Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 18:41

General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.29310.exe

  • Size

    1.6MB

  • MD5

    3d1072986b88dc6184e40ba0df6acfc2

  • SHA1

    3dced4443af3c9591c948c827ac5b02bd0d31029

  • SHA256

    8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5

  • SHA512

    6b072f7e1b617a1426faeffdc14b80259f2601f29f5df65953694917cfa9611379976424ec37ffe3d139f5abd1bff02146d968f6a47d96d57ab4de1bb32a626b

  • SSDEEP

    24576:rPKokfY5HGAg4y2oLeeHlQFwSohxt3jIwYg94ZIgUZ8K5BEuww4sXpA5jp9DTS2I:LZWY5mz4yJSfu/9IwYgeJuw7sX0jpd

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.29310.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2828
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1500
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1104
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4852
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3196
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4788
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4440
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1516
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4380
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4620
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3420
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1768
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:220
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2344
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3424
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:5036
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3720
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1128
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2068
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2736
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3976
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:740
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3308

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

              Filesize

              2.1MB

              MD5

              f0cd556e7fdd5a7b20d073c5dcec49bb

              SHA1

              b0aea6e522a1b3a93e3da70ab97e6eb0623d4f0e

              SHA256

              179a952f36bab453b782d2082795c08f760a3d540cb9d9a8725a10054f9d69f0

              SHA512

              beb358e4006e388392b8eea5bca398f4a03be243c63a94f70890d6a284775b1f817677a2e46e9ba9554997a73e6b879d709a76248b96d7d90e10926cbb967bfb

            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

              Filesize

              1.4MB

              MD5

              70e8c2578e700d6ee1c0b1f0f716da22

              SHA1

              bd1b5177ed6bfa988be24cbb9052b52d964bd9c0

              SHA256

              7cb70ced9587af307cc958cbf648c8684d60d6ac58c981b63a46efef8477ff72

              SHA512

              bc1d6f7f5edbb6b9c00ad89dd1e124c9f03f4f164c8e847710bc421b9dfd9b53f26ea25aa160cb63c9ddb8acada5a6c79ff0d332b25dd487f1a2a623f8670fa0

            • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

              Filesize

              1.5MB

              MD5

              447251acb48b5f8a1c9224f69434d070

              SHA1

              f63619f3665e89a3e87f4cd83cdb7a0553b5a1b0

              SHA256

              6869dcb707c8fcf70986e8e4ff6fc6c1e033c49de0b2b1397ce8234e0d393308

              SHA512

              f683eaabba30de91ca491e890414f40de4c6d398f6e11b085c74c45e5a1164ecd3fd7a6a8a7b8d683e3ebbd22702b22870b6b7f43befe328ce6def1a8b05f263

            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

              Filesize

              2.1MB

              MD5

              c9740e060c740c8a9b756d998cd34481

              SHA1

              69955a48d7c5698a4a5b475320621599b52f70c5

              SHA256

              625492947cd057e53bee6736a060eb39225ab542a833109f2eaa5e6fca6ae210

              SHA512

              9eb6b2034b95ca94170bb227eec16b62a3b88c7e32c77db57ce3c20db474dd788687629ae83e3a5686a260d4cb5ae7a7a0b718be5d90b2fa4c92cfd907bae83f

            • C:\Windows\SysWOW64\perfhost.exe

              Filesize

              1.2MB

              MD5

              755beae15fd9e72a7af70367bb37c736

              SHA1

              10603ed3ac8da3eb0115d86936d153e275e22bbd

              SHA256

              3d654970e53604a5ee5b66f2746f0ee5c836ddc3b11a26f208d4e4a87a735590

              SHA512

              5333e3cfcf4445ff3059212a2e84388ff15f02e4749097562397361c558e5d6eb73c6962d128ff2e377c3efca8ac59d0f859892345c6e967320930630b38de26

            • C:\Windows\System32\AgentService.exe

              Filesize

              1.7MB

              MD5

              c79474b28224276444844f3c7235112f

              SHA1

              c5efeb17d7c95093aeb7549a6be23ebb16d0962a

              SHA256

              50251a2a85e0d7889d22544e7852e5e5b0a8a8b1170f7581e986a06a98265048

              SHA512

              24379701d910ea67019b46c88734b08bd78cea96a79f404edb403509b4f5003c5c9197abbf60c3885773b2d4f04c999da2376ee7ebc01b40cb4e32499229ab89

            • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

              Filesize

              1.3MB

              MD5

              3a379e6c34ea5537bf5c5cb4ab478e9b

              SHA1

              0d85420ecb315b42e4d1d183f6711cb105f60f78

              SHA256

              81f924e439027dcd0eb9bfaca55466fd25321b37710f880559d8757d3251fb0f

              SHA512

              c0471bbc12459baf0511c9ebece5f10fa49b1a3da12a12825f413226cb5d4d6ca109a9626c36de26bf1863650d32d7265d056f6fdbb5976bf6f19da3e7a33ecc

            • C:\Windows\System32\FXSSVC.exe

              Filesize

              1.2MB

              MD5

              411cef66dd788f4fa6b02ad7b7fb7c24

              SHA1

              244f38dbfeed501a61293b29f35e51a64b3d2199

              SHA256

              bac01a93aa604d97a00c3b51e04f63067ea3aa9a0b83026a8a0c5e285436c107

              SHA512

              247b3657c96ae66e76468b6412b5fcab6ff104ebd55dd2b7dcf80488af2a08845d4574f2d537e94dd5ba311724a458fd2c97dea93a95173ab9d5c4412e7e9d86

            • C:\Windows\System32\Locator.exe

              Filesize

              1.2MB

              MD5

              9f427d923795f1a280c39985f6c09273

              SHA1

              5b7b3a46ddf15f52bd4256aa6bd9b6797e2a9fb3

              SHA256

              04bad6630f0be5c47501761c8458e195440b6b1af6f266b2d8b9dab76f12ef72

              SHA512

              1fd5828c6ed5dadfcac3e92aa022ffaf8902aa44f08efcdc5d96228b5c268d3242bbf236f9c9a2db36a28fedbebd6cb7a363dd67d82edb4ef6cc3e3767702978

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              1.6MB

              MD5

              eb3815cc7b7d46341142d711eaa9f261

              SHA1

              bf4263be971ae7ca3827cc55a3ed770b17993f09

              SHA256

              697e3741563ba23be5173c7bad6167432d8ff0535fa5e943ab4954a27ed10113

              SHA512

              b17b252eb245ef78da15a8a3f74baca99debd6c40b3438eae37102e3c2660ad6767b8fcc39f1516e684913842faf633ad5b35431e69ff6546c839d322879220a

            • C:\Windows\System32\OpenSSH\ssh-agent.exe

              Filesize

              1.6MB

              MD5

              eb3815cc7b7d46341142d711eaa9f261

              SHA1

              bf4263be971ae7ca3827cc55a3ed770b17993f09

              SHA256

              697e3741563ba23be5173c7bad6167432d8ff0535fa5e943ab4954a27ed10113

              SHA512

              b17b252eb245ef78da15a8a3f74baca99debd6c40b3438eae37102e3c2660ad6767b8fcc39f1516e684913842faf633ad5b35431e69ff6546c839d322879220a

            • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

              Filesize

              1.3MB

              MD5

              114ffd6d8d10b8db083720695419fede

              SHA1

              d8d212c3c00bd231d0f3275948aeb5be1d3139bd

              SHA256

              2ce9996beaf5a542b915b5582566786da2234a9ebb54eb57e241d909c54f210b

              SHA512

              7a9af24d850dc4e69cddfde48e41e842e1c878cd43fb10cb79f1f885617488973b5145683a0dfe9eeabdbe7722b06ff3939e3f1523bfe8bd96699f70491b28d0

            • C:\Windows\System32\SearchIndexer.exe

              Filesize

              1.4MB

              MD5

              2910dd93260a068251ae043d67f7e36d

              SHA1

              eada79e768678b999bd12566ad8000126871a2f4

              SHA256

              3b9af1867b7b8797089f4a48f6328074a61cc08f634e45ba6a35e3f84734e1a2

              SHA512

              a24ace88417b8582f80b6d7eaad5329030c7301bc3db9acf0d9bc3021c484717f9ff8bc0cf64b9181bc2befc9354bf0d2299180ce53b08b431758881548ca2e5

            • C:\Windows\System32\SensorDataService.exe

              Filesize

              1.8MB

              MD5

              bdff67b4622034f947be5ddf38fd03de

              SHA1

              cef460de9a90a78eb3af863f72350b289da1c8b2

              SHA256

              ba00dadddd0bb75926ea5ef48e1bde921d6f709252a4f11f26b3141caa467889

              SHA512

              e112e4442f2ef2b33eeb4a60637bd95648c966339207609dbbc2eaa81555a0cf4d24964d6e781dcb2b012398fc49972d052904b4bdf91b2ba7662451e75c936f

            • C:\Windows\System32\Spectrum.exe

              Filesize

              1.4MB

              MD5

              c6066f1b9c3b7cf26c9b20435c2e8f79

              SHA1

              8edf7122f3d00d408e7c133c238316af51877394

              SHA256

              7ae08f3501a5e2ff82ac44d8b29093378f96d487108a0c10ece07744bd76dfa2

              SHA512

              ebb42f593112b2ccd30114f917966719353ec9bd1a52fd39833bcae524ad29c55b1c4393985b958bc301f141db6dfaeb90c6d55802c4d5a27e30d90787f225c1

            • C:\Windows\System32\TieringEngineService.exe

              Filesize

              1.5MB

              MD5

              de279b3938a87f72ca84be6f50609aca

              SHA1

              41fd2211346ff3439f390bae995272a768b4f15c

              SHA256

              586ffad8b3ed1d45f57d0cd8e44987df2dc9b7fa98a8f6feeea617092785af33

              SHA512

              9b68ae6804898255f3ae43a5460b01cbf0385eb6218ed7e8b67c34050ea65125cc8f0e20f8e57f49cc423ae11249e50b8b8c36f8aeaee42fa2ec022229bd4d6d

            • C:\Windows\System32\VSSVC.exe

              Filesize

              2.0MB

              MD5

              80a38f93ea9d9cead175d5e375ae6275

              SHA1

              d05a0dcacf5bb4e67f5f7b58bd59d1f14e8c8b7d

              SHA256

              c745265038fe83be885559619f7ce3d392f5a006bf09b59daf5b9c9566aa71d1

              SHA512

              3d93890dcd7e6ebbcad43ed3c992cfd6488fcea881837dc9408b34841144f46496a06c62632f31fc322672117cee3ec0142f54362aa71a064ef062d45404924e

            • C:\Windows\System32\alg.exe

              Filesize

              1.3MB

              MD5

              f7f8bd615cce378fcdb77b5077797dff

              SHA1

              5bbb33c6a87c242c4cb7e2979693beffe7be3d8a

              SHA256

              3a04dc8e9128491b2050f48ecf2424234477e443438d8314193ae9f90b86bfda

              SHA512

              75feaec5c57b8bcf1b9ce11be0dc927f94e506f7fef1ae86462670a6aed10218f9400176ac9e6c79a7e367ea33c09eb1c272e1ce8369bdbecb40c1eea0e55c52

            • C:\Windows\System32\msdtc.exe

              Filesize

              1.4MB

              MD5

              54e3ba2ffdb2006acf456f3a4fda275a

              SHA1

              17c8c48177cba3d53670d179cf362f61f92f66c4

              SHA256

              ca1aa62b0ef716d2a489676b21505268320f6e0da39af60d87f0091fd266525e

              SHA512

              a570f93f0388369c1b9ff0b266d573de8b82f36d6c757e4d2f2bd946db623aa631e00e4568168032a2c81395a1e9de26df3c9d37055beca0193f1726f3aef6b0

            • C:\Windows\System32\snmptrap.exe

              Filesize

              1.2MB

              MD5

              1cad532b9cee865834dff7c3a00b20a2

              SHA1

              68bd0ea8ba8e8336b32d0cc58cae92d0daa6ae8d

              SHA256

              10a7c24f55fac953ea0103eec02838711f51c9da97196f487e7ff74395a81352

              SHA512

              feaba5c6be953c5dabaad0e7d6822e22b32b226c8041973d10c621f9728dc5af540998827eefd964899af82174b98760d622b9852975c1664ce749fb1b65fa2d

            • C:\Windows\System32\vds.exe

              Filesize

              1.3MB

              MD5

              be35d9b92d07fd2402b747d8d2ba59ea

              SHA1

              bde531673d18bccdc28c4c1b5afe53b760ed5cec

              SHA256

              864cc9d944d33db0b98db8c4ab928ead01c7d7031d858222d3312b9dfdf9d60e

              SHA512

              c2648ca48036ce1ebd7fed5fa5f7292406dedcb62c2882eea5899fb6745824ec59ddb5231caf99bf75b505479547efeb405293288da1ed293f95995a47fa2583

            • C:\Windows\System32\wbem\WmiApSrv.exe

              Filesize

              1.4MB

              MD5

              c0f4dcdc843f998d09d3ad85a98511fa

              SHA1

              3a5bdaa4ba73b2c1a6cc164d72a4901c6c6fcbee

              SHA256

              a0bb924dc7dd8427e13b637bafd10bdb40025cfc9ef4a058db8ecfca392d8786

              SHA512

              9b308f0281a33070c3dd447e53e0cef78b66cdd836a7ae29fb3d2e35b7558d8997a3e21f2b068e6abbd5df86e17c07c523568695273af91ace90b47451b75cfa

            • C:\Windows\System32\wbengine.exe

              Filesize

              2.1MB

              MD5

              5032b5c071f914ec06eff41b50307a09

              SHA1

              ab76bcb8fb9201cf05ee532c075aa5959fa8a323

              SHA256

              2b8136b938528d44c3505b343aca54dfa51dceadd18b68d7105ffc9257e87744

              SHA512

              992812fd9cf2bb103d348c93d5ab8687f92513a7e8395eb1f5b69addbcdaccf7aa3a007c67c7d863cc14d68deae92b3b45e9d778f208b5ff8a9519c99541df9d

            • memory/220-313-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/220-531-0x0000000140000000-0x00000001401D7000-memory.dmp

              Filesize

              1.8MB

            • memory/1104-178-0x0000000140000000-0x0000000140200000-memory.dmp

              Filesize

              2.0MB

            • memory/1104-175-0x00000000006F0000-0x0000000000750000-memory.dmp

              Filesize

              384KB

            • memory/1104-243-0x0000000140000000-0x0000000140200000-memory.dmp

              Filesize

              2.0MB

            • memory/1104-168-0x00000000006F0000-0x0000000000750000-memory.dmp

              Filesize

              384KB

            • memory/1128-593-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/1128-374-0x0000000140000000-0x0000000140147000-memory.dmp

              Filesize

              1.3MB

            • memory/1488-389-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/1488-600-0x0000000140000000-0x0000000140216000-memory.dmp

              Filesize

              2.1MB

            • memory/1500-156-0x0000000000700000-0x0000000000760000-memory.dmp

              Filesize

              384KB

            • memory/1500-162-0x0000000000700000-0x0000000000760000-memory.dmp

              Filesize

              384KB

            • memory/1500-176-0x0000000140000000-0x0000000140201000-memory.dmp

              Filesize

              2.0MB

            • memory/1516-231-0x0000000140000000-0x0000000140210000-memory.dmp

              Filesize

              2.1MB

            • memory/1516-232-0x0000000000860000-0x00000000008C0000-memory.dmp

              Filesize

              384KB

            • memory/1516-248-0x0000000140000000-0x0000000140210000-memory.dmp

              Filesize

              2.1MB

            • memory/1768-292-0x0000000140000000-0x00000001401EC000-memory.dmp

              Filesize

              1.9MB

            • memory/2068-599-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/2068-387-0x0000000140000000-0x00000001401FC000-memory.dmp

              Filesize

              2.0MB

            • memory/2344-315-0x0000000140000000-0x00000001401ED000-memory.dmp

              Filesize

              1.9MB

            • memory/2448-352-0x0000000140000000-0x0000000140239000-memory.dmp

              Filesize

              2.2MB

            • memory/2736-601-0x0000000140000000-0x000000014021D000-memory.dmp

              Filesize

              2.1MB

            • memory/2736-410-0x0000000140000000-0x000000014021D000-memory.dmp

              Filesize

              2.1MB

            • memory/2828-173-0x0000000000400000-0x000000000065B000-memory.dmp

              Filesize

              2.4MB

            • memory/2828-242-0x0000000000400000-0x000000000065B000-memory.dmp

              Filesize

              2.4MB

            • memory/2828-140-0x0000000000400000-0x000000000065B000-memory.dmp

              Filesize

              2.4MB

            • memory/2828-143-0x0000000000400000-0x000000000065B000-memory.dmp

              Filesize

              2.4MB

            • memory/2828-144-0x0000000003570000-0x00000000035D6000-memory.dmp

              Filesize

              408KB

            • memory/2828-149-0x0000000003570000-0x00000000035D6000-memory.dmp

              Filesize

              408KB

            • memory/3196-206-0x0000000140000000-0x0000000140237000-memory.dmp

              Filesize

              2.2MB

            • memory/3196-195-0x00000000004D0000-0x0000000000530000-memory.dmp

              Filesize

              384KB

            • memory/3196-244-0x0000000140000000-0x0000000140237000-memory.dmp

              Filesize

              2.2MB

            • memory/3196-201-0x00000000004D0000-0x0000000000530000-memory.dmp

              Filesize

              384KB

            • memory/3308-713-0x000002E471E80000-0x000002E471E90000-memory.dmp

              Filesize

              64KB

            • memory/3308-660-0x000002E471E60000-0x000002E471E70000-memory.dmp

              Filesize

              64KB

            • memory/3308-662-0x000002E471E80000-0x000002E471E81000-memory.dmp

              Filesize

              4KB

            • memory/3308-661-0x000002E471E80000-0x000002E471E90000-memory.dmp

              Filesize

              64KB

            • memory/3420-291-0x0000000000400000-0x00000000005EE000-memory.dmp

              Filesize

              1.9MB

            • memory/3424-333-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/3424-578-0x0000000140000000-0x0000000140169000-memory.dmp

              Filesize

              1.4MB

            • memory/3976-602-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/3976-411-0x0000000140000000-0x0000000140179000-memory.dmp

              Filesize

              1.5MB

            • memory/4352-138-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

              Filesize

              64KB

            • memory/4352-137-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

              Filesize

              64KB

            • memory/4352-136-0x0000000005B30000-0x0000000005B3A000-memory.dmp

              Filesize

              40KB

            • memory/4352-139-0x0000000009600000-0x000000000969C000-memory.dmp

              Filesize

              624KB

            • memory/4352-135-0x0000000005960000-0x00000000059F2000-memory.dmp

              Filesize

              584KB

            • memory/4352-134-0x0000000005E70000-0x0000000006414000-memory.dmp

              Filesize

              5.6MB

            • memory/4352-133-0x0000000000E10000-0x0000000000FAA000-memory.dmp

              Filesize

              1.6MB

            • memory/4380-372-0x0000000140000000-0x0000000140226000-memory.dmp

              Filesize

              2.1MB

            • memory/4380-247-0x0000000140000000-0x0000000140226000-memory.dmp

              Filesize

              2.1MB

            • memory/4416-355-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/4416-363-0x0000000140000000-0x00000001401C0000-memory.dmp

              Filesize

              1.8MB

            • memory/4440-223-0x0000000002270000-0x00000000022D0000-memory.dmp

              Filesize

              384KB

            • memory/4440-217-0x0000000002270000-0x00000000022D0000-memory.dmp

              Filesize

              384KB

            • memory/4440-226-0x0000000002270000-0x00000000022D0000-memory.dmp

              Filesize

              384KB

            • memory/4440-230-0x0000000140000000-0x0000000140221000-memory.dmp

              Filesize

              2.1MB

            • memory/4620-272-0x0000000140000000-0x0000000140202000-memory.dmp

              Filesize

              2.0MB

            • memory/4788-245-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/4788-213-0x0000000000190000-0x00000000001F0000-memory.dmp

              Filesize

              384KB

            • memory/4788-208-0x0000000140000000-0x000000014022B000-memory.dmp

              Filesize

              2.2MB

            • memory/4788-205-0x0000000000190000-0x00000000001F0000-memory.dmp

              Filesize

              384KB

            • memory/5036-335-0x0000000140000000-0x0000000140259000-memory.dmp

              Filesize

              2.3MB

            • memory/5036-579-0x0000000140000000-0x0000000140259000-memory.dmp

              Filesize

              2.3MB

            • memory/5116-193-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB

            • memory/5116-191-0x0000000000A80000-0x0000000000AE0000-memory.dmp

              Filesize

              384KB

            • memory/5116-188-0x0000000000A80000-0x0000000000AE0000-memory.dmp

              Filesize

              384KB

            • memory/5116-181-0x0000000000A80000-0x0000000000AE0000-memory.dmp

              Filesize

              384KB

            • memory/5116-182-0x0000000140000000-0x0000000140135000-memory.dmp

              Filesize

              1.2MB