Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 15:09

General

  • Target

    532d44121238b63e34a05981b7108d20N.exe

  • Size

    5.2MB

  • MD5

    532d44121238b63e34a05981b7108d20

  • SHA1

    b969c686dbd0cb039eebbfc50fcb77b4dd02a7b1

  • SHA256

    3475258ed81e0c42b32aa6025a2cf7b67eb489c6403ecc80bc9eacd4ae87bd26

  • SHA512

    ec1c29232421cd7eda2b347f0a1591a095ef09180e1e09d1ddd294d4b9f7062c3607d07d762a8b7a706f8c981ef35c782561499696341a1d74f3ff1c153cc74d

  • SSDEEP

    49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lU0

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 35 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 21 IoCs
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\532d44121238b63e34a05981b7108d20N.exe
    "C:\Users\Admin\AppData\Local\Temp\532d44121238b63e34a05981b7108d20N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\System\YprybPS.exe
      C:\Windows\System\YprybPS.exe
      2⤵
      • Executes dropped EXE
      PID:2088
    • C:\Windows\System\ZtMBeAI.exe
      C:\Windows\System\ZtMBeAI.exe
      2⤵
      • Executes dropped EXE
      PID:2176
    • C:\Windows\System\EJDsCXd.exe
      C:\Windows\System\EJDsCXd.exe
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Windows\System\lEpSMIG.exe
      C:\Windows\System\lEpSMIG.exe
      2⤵
      • Executes dropped EXE
      PID:2356
    • C:\Windows\System\djoysso.exe
      C:\Windows\System\djoysso.exe
      2⤵
      • Executes dropped EXE
      PID:2796
    • C:\Windows\System\FJtAlfE.exe
      C:\Windows\System\FJtAlfE.exe
      2⤵
      • Executes dropped EXE
      PID:568
    • C:\Windows\System\LAyngHw.exe
      C:\Windows\System\LAyngHw.exe
      2⤵
      • Executes dropped EXE
      PID:2240
    • C:\Windows\System\qxUuMuu.exe
      C:\Windows\System\qxUuMuu.exe
      2⤵
      • Executes dropped EXE
      PID:2720
    • C:\Windows\System\moSMFMq.exe
      C:\Windows\System\moSMFMq.exe
      2⤵
      • Executes dropped EXE
      PID:2856
    • C:\Windows\System\usiiSBl.exe
      C:\Windows\System\usiiSBl.exe
      2⤵
      • Executes dropped EXE
      PID:2840
    • C:\Windows\System\iBgYtUL.exe
      C:\Windows\System\iBgYtUL.exe
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\System\GEDvknN.exe
      C:\Windows\System\GEDvknN.exe
      2⤵
      • Executes dropped EXE
      PID:2788
    • C:\Windows\System\PosIEoE.exe
      C:\Windows\System\PosIEoE.exe
      2⤵
      • Executes dropped EXE
      PID:2784
    • C:\Windows\System\iVFpXqF.exe
      C:\Windows\System\iVFpXqF.exe
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Windows\System\YbApRmu.exe
      C:\Windows\System\YbApRmu.exe
      2⤵
      • Executes dropped EXE
      PID:2628
    • C:\Windows\System\MxNexJN.exe
      C:\Windows\System\MxNexJN.exe
      2⤵
      • Executes dropped EXE
      PID:2676
    • C:\Windows\System\vuIMdvp.exe
      C:\Windows\System\vuIMdvp.exe
      2⤵
      • Executes dropped EXE
      PID:1976
    • C:\Windows\System\ZDfwsQJ.exe
      C:\Windows\System\ZDfwsQJ.exe
      2⤵
      • Executes dropped EXE
      PID:2020
    • C:\Windows\System\YPqwkAX.exe
      C:\Windows\System\YPqwkAX.exe
      2⤵
      • Executes dropped EXE
      PID:848
    • C:\Windows\System\BUEXWvB.exe
      C:\Windows\System\BUEXWvB.exe
      2⤵
      • Executes dropped EXE
      PID:1828
    • C:\Windows\System\NtJApgR.exe
      C:\Windows\System\NtJApgR.exe
      2⤵
      • Executes dropped EXE
      PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\FJtAlfE.exe

