Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 18:41

General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.29310.exe

  • Size

    1.6MB

  • MD5

    3d1072986b88dc6184e40ba0df6acfc2

  • SHA1

    3dced4443af3c9591c948c827ac5b02bd0d31029

  • SHA256

    8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5

  • SHA512

    6b072f7e1b617a1426faeffdc14b80259f2601f29f5df65953694917cfa9611379976424ec37ffe3d139f5abd1bff02146d968f6a47d96d57ab4de1bb32a626b

  • SSDEEP

    24576:rPKokfY5HGAg4y2oLeeHlQFwSohxt3jIwYg94ZIgUZ8K5BEuww4sXpA5jp9DTS2I:LZWY5mz4yJSfu/9IwYgeJuw7sX0jpd

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe"
      2⤵
        PID:3836
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe"
        2⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1512
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:4124
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:2064
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:2736
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2116
      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2076
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:2652
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1872
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3224
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:3372
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:2068
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        PID:2240
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:1804
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4788
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:1116
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4212
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:4620
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3640
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:3180
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2788
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:1468
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4380
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:2080
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1700
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:884
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:1384

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                Filesize

                2.1MB

                MD5

                dc5df84f2f341eb756d52d416c25672a

                SHA1

                9b68322b63fbef5c3607b085e3f6c4042bbecb26

                SHA256

                d6851c67c09a02a54950f830ba3675987038db63f9b0325ae9618c6e77404f67

                SHA512

                70ea351aff6fdaac102865c68d837b2bcb0c849bc48cbc9125aa1d702b158f7835723a028ea5d9e53627711d416ade14d73033b35ff46ab225c618b8849515f2

              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                Filesize

                1.4MB

                MD5

                46ba2c464cf5e7a9c60bb2ff5a5354e6

                SHA1

                8eccf7799a6200fc6af615cc3db1cf7a578cc054

                SHA256

                60c41130b4eae500234d0f1d828a0dce08ade62262ce53a8a69a9bda0cb22493

                SHA512

                859ab843246002203c4438988c28f8c8162692dbaf46b090ee1ea12b73f1e96f41bb9095446e3c859e0d11dbafca4f12f64e217ed29b5caf2c3b4bff7fa22b1a

              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                Filesize

                1.5MB

                MD5

                dcd7a67e87e6114edb1085865f8d775e

                SHA1

                b2a7ab3b3f236a138a3a758030c88d3af29f79d7

                SHA256

                ded42d6e4d800c011b58177d521749c872cc9ed61c953cb8c54204d126afbd82

                SHA512

                9b80cbb087e4cec9a139de25396d8939c6c08038a933630dac220a0a8c2052a79ea3906725774d7770ab172156ea752516bee655ae4ef8847e565fd54232ca8c

              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                Filesize

                2.1MB

                MD5

                acdde84eb61d05ad9eb142c3cd045839

                SHA1

                93424013eaacb4b915dc18f1fc39d9ce1dda6fd7

                SHA256

                4bbc019b0a65e7703ae85360148bdd39d5347c79fbc1516d0c3696c61cc174ea

                SHA512

                ee2b8a4f38f599c439158157601e88727d89401ef58d2fe9a31547f5e43b607f89dcebf6a7e45a51be2bc14db6e95f35b819f361362704323dc2fdf0cdc92171

              • C:\Windows\SysWOW64\perfhost.exe

                Filesize

                1.2MB

                MD5

                813db0b56035ec0a4cf3887d71d2c4aa

                SHA1

                f03217e425ebaee33cf9be638b8c83755733bd47

                SHA256

                22669a2a26859389a1339b872c3a64c45f05e0e621b7691de49c583a0f3cb3f8

                SHA512

                93d97485946fd5c6e50c46ba75573f65b89825eb7e218050fd2d6b71fcf483deda2465c13a5c9e861a8af4fc01ba0a0495ea3572768bff1473c960012f5771ca

              • C:\Windows\System32\AgentService.exe

                Filesize

                1.7MB

                MD5

                f04bed6f8a5f80ae129fcb931b0d02b1

                SHA1

                8b3e57fac5981828bd626a81ed372c16d553bbc9

                SHA256

                36ca5f14dfe5022ade2470c0b0eb64da9e9a0e3b814f4da498f2d60a0dff41ca

                SHA512

                cefe6eb98308ae6a9961ee4061c104f73577d0668d42e80e3f58e348ae49b96a1f42398f07ac54618a66e0f2e13eb9d09cb4f52058010258af929265865ffd4c

