Analysis

  • max time kernel
    236s
  • max time network
    237s
  • platform
    windows10-1703_x64
  • resource
    win10-20220722-en
  • resource tags

    arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-08-2022 15:40

General

  • Target

    svcsc.exe

  • Size

    1.7MB

  • MD5

    5f9806abe45fb86779adc3813f97058a

  • SHA1

    706c9eef39ed093b20af1554c934858993b6b57a

  • SHA256

    f9d595fb503dd18335c9ee9bad24e3760c2456d7df20c49c0bbba719c84882e2

  • SHA512

    e28da798cb9406bfd636074896d5f61f6d6dc972c241d0afb701ac527563e348257d171c072af09a58ec3d390e1cc7dc2660ecf744fc0d28d76ac666c754cd21

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs 12 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\svcsc.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\34C.exe
      "C:\Users\Admin\AppData\Local\Temp\34C.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\wklopsvcs.exe
        C:\Windows\wklopsvcs.exe
        3⤵
        • Windows security bypass
        • Executes dropped EXE
        • Windows security modification
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Users\Admin\AppData\Local\Temp\107459623.exe
          C:\Users\Admin\AppData\Local\Temp\107459623.exe
          4⤵
          • Executes dropped EXE
          PID:4168
        • C:\Users\Admin\AppData\Local\Temp\867831972.exe
          C:\Users\Admin\AppData\Local\Temp\867831972.exe
          4⤵
          • Executes dropped EXE
          PID:3932
        • C:\Users\Admin\AppData\Local\Temp\656425582.exe
          C:\Users\Admin\AppData\Local\Temp\656425582.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\wcdsemgr.exe
            C:\Windows\wcdsemgr.exe
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Suspicious use of WriteProcessMemory
            PID:1152
            • C:\Users\Admin\AppData\Local\Temp\183073611.exe
              C:\Users\Admin\AppData\Local\Temp\183073611.exe
              6⤵
              • Executes dropped EXE
              PID:2688
            • C:\Users\Admin\AppData\Local\Temp\2951923665.exe
              C:\Users\Admin\AppData\Local\Temp\2951923665.exe
              6⤵
              • Executes dropped EXE
              PID:4956
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\svcsc.xls"
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:3976
      • C:\Users\Admin\AppData\Roaming\RAC\mls.exe
        "C:\Users\Admin\AppData\Roaming\RAC\mls.exe" -s
        2⤵
        • Executes dropped EXE
        PID:4752
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 512
          3⤵
          • Program crash
          PID:4624

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ABGWTCK\2[1]

      Filesize

      9KB

      MD5

      573584190b9ae1f05e0b40591df933c4

      SHA1

      412fe72d4eb447ac1744bea4a35360703b1fb110

      SHA256

      85348184c11fe6ea7866ab07f01a7acdd189b0c349b2775f1d28f188b45fa074

      SHA512

      cc33f657047478259fb4ff1d610b9e8adf55744aa4a0a015413cf2747b11992c4d2d5df9d449690c1d28d905e92e93f2b915edf51e8361973018b17bfad496d4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RKA4D8SW\3[1]

      Filesize

      6KB

      MD5

      9e2f163c15ee457be1f51981985570a1

      SHA1

      4a191e6da4a85b915f285e758d0789d2ede3aff1

      SHA256

      c7de55ddd548f4f268979e1f0c70ab0edb2566c0ce46b921ea281e1570abad82

      SHA512

      4b3eae4a1df79ac8805f46d32daecdb54028d160a5056679d4478c08e7f8ff42df5f84f4b1fe2cb8b5f3574eae5b18a94ad865edfc4d314a51118316c907967d

    • C:\Users\Admin\AppData\Local\Temp\107459623.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\107459623.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\183073611.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\183073611.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\2951923665.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\2951923665.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\34C.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • C:\Users\Admin\AppData\Local\Temp\34C.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • C:\Users\Admin\AppData\Local\Temp\656425582.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Users\Admin\AppData\Local\Temp\656425582.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Users\Admin\AppData\Local\Temp\867831972.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\867831972.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\svcsc.xls

      Filesize

      172KB

      MD5

      c0a83d190005139498523c1e5cf2ab97

      SHA1

      f503561162f978cd2f6c93545e3c2183cffed4e3

      SHA256

      f5e4987ef8efe10a55440451365a57b41b8c736f4403ee1ce792680f5b94bf21

      SHA512

      bd0930b0b76ea10ff8082d3a5e81ab851e683253caaee5ae9f7b76de0964f15e5e67d0262627dcaf7833a64b87e22e9c0bb8b102cc84ce7c5b33894663b0d3e5

    • C:\Users\Admin\AppData\Roaming\RAC\mls.exe

      Filesize

      1.6MB

      MD5

      6740d8a7b536b412240ea4a8b4c790eb

      SHA1

      6b9a10f5c24551e93e658c1d917828491f2069e2

      SHA256

      d0613d47a3891dc74fc7f8f03046625a25cec35348911f4cfbde7e2bd607f6b3

      SHA512

      e254b2911fb028b85a300261776721a95045534bfa035e8e96db4c1182a5bd78af4552bce18e73b0de2cecacbe6cea726b817323994f2a24620d4c87a77c82b0

    • C:\Users\Admin\AppData\Roaming\RAC\mls.exe

      Filesize

      1.6MB

      MD5

      6740d8a7b536b412240ea4a8b4c790eb

      SHA1

      6b9a10f5c24551e93e658c1d917828491f2069e2

      SHA256

      d0613d47a3891dc74fc7f8f03046625a25cec35348911f4cfbde7e2bd607f6b3

      SHA512

      e254b2911fb028b85a300261776721a95045534bfa035e8e96db4c1182a5bd78af4552bce18e73b0de2cecacbe6cea726b817323994f2a24620d4c87a77c82b0

    • C:\Users\Admin\tncmds.dat

      Filesize

      292B

      MD5

      07872b17cfd93a2792bd0b17f5c07002

      SHA1

      7de2ee0b5255ecc6720fb91cae5e51af20a0e4c5

      SHA256

      44a3fbe34f99b539d55342fc99c33a9d5c6da95bfc765d94c47eb64ecbdbede0

      SHA512

      f6c519a48afd92a1eee0f6e4efdf9f0c0cd6104e7edae202aee33d1d8036be3be681032383c0b36fd1ca71ae53600d55b05bb736410f905de06b0f5364d64d37

    • C:\Users\Admin\tnnodes.dat

      Filesize

      4KB

      MD5

      9955ae60a2ed7c794f36ff509c57bd9d

      SHA1

      26e4da53f46c9d3f94498c6ab3d277ddf37d441a

      SHA256

      49a160e5d636d06ebc3a6a69b522fe1eed1a71c9dff50079d2adbfde4b16fa6b

      SHA512

      352d55485153d53a830c470787110755bc17d84cd273e6262193431dbff6e03d2be22cdf2dff6fcb5c95c6eff0536442943e41fb3e02a6c28f2b5f49619a3cc7

    • C:\Windows\wcdsemgr.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Windows\wcdsemgr.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Windows\wklopsvcs.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • C:\Windows\wklopsvcs.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • memory/1152-629-0x0000000000000000-mapping.dmp

    • memory/2256-175-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-143-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-153-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-154-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-155-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-156-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-157-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-158-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-159-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-160-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-161-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-163-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-162-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-164-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-165-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-166-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-167-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-168-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-169-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-170-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-171-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-172-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-173-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-174-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-127-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-176-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-177-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-178-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-151-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-128-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-129-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-130-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-183-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-131-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-132-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-133-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-134-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-135-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-150-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-136-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-137-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-139-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-138-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-140-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-141-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-149-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-148-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-142-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-152-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-147-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-146-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-145-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2256-144-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/2688-680-0x0000000000000000-mapping.dmp

    • memory/3624-186-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-187-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-190-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-179-0x0000000000000000-mapping.dmp

    • memory/3624-188-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-181-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-182-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-193-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-192-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-191-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-184-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3624-185-0x0000000076F10000-0x000000007709E000-memory.dmp

      Filesize

      1.6MB

    • memory/3784-248-0x0000000000000000-mapping.dmp

    • memory/3784-295-0x00007FFD80790000-0x00007FFD807A0000-memory.dmp

      Filesize

      64KB

    • memory/3932-537-0x0000000000000000-mapping.dmp

    • memory/3976-486-0x0000000000000000-mapping.dmp

    • memory/4168-497-0x0000000000000000-mapping.dmp

    • memory/4332-297-0x0000000000000000-mapping.dmp

    • memory/4752-255-0x0000000000000000-mapping.dmp

    • memory/4872-588-0x0000000000000000-mapping.dmp

    • memory/4956-723-0x0000000000000000-mapping.dmp