    Filesize

    5.2MB

    MD5

    73edbd47ce677d399a52c87c3de14181

    SHA1

    74fa49d21ee91ac92a904470fdd3ce46a0b012ad

    SHA256

    3d207bfc99ebf4ce149cbbf33da80a3b97ee278b412df489c6e08ef8253f4b71

    SHA512

    2fa632ea4f91752fd2cff298010842e16cb052171960cbbb649885b30ebdc883ce3de61a46baa8749f68cd49754a29bba9ce805128c6cca518974c98615337bc

  • C:\Windows\system\LAyngHw.exe

    Filesize

    5.2MB

    MD5

    c7b00698b5958127f40ae6f9c34a80a7

    SHA1

    ba32c5a3390f6b51d5565abd0a0f94affae8c999

    SHA256

    f5a2371246a74a8becb9d82ac57dfff8855ff7c0cf830deebda292147a8f19b7

    SHA512

    67e549f272cbaa9ea11fd9e8526ca2f1f631d0a1fd8092e7998a0689a313d207b10d84ef7f9482ef662a87fe191039b895fd8ea61263ccdca911e299f548aa77

  • C:\Windows\system\NtJApgR.exe

    Filesize

    5.2MB

    MD5

    b34f403d20ac91548f38969304182bf6

    SHA1

    249a052fe743eee7e1dafccdcfd4ad396b121d9a

    SHA256

    b373750c7ad8d5cc0fb0749dbf53f4cf242b1bae962056b5318a63b52c82e592

    SHA512

    7a67ac4763e7aad2c9fbdfbd555a90c16f4322dc782e664ea480370b54ed5d1b530615107bb2371c445ffd9fb6e4e54a004af05a926b7acd4a0d1e3fb9b293fb

  • C:\Windows\system\ZtMBeAI.exe

    Filesize

    5.2MB

    MD5

    97e147a8d79c04bcde7e299086ba2f67

    SHA1

    a44e7cc5e89757302d68ae24f5973693d1725252

    SHA256

    18b31423b7339b711c63b8180abaa900409e8dc822972c2a1eb055dcdec5cc4f

    SHA512

    0c7c61e21b86b9a8c4095cd7e691473ff835bc8fab2ccdadbdddde21614d8fff86dd9b70d7cbcbf7df3beea85d2d85aca037ac893c893f9170666bb2773c11db

  • C:\Windows\system\djoysso.exe

    Filesize

    5.2MB

    MD5

    b3bebf65cf6a1a41c8a846b7e278b8fa

    SHA1

    c9a6b5c5ab3b93959df7ec7a9cd6beb3c1301f22

    SHA256

    576d1104ffac1dcaba30ccba2c5190b0435db342b1bb63b059ca15dc29b13c12

    SHA512

    f75f1cdadcfbc4413ebd27dcc4364aa54882f660a6a743c7d03943343dd1d119008ff63eec05b208e3e40346abe04a5a61799b6e93230776907b8b64e4b7e88b

  • C:\Windows\system\iBgYtUL.exe

    Filesize

    5.2MB

    MD5

    b452da4a0cdad9b817963aa092be0932

    SHA1

    f3228de90521b0141fc764274140b4e9f5ffa8f8

    SHA256

    0316874f9b465024283735ccb95c94f197d98b57bbc3aac7408fd8a00e866757

    SHA512

    b2afe47d15748ee23f490c5df3b5d65ec057d311320e35b722f4d805a63fd77931f0b34e248c4acb27a4774936bb30f9e630a3ceccba49a05751452106bc5677

  • C:\Windows\system\moSMFMq.exe

    Filesize

    5.2MB

    MD5

    0c53a06446019edefbacf3c6e346aad6

    SHA1

    a511a4cf37f56144e52ef64a279a99809d1481c5

    SHA256

    9db245d6812549de5788a5b96812bf0a7569ea0b4171ca076ba7d155a72069a3

    SHA512

    da1d109a20f1258dc5f87f3710734802a373f0452e29bf5f84f9380aba3d6a33ef8930b52b46e2d2a739782f6345ca5fe5bc5f5a81ddbe8e46ae366a2a8225ba

  • C:\Windows\system\qxUuMuu.exe

    Filesize

    5.2MB

    MD5

    d6ba6aa73bee657504ac5d4a16550129

    SHA1

    3d6f37121440a48ea118c092bee3f85200c9e704

    SHA256

    b1a2a4d8b33e80860cc34f256c1eef2f09d2e702af2cfea48e32b67a1a71c18d

    SHA512

    707e0d33388e81a137e6e05b0ddb2b9303c49810d626cc1ad6061e59a92a7a3a9b0276b09053df3e4978628aafdaab2c507779fc72a68e9b27986d17f1850999