              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                Filesize

                1.3MB

                MD5

                c91b32313dd84831e1db3e202c19d981

                SHA1

                7054bc8bad75c962799e6a3a1be3484753f9daca

                SHA256

                2749778929d83eb80d6f03b26949f7c5c25628ac66c64c2f7f38c7bd556aa310

                SHA512

                4b499ca1557f5f09ee96e743a90158c7742457f260522461e15f56b47c0e7a8fedc729f2d95c4ddccae3971fbc0493f1fb3e65b2de170ef5ff7e5ffc3624a396

              • C:\Windows\System32\FXSSVC.exe

                Filesize

                1.2MB

                MD5

                a9cdea84dc5a3324d8e4ced1ca4c188d

                SHA1

                21d368d833d92acb896d82a041088514e5f617b4

                SHA256

                7754a1f068cc9ffffd930958581b46eacf5445126bad043cd7f564aa54f266cb

                SHA512

                93c7931a39cb5d773be7167b58f3d93eff58bddd920f8a840f5547810ec4898bc45d74e5be7d7da2d18e06e92a1728cad7870ed036bcde29e803a84181d50162

              • C:\Windows\System32\Locator.exe

                Filesize

                1.2MB

                MD5

                5a3e3ef62dec5c4fe3ae8bffa321fb75

                SHA1

                aeb3d5fc948c444ebf7aeadfdc2d3ad356cb877c

                SHA256

                b5a644fbcaa08d29784db4eaf710fe8622d6f976327ae9fe24ea6c90f1ad468e

                SHA512

                e155d1cb8313acc0e56cfecc62c71380688dc75d9f80df949c02b7e97e8139f2c5322cc9040a0dceaecfa87b0b421aa91589dc2d83421335cdbbcb4a977b8231

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                1.6MB

                MD5

                5c868867266cc26eb10fb6a7ce2e7dba

                SHA1

                339b005d80b5281b57008ec283b0b084aebf65cc

                SHA256

                75b90f127d00b5e51fbc5c862adc1c97b215d8995fd4b6717913bca2d99b7d73

                SHA512

                5a2648854c5fdf6b64d25e0638fc4202f7f78fa9eec11abf3e1ddc2d7ecba806e7f69d8c4176c08bd440578fc39a8930f6a0b74e720b7d2b8834c4f410fd6b75

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                1.6MB

                MD5

                5c868867266cc26eb10fb6a7ce2e7dba

                SHA1

                339b005d80b5281b57008ec283b0b084aebf65cc

                SHA256

                75b90f127d00b5e51fbc5c862adc1c97b215d8995fd4b6717913bca2d99b7d73

                SHA512

                5a2648854c5fdf6b64d25e0638fc4202f7f78fa9eec11abf3e1ddc2d7ecba806e7f69d8c4176c08bd440578fc39a8930f6a0b74e720b7d2b8834c4f410fd6b75

              • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                Filesize

                1.3MB

                MD5

                6901c175e4321d9f7b8f3bb1f2d3aa09

                SHA1

                f8b43ac67148c876d10755b51a4f8c942fabe843

                SHA256

                42db4986f57d66941b2fcaed7615ce114555b83f95607334210eb49514001915

                SHA512

                20a5ed020d8c9749a42c8a0604094bf9fbd3625f162d53ec6efb9368e1b24a5ca172176f4cfb434b55ec40ea0988e8453e7d0ddde86e5f606ab79375ed0ea85c

              • C:\Windows\System32\SearchIndexer.exe

                Filesize

                1.4MB

                MD5

                49f397e2edb5f439bd27e54fd2937b56

                SHA1

                7ace2b64cc6f0d821efe73354883410002b622d9

                SHA256

                c9762fe7afbcdd9ce841b2c898f42ad0ceb4c3d965a82405f8ddc458c20f8ac0

                SHA512

                9c93508bc0976388949df5524e90b7ab46939b35ee746cb011b2f00400da79276b80043780bf01aef5e6fc8fa9613f22e4c2b12919668d38310d740e372a2d0c

