\Hash = "mFQTYt1Z6YQ="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.3gpp = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\UserChoice\Hash = "T391Knfb9Yo="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.html = "1"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.wav = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d30e0ae158ada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb33eba7158ada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice\ProgId = "AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice\ProgId = "AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice\ProgId = "AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.HTM\UserChoice\ProgId = "AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice\Hash = "PtFPI13HMJ4="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice\Hash = "2JzVYhaIS/A="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	Wave.exe
3900	Wave.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	Wave.exe
Token: 33	4008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeDebugPrivilege	3900	Wave.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4652	4008	SearchIndexer.exe	76
PID 4008 wrote to memory of 4652	4008	SearchIndexer.exe	76
PID 4008 wrote to memory of 520	4008	SearchIndexer.exe	77
PID 4008 wrote to memory of 520	4008	SearchIndexer.exe	77

C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692
  2⤵
  - Modifies data under HKEY_USERS
  PID:520

C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave\Wave.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Wave.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Wave.exe.log
Size 1KB
SHA256 1cfdbba98758050fe9b6d1605591f17cf0138d6c628877e4c15edee12de1233d
MD5 5ecd3648e2f5d9b817a5529e0ea795f5
SHA1 eb27407798f5e5760e9eb94c1d52cfdf3837270a
SHA512 d995332639f48a84403a19d49b09e204964a64f9c907aec7e53e9a9852f8f17a060771b2a13d19dcfaff30082ffc8850d32a16a4589c7bdf95520f504dcfe637
MD5 SHA1 SHA512

Submit Download

memory/520-103-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-59-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-47-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-335-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-337-0x000002AA24A30000-0x000002AA24A40000-memory.dmp

Download

memory/520-341-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-333-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-332-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-327-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-325-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-323-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-49-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-52-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-54-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-55-0x000002AA23080000-0x000002AA23090000-memory.dmp

Download

memory/520-56-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-57-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-58-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-107-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-60-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-63-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-64-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-69-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-70-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-71-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-75-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-77-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-76-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-74-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-68-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-67-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-78-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-79-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-80-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-99-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-84-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-86-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-85-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-87-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-89-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-88-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-92-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-93-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-96-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-97-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-98-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-100-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-45-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-83-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-315-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-239-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-112-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-115-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-120-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-133-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-136-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-158-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-157-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-171-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-170-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-173-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-179-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-182-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-183-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-188-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-202-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-204-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-206-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-209-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-212-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-213-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-218-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-231-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-233-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-109-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-245-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-254-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-255-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-259-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-263-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-265-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-276-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-287-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-288-0x000002AA24A30000-0x000002AA24A40000-memory.dmp

Download

memory/520-293-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/520-300-0x000002AA23040000-0x000002AA23050000-memory.dmp

Download

memory/520-309-0x000002AA23070000-0x000002AA23080000-memory.dmp

Download

memory/4008-6-0x00000251E12B0000-0x00000251E12C0000-memory.dmp

Download

memory/4008-38-0x00000251E58F0000-0x00000251E58F8000-memory.dmp

Download

memory/4008-22-0x00000251E1450000-0x00000251E1460000-memory.dmp

Download

memory/4492-42-0x00007FFE06990000-0x00007FFE0737C000-memory.dmp

Download

memory/4492-5-0x00000132A5A40000-0x00000132A5C01000-memory.dmp

Download

memory/4492-4-0x00000132A5950000-0x00000132A5A36000-memory.dmp

Download

memory/4492-3-0x000001328B4C0000-0x000001328B4E4000-memory.dmp

Download

memory/4492-2-0x000001328B500000-0x000001328B510000-memory.dmp

Download

memory/4492-1-0x00007FFE06990000-0x00007FFE0737C000-memory.dmp

Download

memory/4492-0-0x000001328A9E0000-0x000001328B0E8000-memory.dmp

Download

memory/4492-46-0x000001328B500000-0x000001328B510000-memory.dmp

Download