  • \Windows\system\BUEXWvB.exe

    Filesize

    5.2MB

    MD5

    eb8d515c87494a8afb4139999cb20718

    SHA1

    a37e9213a98685c5889b2015a61e41d38f8946f7

    SHA256

    ad077128fc0db0a408cdf545e09f42a46519f818c270f303a98836644880d9f6

    SHA512

    ebe0ff1aac7d8ff3e1cbcb9e541d91894967797626bae1ab3ba064aaa69d4a6e3ed20d2d9747a20bd3163e4f3010d99d053440b75841bdf9c3546a049fcb6ea3

  • \Windows\system\EJDsCXd.exe

    Filesize

    5.2MB

    MD5

    1fbf95bcb9249807d93d7779673985f0

    SHA1

    f2c9609b74627784b82b3dae41c476e0ae935435

    SHA256

    28b9b49f19bf12b931888058ad2a91b0621a25dfef89ebc382329f1ed70a57fc

    SHA512

    39d63883be29bedcfa552b4a1cda98e92df237178737d2de633a92e17ee3eecbdfba88ff9d4cf0822dc7e8cb3bca6e1e343ee746fd0588f576ef041bd2d33dd6

  • \Windows\system\GEDvknN.exe

    Filesize

    5.2MB

    MD5

    2fcfe09159f49ee71864de0c883bed89

    SHA1

    4a1b401a8b882da660d30cb8cb5b8fb74b690cf0

    SHA256

    dcb89694a499bde39e378c2a75dc5cb334ec23763afb5b91be4df632dae6b4d8

    SHA512

    17e555716164a530ffd973bffef54a5dcd3d784c2ceee0cefa4e986b57a56967391058b51ca25a826f59f4c31dab036ec4a53d3cc4b2ae8f4fdf09762f7ec064

  • \Windows\system\MxNexJN.exe

    Filesize

    5.2MB

    MD5

    6f4e3eb36cfa82fdbe788cc960bce3b6

    SHA1

    86e0320df7a1f651ec9e01ccb988ea27ffb00f4d

    SHA256

    0d5c120d990570f0ca835158534b8e20f5eb09cede472c3735fe0b26ac474921

    SHA512

    092f44b0dcca973966b0a3953be65ccc3592112cf7fe78f3f5e93bc651c93bcb8afd009666a78ec7bc6d589a60da4844e2692186722a6fd969625af33c9fce52

  • \Windows\system\PosIEoE.exe

    Filesize

    5.2MB

    MD5

    65dcedd49ccb0b7c54a1ada5bebd8567

    SHA1

    f3443aba814e4466267b8c08b1c56b56a7224ca2

    SHA256

    ad7593ae4dd4169979d84498e48875f3e81ce3739dc699849954b05d36c3dc39

    SHA512

    2983f038318bb0e41613c8406417125bfbb83740167236b4d6192e77646899e01b2eef1b5e694ecdfe58853c7408a9ccac1dc122541e97d75a20706d60044ba1

  • \Windows\system\YPqwkAX.exe

    Filesize

    5.2MB

    MD5

    56c8f3d0fde88fcd75f27f56406131f2

    SHA1

    847962567f29891b3c769ad87d1f5f1797181483

    SHA256

    6b0f079c6f8e4c609ca481c275bb4c975a895da857ce19497c72d5c2a249d2eb

    SHA512

    a1b9d3708b1d09434e707f3379bd2d01567bd91c3967bca592bd49a4e4cd0a3379cd060aee9be67654ae788e6c57a00bcf9fb05b97e838aecde28fce111fb44a

  • \Windows\system\YbApRmu.exe

    Filesize

    5.2MB

    MD5

    4ed9d2f946ee608ec2774b64ee91e0ff

    SHA1

    d76b163cd8a84c098897af7fdc37f4d8e72df0fa

    SHA256

    ca30cde00636762a111b9b9f3dd378f933b0fccec6f13ea2797c51ca87d59a35

    SHA512

    8b8b4db52374d76753a09f3d306f824472a93cdd16198eade8e2eafbcd884452cbffff0104207d2ce7e9f44a8ca1fda136bd487b9f3a49f3d23c5250814f2389