              • C:\Windows\System32\SensorDataService.exe

                Filesize

                1.8MB

                MD5

                43ffc36193e6ac79623905110158fc27

                SHA1

                ef71d136c676e635c0d9bc34c84f2fa34e2ff17e

                SHA256

                87348a239d0c9168c9743ebb88cdbc1e5097d235d9e8de1f52ffc05bfde1fe7a

                SHA512

                b505f3dd4573cac85803fe96962c0f688018519a2fda0ca053ae33d8c689bdfb1ba11ccb7f98072598911d46a21f882e9dd29bfdf28f26c8bf8e7b554d017bb1

              • C:\Windows\System32\Spectrum.exe

                Filesize

                1.4MB

                MD5

                b19a459f67badaae998ea140d2ee7724

                SHA1

                d84b67becb4c88c48f571a381bd562a885848730

                SHA256

                28c841d2f0f7c5934e1bb393eb567e40603ba3d3f8fbf619ed366c1e6917e298

                SHA512

                795471348df8470d5f3b82a257148d22f6f636d35bda514d46447698ca235c3e75d0f3d6d8b41cd2f8e5c316a0b0d14fce04c66ba4b9dc542caf8e650eb7e6e0

              • C:\Windows\System32\TieringEngineService.exe

                Filesize

                1.5MB

                MD5

                88c0a7ab684b302ffe4f68e3e37c4a98

                SHA1

                9f58e001e784688c133f6b01ddc10483b836e638

                SHA256

                82e3980e006350bc21aa661e10b7b3d408c3716c1e7f6cf1526d30a75a33e634

                SHA512

                93ac6534dfd26610be00ff2e3e9a4dbd4d95ef90b756d3ba09a91da2346a9fd8b65af759b1d86a4bc9977af5d30673d71c1911637bab8b78aa7c223785ff550b

              • C:\Windows\System32\VSSVC.exe

                Filesize

                2.0MB

                MD5

                7e9e01f89238a68ec01091596c3afa94

                SHA1

                da02e0f7bc82f2317645ca99dbe0fd3b6a5c662e

                SHA256

                76376566c4f9be99426f51a917026e91d9265c4374286e479a401f39aaa497b2

                SHA512

                f7fa59f530ad48f1f241367891e5ea72c96dd01693322b696cdaee874e09215681320a056a18e31dd6cddd5076ece7970fe3faae0e38c350486608a4d6365011

              • C:\Windows\System32\alg.exe

                Filesize

                1.3MB

                MD5

                8de42f360007fa54844332e98e1d2174

                SHA1

                865842e7529f061927d569aaf296480362eafabd

                SHA256

                b1e1d1d882cf2f8dbf72f1d6ab88f661783b4801059d9abc042f9e4ade34575d

                SHA512

                faff873be993e5a21798fdb1ef649c343aee0191c44ab19f8848526835772f1d9865153acc73f90cf36dff9c02b429426f2f1506767da44389414b7d1550a5c5

              • C:\Windows\System32\msdtc.exe

                Filesize

                1.4MB

                MD5

                70d36ad73bfcec14501dc8c1b837b968

                SHA1

                c40f479d7a465bd0b2f06ba297876e919d719f8b

                SHA256

                86541463f910d70fef8caae5037644b8b7bbf62234cab589f3c62e8d0c19eda4

                SHA512

                ec2d0de054a8829fd0b6ccb6b629695307622d0bc397a1b73211855c4ef720e497b4c42898077878f787bc56fc869aa564411cb09eca7469bea22c54e83d4558

              • C:\Windows\System32\snmptrap.exe

                Filesize

                1.2MB

                MD5

                942e32bb98fc2ea47af51d8433b4ad53

                SHA1

                001c21c4f8463c55e4985bd19423fb0a2a7e07ac

                SHA256

                477bcae3a98f347780b0d5d855b5f0ba1969a97fd83cca5b5a54fa8dba1493ff

                SHA512

                605a64ac7f48871972e137a4c90319d1c61a73b8d5d58f47f703adc85340f409076fa1267ef73ef4b5589563cb2ae637f7a7880c45b75e7acdb9bdef42c0d3c6

