Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-06-2024 03:10

General

  • Target

    2024-06-01_4faf6212a719ac648309e9ba3c83a1b6_cobalt-strike_cobaltstrike.exe

  • Size

    5.9MB

  • MD5

    4faf6212a719ac648309e9ba3c83a1b6

  • SHA1

    c2af1ebb7aa3066e0f12e70d125c640a93df8a60

  • SHA256

    cd34b8e00cb45d08dc75220bd1662e5d3ea507767e299be0e2a5f1372f13835a

  • SHA512

    415355c112d953a9d30d33477d4576761789b8f7651a5bb33629cb3f14d25f63408bc86293679b886b098237fcaed49f54e79f266f37d46e8f6a1eefb3fc4752

  • SSDEEP

    98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 21 IoCs
  • UPX dump on OEP (original entry point) 55 IoCs
  • XMRig Miner payload 57 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_4faf6212a719ac648309e9ba3c83a1b6_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_4faf6212a719ac648309e9ba3c83a1b6_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\System\yKHxaym.exe
      C:\Windows\System\yKHxaym.exe
      2⤵
      • Executes dropped EXE
      PID:2636
    • C:\Windows\System\gCUIkGk.exe
      C:\Windows\System\gCUIkGk.exe
      2⤵
      • Executes dropped EXE
      PID:3064
    • C:\Windows\System\xYLJxjB.exe
      C:\Windows\System\xYLJxjB.exe
      2⤵
      • Executes dropped EXE
      PID:2580
    • C:\Windows\System\GESEuxR.exe
      C:\Windows\System\GESEuxR.exe
      2⤵
      • Executes dropped EXE
      PID:2736
    • C:\Windows\System\yvwOCqB.exe
      C:\Windows\System\yvwOCqB.exe
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\System\teYnOEx.exe
      C:\Windows\System\teYnOEx.exe
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Windows\System\FOiCnDr.exe
      C:\Windows\System\FOiCnDr.exe
      2⤵
      • Executes dropped EXE
      PID:2844
    • C:\Windows\System\XKSaZUC.exe
      C:\Windows\System\XKSaZUC.exe
      2⤵
      • Executes dropped EXE
      PID:1624
    • C:\Windows\System\qWkjVac.exe
      C:\Windows\System\qWkjVac.exe
      2⤵
      • Executes dropped EXE
      PID:2772
    • C:\Windows\System\VrXqyZJ.exe
      C:\Windows\System\VrXqyZJ.exe
      2⤵
      • Executes dropped EXE
      PID:2524
    • C:\Windows\System\LFWcPEu.exe
      C:\Windows\System\LFWcPEu.exe
      2⤵
      • Executes dropped EXE
      PID:3020
    • C:\Windows\System\NZeDknR.exe
      C:\Windows\System\NZeDknR.exe
      2⤵
      • Executes dropped EXE
      PID:2272
    • C:\Windows\System\VWwxOea.exe
      C:\Windows\System\VWwxOea.exe
      2⤵
      • Executes dropped EXE
      PID:2684
    • C:\Windows\System\nMKSTVw.exe
      C:\Windows\System\nMKSTVw.exe
      2⤵
      • Executes dropped EXE
      PID:1532
    • C:\Windows\System\etqLXzB.exe
      C:\Windows\System\etqLXzB.exe
      2⤵
      • Executes dropped EXE
      PID:1620
    • C:\Windows\System\geBjeaM.exe
      C:\Windows\System\geBjeaM.exe
      2⤵
      • Executes dropped EXE
      PID:1880
    • C:\Windows\System\FqkXkDb.exe
      C:\Windows\System\FqkXkDb.exe
      2⤵
      • Executes dropped EXE
      PID:1124
    • C:\Windows\System\MGodZsc.exe
      C:\Windows\System\MGodZsc.exe
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Windows\System\OdwWnYd.exe
      C:\Windows\System\OdwWnYd.exe
      2⤵
      • Executes dropped EXE
      PID:1476
    • C:\Windows\System\AWhvAZY.exe
      C:\Windows\System\AWhvAZY.exe
      2⤵
      • Executes dropped EXE
      PID:2412
    • C:\Windows\System\DGEzedP.exe
      C:\Windows\System\DGEzedP.exe
      2⤵
      • Executes dropped EXE
      PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\FqkXkDb.exe

    Filesize

    5.9MB

    MD5

    c0f8e61b3990c87290c129c4551f7fcc

    SHA1

    6c60fee77e44ef3b57d897277dd44a48e3e3a580

    SHA256

    997392bf04072846ceef5aacbfe3178e1cabbc7c4ec81c7853b3d97ca5a06c5b

    SHA512

    0c6bf654d386c125db23226c9ab7a8f875d4e611cc02d6916372ad58cb68c4a88da0d19ebab397e0d22d551d0497b1f5d843eefa26f76a2f83d9f34a159f958f

  • C:\Windows\system\GESEuxR.exe

    Filesize

    5.9MB

    MD5

    4f04421412367079bb9c4faaae839599

    SHA1

    5f16a02f9a4154d9477a4dc2323d30b7e8ba3370

    SHA256

    a9e58667933291717f3c651bb9e03f0033acd37406f1bc990eaf827e4bba38c3

    SHA512

    1e594c1deedc19750c8187a8f1c5dee7fe4d441eca5aee53e1373ad7fb98390c817a792560751867fd2f54fe8c84065ace36a7b23dd0edbe9272707b8ce56222

  • C:\Windows\system\NZeDknR.exe

    Filesize

    5.9MB

    MD5

    795c801ffced024e2174d5c935002876

    SHA1

    018cb75a67eca5f0f135549541ca90e695636cd8

    SHA256

    c29ec0587cc86dbe587660876c0b8705b326e8d5a18323083ece8b6c89fb88a3

    SHA512

    a369b8d2ed4e1029497e095b2d8b9354c3a71f5a351ced8c26ce2b70311d74ca4f441fdfa942fbef87b736785fee6a2ff7b19f626b406afe7f98977775900449

  • C:\Windows\system\OdwWnYd.exe

    Filesize

    5.9MB

    MD5

    74ebab36d7af5cf2b5e099b10ad0d05a

    SHA1

    10421c400baad3bcd7990440c825afaa4dbb6b82

    SHA256

    25e0a5b5d0c323b0bb769dad6ba13f6619dd3a724f6083c4e7380a4c85029208

    SHA512

    ce9ee7f41ea4544e77eb0af5a184342198c4405378a1a8ae255a804f0731fcc3c64b24fa7a29645d07cbe39edb1c2606464230f0dc44bfb975101c374c49fbb6

  • C:\Windows\system\VWwxOea.exe

    Filesize

    5.9MB

    MD5

    173aa17917aa3378021f0b93aebb4a85

    SHA1

    0bdb036e064acb64a6559cf2048a0ffafe59d947

    SHA256

    e932149500d3315aaaa36abb4038a2e037883a5c75b91cab892e4a291934e410

    SHA512

    84b3575666ff821f5f6ebbd6bd5b185c1b1bce50cab27de27d25b05f0707a09a28d89a76587fcbb6cde491e274399321ea7d7f540b65a4c1f96b45694806d8a6

  • C:\Windows\system\VrXqyZJ.exe

    Filesize

    5.9MB

    MD5

    6374cf0f07b50c32579e3d4525f38842

    SHA1

    9f4bc0e15c49fee1cd16a75d35d02890cd24325d

    SHA256

    cae7cf0b2d35041194e357ec8654062f0a7f0e206084164a8910d57edadbc8a8

    SHA512

    3361c0f944f45e4a9cd60016af44157e46ff914355ef0dbaed36f363c0424cfd80a8226bc57a1dac71fae0cb76b7820e1ec0f10ae7838e9adc02ac11a8682c99

  • C:\Windows\system\XKSaZUC.exe

    Filesize

    5.9MB

    MD5

    114c0024ae084524d6a8029fb7f3cdff

    SHA1

    3bd288f867c7714274bd06ec15a561ea355f98a7

    SHA256

    34d45ba41546b0bbc901a5a153ea550d1084e3ff573e93f425de8e8ef7db2d2e

    SHA512

    31b847deebc779de8f417ca7c9bf3daa40361820e769ca913cadcf845fe60ea2fb5e6b57d4202c31f75de90635a408fe71030f6919aedf4aff8e01e3520fca54

  • C:\Windows\system\etqLXzB.exe

    Filesize

    5.9MB

    MD5

    b729f67da70172a4b7affdf4fcec0faa

    SHA1

    dbf0d65d532e374e2e2f0127d71919cfdefd2d45

    SHA256

    f6216396ad85ff05b6f26c8b87e53fa6a07587f4860ff2d8d9d31ee2396a79ec

    SHA512

    2733d57a8bb440c0f603ef534caf9d5eeb7282e4780ce804159898bc0b26545fa8b0dd2ebc40894a7bf302b46ba237315cdf0df904bb8ba4b8d875ba18e3624f

  • C:\Windows\system\gCUIkGk.exe

    Filesize

    5.9MB

    MD5

    98e7106fd0d105ea4823bf2f2b6c92f6

    SHA1

    e2ee5ccd85eada979cb9988def7d2c76a48b47dd

    SHA256

    a37a5b5b76f0c565bcbcea12bb5ca952c12ca5089e9408ebe8e443adeac38c51

    SHA512

    d92de766c780658d9ae7660d9ad0eb110d49ed58782b15cc07a46039e72e66b71d529cbc3fe3a1dd1d5cfac0623312545cc87295dc20a7fbeaad829886a9d00b

  • C:\Windows\system\geBjeaM.exe

    Filesize

    5.9MB

    MD5

    d433df1790868195e50f6086b9b49f51

    SHA1

    c4b51f235d2909e7d4db85edf6161404b863301e

    SHA256

    384c465870cc5c146f878515a1c654f54eed2b8c6ca3a9f8b27aab3e33661527

    SHA512

    852d65f8ce6a915ab35b207891f78e797549018ac6f05b046f17899b15cdda8077a54c4f6ebee329d06cf885ecb98043e5848fdd5125254ee427c41e529d6324

  • C:\Windows\system\nMKSTVw.exe

    Filesize

    5.9MB

    MD5

    b6c75d7c2979aaef6a08b5eacb8e8267

    SHA1

    0e2f3230f9f93a4ebae7626756b917862e1bbb2c

    SHA256

    c9ea3517bf5fedb30956f3dc59645521a1d2855c8b84b13db91e6f9e88bfaeff

    SHA512

    8a88505847c2381573f2b71e16f173a4460952995dc644b3d1b58733d508f626764d05aafb4fbdb6568fdda0e440d03066726894cece756459601679e1620168

  • C:\Windows\system\qWkjVac.exe

    Filesize

    5.9MB

    MD5

    9ac55b898874895b21957b868123e330

    SHA1

    46295b46ac98d92d926ebeeab2745aff8a4f62f8

    SHA256

    13194219d00ec7c089e1e7a52a28f6df975e241e9a6aac8efe71bc98431623c2

    SHA512

    f5e385816574c6abc148b4ae495327e0fcf99f3460e9870118fd8def946ce226585ed680f74a2d55172895d25115566d1779ff7cfabf21d9ea541e99b9d33341

  • C:\Windows\system\teYnOEx.exe

    Filesize

    5.9MB

    MD5

    61c3bf8566d1eb27b2a29a5abd7df277

    SHA1

    c246715d82719ce38da49d52f98b7968e8afb06a

    SHA256

    359b52df7e88592c7fb1c136d724ae20a1855ffb82ff0f33695125e58183cd93

    SHA512

    b750dec555e36696c4db2b546be14a61aa3c1d69a6badddcf3d4f8d670133c30d8e4825725013d2727492988f9b5aba9c0c8629b4e239235f505f7514095146e

  • C:\Windows\system\xYLJxjB.exe

    Filesize

    5.9MB

    MD5

    7169cfd39b226188f48cbaded6150d1c

    SHA1

    8867c34eefd16b0171b4e8055dc74e1160626bff

    SHA256

    ead91792a8ec3ec00ad6fa4ea51ed8e5bee0ce292505e701052441784007a203

    SHA512

    33c4114a3d2cb4426941eb5b62a21a49ad43a265298fa9060939e9b50b65454d4f317fbb8e7c0181d6e4abd81e3f1ff5da3ca4315f3df8aebc3e9586f147db0a

  • C:\Windows\system\yvwOCqB.exe

    Filesize

    5.9MB

    MD5

    d80fcea7ad56329e8f1185514cc16833

    SHA1

    9f5711ec8e0540377ea80673dffa93b5b420eb1d

    SHA256

    3c23e83855be266fdcf96e5b0c8339fd34abf30ffef90974ec40b460b7710f0d

    SHA512

    47c26bc4ec28dc5f1245d0a22d37204e4b32ba9062e886ab56ab47d223179097b4bf0797ee43cf12b004dba342ba37b5e154bfaf9a93e6ddef6e0350b2c902a0

  • \Windows\system\AWhvAZY.exe

    Filesize

    5.9MB

    MD5

    5ea0d9ce3d2c02c193b95c1f0df0f54a

    SHA1

    0218b9301757461143de06cf197922917e5eb372

    SHA256

    6f1b3093fefe76ae73bb71b62e3630657753b4af7fa0c319d96224ba67cf98d8

    SHA512

    646d705e7a49f643689bc6181f5000f78ae4fb8381adc4aa5610522a1b5ada98eb0bfc6d4009faa08eb51bf04cc2d901aa4517ca56b80693ca661f2975d70c5f

  • \Windows\system\DGEzedP.exe

    Filesize

    5.9MB

    MD5

    a37fa1498fbb88008b3a33b24e3af33b

    SHA1

    af57f2b540a3a2ba70180f0eb8b04b0bde815841

    SHA256

    1f7e8d4e85fa1d1ab43d867b8ea48881a697d6213eee26ce86da4ae39ccd47a7

    SHA512

    8b30e112d8921c2fa99f2c42bf33ee5b2dc75cb9c5d9bdfc0c0a42401ecebea36956f6e8b230a99aee473566d04f1f392891516b52833faf9ebf06b201562f1a

  • \Windows\system\FOiCnDr.exe

    Filesize

    5.9MB

    MD5

    210881f6c054d9b94d0353727b52d098

    SHA1

    1575ec8b765ce67e7ed3150ed2c364108c228286

    SHA256

    605f99993e992f7c861f7681dee825b05492c173f3442c047d2cc94c7183d7b9

    SHA512

    f6d85e8d5fee317e9746fd9c6f5ce8b1c58f5959568482b0cbb2c49703ed1308d6afc9e741f6ee51b4a0450472e4f4f35fe71c3871b325d97db5c7f8d39c75e0

  • \Windows\system\LFWcPEu.exe

    Filesize

    5.9MB

    MD5

    bbda182e20d9a03ac5128bfa72cf9f83

    SHA1

    640fd716e9f335ec1ebb5f14123235b507795c1e

    SHA256

    dd2517ddc63c7e629cce0b2081c439c5dbfa9df417491c2d9af898abf83c9a90

    SHA512

    46e0ec902706cc8d702ba73981b953b0f2bd1f5ee6117c6762675ec1f683e05c56ff7a49315b75885d1ab623c842321cdfa4ab76e6b68f7a899a31dd71c327a3

  • \Windows\system\MGodZsc.exe

    Filesize

    5.9MB

    MD5

    ffa4e689c72943477c13df0006c8129c

    SHA1

    2d35cf889577d5547fd48d674f636d880bb13428

    SHA256

    dcadc49d41145381c726ca5da20a327b0f1e6364608eaf1dfe2097f923f09337

    SHA512

    649b0569a96c769a6efcc4841b5162711137f13e163c878784e0f2f25e9ff6bb14de178be8ba3a3b6ecbd2715426df3cec55df7979df291196d93e91795d16b9

  • \Windows\system\yKHxaym.exe

    Filesize

    5.9MB

    MD5

    ec7e098d8ae23e6383dc6aade506d171

    SHA1

    8f067b44a9f9447b562ede87fbcebad01b10074e

    SHA256

    badf5529e3ab85404048343dbf17c159d465155459e5ec2c53cc9adb55383b1d

    SHA512

    1dc2c30c373a65ebeb7fc52ab6c2eb23aa380cf9f6004d9f49cef684ffb681fdf3614ccd63c46a95825b8eb55639eb0538d1ab360135e1fac592f15b93940375

  • memory/1532-153-0x000000013F0C0000-0x000000013F414000-memory.dmp

    Filesize

    3.3MB

  • memory/1532-99-0x000000013F0C0000-0x000000013F414000-memory.dmp

    Filesize

    3.3MB

  • memory/1624-150-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

    Filesize

    3.3MB

  • memory/1624-82-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-73-0x000000013F940000-0x000000013FC94000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-140-0x000000013FA70000-0x000000013FDC4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-56-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-27-0x000000013FD40000-0x0000000140094000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-69-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-18-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-108-0x000000013FA70000-0x000000013FDC4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-21-0x000000013F730000-0x000000013FA84000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-70-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-53-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-138-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-98-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-1-0x00000000000F0000-0x0000000000100000-memory.dmp

    Filesize

    64KB

  • memory/2080-33-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-90-0x000000013F760000-0x000000013FAB4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-89-0x000000013F290000-0x000000013F5E4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-0-0x000000013F290000-0x000000013F5E4000-memory.dmp

    Filesize

    3.3MB

  • memory/2080-81-0x0000000002420000-0x0000000002774000-memory.dmp

    Filesize

    3.3MB

  • memory/2272-84-0x000000013F940000-0x000000013FC94000-memory.dmp

    Filesize

    3.3MB

  • memory/2272-152-0x000000013F940000-0x000000013FC94000-memory.dmp

    Filesize

    3.3MB

  • memory/2484-51-0x000000013F500000-0x000000013F854000-memory.dmp

    Filesize

    3.3MB

  • memory/2484-147-0x000000013F500000-0x000000013F854000-memory.dmp

    Filesize

    3.3MB

  • memory/2484-137-0x000000013F500000-0x000000013F854000-memory.dmp

    Filesize

    3.3MB

  • memory/2524-151-0x000000013F0F0000-0x000000013F444000-memory.dmp

    Filesize

    3.3MB

  • memory/2524-83-0x000000013F0F0000-0x000000013F444000-memory.dmp

    Filesize

    3.3MB

  • memory/2580-143-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

    Filesize

    3.3MB

  • memory/2580-22-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

    Filesize

    3.3MB

  • memory/2584-36-0x000000013F5D0000-0x000000013F924000-memory.dmp

    Filesize

    3.3MB

  • memory/2584-136-0x000000013F5D0000-0x000000013F924000-memory.dmp

    Filesize

    3.3MB

  • memory/2584-144-0x000000013F5D0000-0x000000013F924000-memory.dmp

    Filesize

    3.3MB

  • memory/2636-141-0x000000013F6C0000-0x000000013FA14000-memory.dmp

    Filesize

    3.3MB

  • memory/2636-15-0x000000013F6C0000-0x000000013FA14000-memory.dmp

    Filesize

    3.3MB

  • memory/2684-91-0x000000013F760000-0x000000013FAB4000-memory.dmp

    Filesize

    3.3MB

  • memory/2684-139-0x000000013F760000-0x000000013FAB4000-memory.dmp

    Filesize

    3.3MB

  • memory/2684-154-0x000000013F760000-0x000000013FAB4000-memory.dmp

    Filesize

    3.3MB

  • memory/2736-28-0x000000013FD40000-0x0000000140094000-memory.dmp

    Filesize

    3.3MB

  • memory/2736-135-0x000000013FD40000-0x0000000140094000-memory.dmp

    Filesize

    3.3MB

  • memory/2736-145-0x000000013FD40000-0x0000000140094000-memory.dmp

    Filesize

    3.3MB

  • memory/2772-65-0x000000013F3E0000-0x000000013F734000-memory.dmp

    Filesize

    3.3MB

  • memory/2772-148-0x000000013F3E0000-0x000000013F734000-memory.dmp

    Filesize

    3.3MB

  • memory/2844-146-0x000000013FE40000-0x0000000140194000-memory.dmp

    Filesize

    3.3MB

  • memory/2844-55-0x000000013FE40000-0x0000000140194000-memory.dmp

    Filesize

    3.3MB

  • memory/3020-149-0x000000013F260000-0x000000013F5B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3020-74-0x000000013F260000-0x000000013F5B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3064-20-0x000000013F730000-0x000000013FA84000-memory.dmp

    Filesize

    3.3MB

  • memory/3064-142-0x000000013F730000-0x000000013FA84000-memory.dmp

    Filesize

    3.3MB