  • \Windows\system\YprybPS.exe

    Filesize

    5.2MB

    MD5

    286b0f6daafc796cc40822bd78c77787

    SHA1

    d2fe50c1b11fdc8bb8452f74b027b1d401ab7940

    SHA256

    4336e688d4c94eab6ba2e3647d4bd96e8db9e971bfe0c2da32d115436c3298f9

    SHA512

    266624f8ebdb70836e00e15440361e03ac82284e3ae12796dcb29b50a2456eb1c7e1d46a51c7dfe346060ca9a9fc0beece502fd0fc4f4d18391ce359531af291

  • \Windows\system\ZDfwsQJ.exe

    Filesize

    5.2MB

    MD5

    2c1c75d8fe6489b8a6491e2136ec3ced

    SHA1

    9ccdc696db48ed0d96543bc1bb1514a54a89094a

    SHA256

    704b7e7bface10fd274689d6883871d6e16b7d6ec7716e2a3ee960284f70a483

    SHA512

    b5d39d8386d64e6d7a916ced8a517480da7220dba4b4b976bfe6666d3aaf873b265a2fc610d8cc754ed650c12c06ac72c72f1465a4094a83aa187c41156ea56d

  • \Windows\system\iVFpXqF.exe

    Filesize

    5.2MB

    MD5

    dbfa34f85824f6d311f4c29cda25914d

    SHA1

    a9eb36ee041a86f985d0445c1c0766b90e4afb31

    SHA256

    a94d1876f8ec6fabcf30ad7cbceef00e7eff4b9b575ce809d7cb1e12bfbf9993

    SHA512

    3b86ac269402c063a4e279910ab2fc64e556249bc6710003a4559783c1b04d20c3b7567312f24fd466229955590a72a45399e9c8a0a98de01157f97db09c1733

  • \Windows\system\lEpSMIG.exe

    Filesize

    5.2MB

    MD5

    afddd56b6311cd3bb0c0be7daf0bb58e

    SHA1

    6486833d59ecee45eca8f0e19b62849cc6ce0af6

    SHA256

    1ff5bf22503d1702a5cf3c89874283c48a9af54452554235dc7860b98eea507c

    SHA512

    7facff64032923fb961c2d2819911be92d0a7aa0820dfa0d1fcb9411cf0bfabb5a13edcef48fcd10474dc6c7e58a75f6ad9dc57607eb517def75360fb5c0d63d

  • \Windows\system\usiiSBl.exe

    Filesize

    5.2MB

    MD5

    0a9e00f9c5f6af2629f3ad4e9d5acca8

    SHA1

    1eed1faf42776182c4cc2485d6393e90f91dd9cd

    SHA256

    99112fa8f8c110bbba5a09b93803dbe0dae5209f8789032813f011d1ca9c7cb3

    SHA512

    bde82ea61b7f0edb62d3d1a33487a45cac257eae089579e851801d38970aebdce499c4a71ed2da0a24ebe42016e6879e92eba9210c4dd255e3b1da37e5456ad8

  • \Windows\system\vuIMdvp.exe

    Filesize

    5.2MB

    MD5

    7a36e1800072528d776d24cd581de2b2

    SHA1

    9eb701e3ce544661a176df7dc7aa9913cd9423da

    SHA256

    68e079c804e6b3b1edc0e08680d8bb91a86025682a4a4fdc0e292bd0df7e6a78

    SHA512

    29c57089375e86f5d965770467c0184b35ff65674b37a21688ee49fe19a2623629f30549133a1397d7faa0c250c9907d08b6b80696539b4dc081917c7d41b873

  • memory/568-109-0x000000013FFA0000-0x00000001402F1000-memory.dmp

    Filesize

    3.3MB

  • memory/568-246-0x000000013FFA0000-0x00000001402F1000-memory.dmp

    Filesize

    3.3MB

  • memory/848-157-0x000000013FC70000-0x000000013FFC1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-116-0x0000000002280000-0x00000000025D1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-160-0x000000013F420000-0x000000013F771000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-25-0x000000013F530000-0x000000013F881000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-52-0x000000013F090000-0x000000013F3E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-1-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/1312-76-0x000000013F300000-0x000000013F651000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-161-0x000000013FF90000-0x00000001402E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-56-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-117-0x000000013F050000-0x000000013F3A1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-61-0x000000013F1B0000-0x000000013F501000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-48-0x0000000002280000-0x00000000025D1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-105-0x000000013F100000-0x000000013F451000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-126-0x000000013FF90000-0x00000001402E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-119-0x000000013F420000-0x000000013F771000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-20-0x000000013F040000-0x000000013F391000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-0-0x000000013FF90000-0x00000001402E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-115-0x000000013F4F0000-0x000000013F841000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-129-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-114-0x000000013F090000-0x000000013F3E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-33-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-110-0x000000013F2F0000-0x000000013F641000-memory.dmp