              • C:\Windows\System32\vds.exe

                Filesize

                1.3MB

                MD5

                936cf284c123b180a42f427262865120

                SHA1

                7f1b41770f01c1f2de6fcb96a61d96e08a708f56

                SHA256

                34065d621bb33cdec51b365eb30510d3efe81d07b078bfd389699badd060a297

                SHA512

                d47ebcf1c88ddefbbadc9563317da8a1808b8a2bb4490fc06f205ab963f4542da308593f0e58ad694f2f066b4f7a9f4d5183fe72f727e8c8efe5a00701b59e7b

              • C:\Windows\System32\wbem\WmiApSrv.exe

                Filesize

                1.4MB

                MD5

                c1210b42987151dcc4158dff83fb5f0b

                SHA1

                c23a3240345f492d6adc5f0f2e01a7a8de6c0315

                SHA256

                a139d3a7db4d5b769b89e5cfa50bf1faac2a41795a05a38cbd6277442832bd9c

                SHA512

                5e9c338fc8195ff57696dc13e442f45a48800e14472d43af331a7f4c2f63cca482ba5f6075d97d9b0cffe6c3e64ff66b1bdc49361ae2a7145f4678a4c48e755b

              • C:\Windows\System32\wbengine.exe

                Filesize

                2.1MB

                MD5

                73e1c3ee65d2393db9a1d175b6d71233

                SHA1

                d23d9cf10e227eae506e32fcc89e0c09d6515428

                SHA256

                fb3102739989f9e818275a3f91748bd96b2275c01ea00dadb87d36bd50a7588c

                SHA512

                1aa51c38fb52df4805cc0d580c9f52d96ba95516d79e57771d2324d72ce802ea19cb73a1ef77ca0c4bef27f1dc937065f40b5b4be3cea74d0a66d15adb6457d4

              • memory/1116-312-0x0000000140000000-0x00000001401ED000-memory.dmp

                Filesize

                1.9MB

              • memory/1384-657-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-729-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-654-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-650-0x00000205440E0000-0x00000205440E1000-memory.dmp

                Filesize

                4KB

              • memory/1384-644-0x00000205440D0000-0x00000205440E0000-memory.dmp

                Filesize

                64KB

              • memory/1384-656-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-658-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-659-0x0000020544200000-0x0000020544210000-memory.dmp

                Filesize

                64KB

              • memory/1384-676-0x0000020544200000-0x0000020544202000-memory.dmp

                Filesize

                8KB

              • memory/1384-728-0x00000205440E0000-0x00000205440E1000-memory.dmp

                Filesize

                4KB

              • memory/1384-734-0x0000020544200000-0x0000020544210000-memory.dmp

                Filesize

                64KB

              • memory/1384-733-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-732-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-731-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-730-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1384-655-0x0000020544100000-0x0000020544200000-memory.dmp

                Filesize

                1024KB

              • memory/1468-384-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/1512-140-0x0000000000400000-0x000000000065B000-memory.dmp

                Filesize

                2.4MB

              • memory/1512-143-0x0000000000400000-0x000000000065B000-memory.dmp

                Filesize

                2.4MB

              • memory/1512-144-0x0000000001340000-0x00000000013A6000-memory.dmp

                Filesize

                408KB

              • memory/1512-149-0x0000000001340000-0x00000000013A6000-memory.dmp

                Filesize

                408KB

              • memory/1512-380-0x0000000000400000-0x000000000065B000-memory.dmp

                Filesize

                2.4MB

              • memory/1512-154-0x0000000000400000-0x000000000065B000-memory.dmp

                Filesize

                2.4MB

              • memory/1700-581-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/1700-408-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/1804-290-0x0000000140000000-0x00000001401EC000-memory.dmp

                Filesize

                1.9MB

              • memory/1872-222-0x0000000140000000-0x0000000140221000-memory.dmp

                Filesize

                2.1MB

              • memory/1872-229-0x0000000140000000-0x0000000140221000-memory.dmp

                Filesize

                2.1MB

              • memory/1872-226-0x0000000000D10000-0x0000000000D70000-memory.dmp

                Filesize

                384KB

              • memory/1872-223-0x0000000000D10000-0x0000000000D70000-memory.dmp

                Filesize

                384KB

              • memory/1872-215-0x0000000000D10000-0x0000000000D70000-memory.dmp

                Filesize

                384KB

              • memory/1884-386-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/1884-576-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/2064-179-0x0000000140000000-0x0000000140200000-memory.dmp