    Filesize

    3.3MB

  • memory/1312-138-0x000000013FF90000-0x00000001402E1000-memory.dmp

    Filesize

    3.3MB

  • memory/1828-158-0x000000013FDF0000-0x0000000140141000-memory.dmp

    Filesize

    3.3MB

  • memory/1928-159-0x000000013F8B0000-0x000000013FC01000-memory.dmp

    Filesize

    3.3MB

  • memory/1976-155-0x000000013FE30000-0x0000000140181000-memory.dmp

    Filesize

    3.3MB

  • memory/2020-156-0x000000013F050000-0x000000013F3A1000-memory.dmp

    Filesize

    3.3MB

  • memory/2088-127-0x000000013F430000-0x000000013F781000-memory.dmp

    Filesize

    3.3MB

  • memory/2088-228-0x000000013F430000-0x000000013F781000-memory.dmp

    Filesize

    3.3MB

  • memory/2088-13-0x000000013F430000-0x000000013F781000-memory.dmp

    Filesize

    3.3MB

  • memory/2176-19-0x000000013F530000-0x000000013F881000-memory.dmp

    Filesize

    3.3MB

  • memory/2176-128-0x000000013F530000-0x000000013F881000-memory.dmp

    Filesize

    3.3MB

  • memory/2176-232-0x000000013F530000-0x000000013F881000-memory.dmp

    Filesize

    3.3MB

  • memory/2240-108-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

    Filesize

    3.3MB

  • memory/2240-236-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

    Filesize

    3.3MB

  • memory/2340-21-0x000000013F040000-0x000000013F391000-memory.dmp

    Filesize

    3.3MB

  • memory/2340-230-0x000000013F040000-0x000000013F391000-memory.dmp

    Filesize

    3.3MB

  • memory/2356-242-0x000000013FA50000-0x000000013FDA1000-memory.dmp

    Filesize

    3.3MB

  • memory/2356-66-0x000000013FA50000-0x000000013FDA1000-memory.dmp

    Filesize

    3.3MB

  • memory/2628-249-0x000000013F420000-0x000000013F771000-memory.dmp

    Filesize

    3.3MB

  • memory/2628-118-0x000000013F420000-0x000000013F771000-memory.dmp

    Filesize

    3.3MB

  • memory/2676-154-0x000000013F4F0000-0x000000013F841000-memory.dmp

    Filesize

    3.3MB

  • memory/2720-146-0x000000013F090000-0x000000013F3E1000-memory.dmp

    Filesize

    3.3MB

  • memory/2780-152-0x000000013F090000-0x000000013F3E1000-memory.dmp

    Filesize

    3.3MB

  • memory/2784-244-0x000000013F2F0000-0x000000013F641000-memory.dmp

    Filesize

    3.3MB

  • memory/2784-78-0x000000013F2F0000-0x000000013F641000-memory.dmp

    Filesize

    3.3MB

  • memory/2784-131-0x000000013F2F0000-0x000000013F641000-memory.dmp

    Filesize

    3.3MB

  • memory/2788-150-0x000000013F300000-0x000000013F651000-memory.dmp

    Filesize

    3.3MB

  • memory/2796-234-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

    Filesize

    3.3MB

  • memory/2796-96-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

    Filesize

    3.3MB

  • memory/2804-238-0x000000013F100000-0x000000013F451000-memory.dmp

    Filesize

    3.3MB

  • memory/2804-75-0x000000013F100000-0x000000013F451000-memory.dmp

    Filesize

    3.3MB

  • memory/2840-148-0x000000013F1B0000-0x000000013F501000-memory.dmp

    Filesize

    3.3MB

  • memory/2856-240-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

    Filesize

    3.3MB

  • memory/2856-70-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

    Filesize

    3.3MB