                Filesize

                2.0MB

              • memory/2064-175-0x00000000006F0000-0x0000000000750000-memory.dmp

                Filesize

                384KB

              • memory/2064-169-0x00000000006F0000-0x0000000000750000-memory.dmp

                Filesize

                384KB

              • memory/2068-269-0x0000000140000000-0x0000000140202000-memory.dmp

                Filesize

                2.0MB

              • memory/2076-436-0x0000000140000000-0x0000000140237000-memory.dmp

                Filesize

                2.2MB

              • memory/2076-201-0x0000000000E40000-0x0000000000EA0000-memory.dmp

                Filesize

                384KB

              • memory/2076-196-0x0000000140000000-0x0000000140237000-memory.dmp

                Filesize

                2.2MB

              • memory/2076-194-0x0000000000E40000-0x0000000000EA0000-memory.dmp

                Filesize

                384KB

              • memory/2080-580-0x0000000140000000-0x000000014021D000-memory.dmp

                Filesize

                2.1MB

              • memory/2080-406-0x0000000140000000-0x000000014021D000-memory.dmp

                Filesize

                2.1MB

              • memory/2116-187-0x0000000000E60000-0x0000000000EC0000-memory.dmp

                Filesize

                384KB

              • memory/2116-189-0x0000000000E60000-0x0000000000EC0000-memory.dmp

                Filesize

                384KB

              • memory/2116-192-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

              • memory/2116-181-0x0000000000E60000-0x0000000000EC0000-memory.dmp

                Filesize

                384KB

              • memory/2240-511-0x0000000000400000-0x00000000005EE000-memory.dmp

                Filesize

                1.9MB

              • memory/2240-271-0x0000000000400000-0x00000000005EE000-memory.dmp

                Filesize

                1.9MB

              • memory/2348-138-0x0000000004B70000-0x0000000004B80000-memory.dmp

                Filesize

                64KB

              • memory/2348-135-0x0000000004C00000-0x0000000004C92000-memory.dmp

                Filesize

                584KB

              • memory/2348-133-0x0000000000080000-0x000000000021A000-memory.dmp

                Filesize

                1.6MB

              • memory/2348-136-0x0000000004B70000-0x0000000004B80000-memory.dmp

                Filesize

                64KB

              • memory/2348-137-0x0000000005010000-0x000000000501A000-memory.dmp

                Filesize

                40KB

              • memory/2348-134-0x00000000051B0000-0x0000000005754000-memory.dmp

                Filesize

                5.6MB

              • memory/2348-139-0x0000000008880000-0x000000000891C000-memory.dmp

                Filesize

                624KB

              • memory/2652-462-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/2652-211-0x0000000000190000-0x00000000001F0000-memory.dmp

                Filesize

                384KB

              • memory/2652-220-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/2652-205-0x0000000000190000-0x00000000001F0000-memory.dmp

                Filesize

                384KB

              • memory/2788-356-0x0000000140000000-0x00000001401C0000-memory.dmp

                Filesize

                1.8MB

              • memory/3180-357-0x0000000140000000-0x0000000140239000-memory.dmp

                Filesize

                2.2MB

              • memory/3224-240-0x0000000140000000-0x0000000140210000-memory.dmp

                Filesize

                2.1MB

              • memory/3372-267-0x0000000140000000-0x0000000140226000-memory.dmp

                Filesize

                2.1MB

              • memory/4124-163-0x0000000000710000-0x0000000000770000-memory.dmp

                Filesize

                384KB

              • memory/4124-178-0x0000000140000000-0x0000000140201000-memory.dmp

                Filesize

                2.0MB

              • memory/4124-157-0x0000000000710000-0x0000000000770000-memory.dmp

                Filesize

                384KB

              • memory/4212-314-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/4212-536-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/4380-577-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/4380-389-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/4620-333-0x0000000140000000-0x0000000140259000-memory.dmp

                Filesize

                2.3MB

              • memory/4788-293-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4788-508-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB