Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 12:06

General

  • Target

    Technical Spec.exe

  • Size

    1.5MB

  • MD5

    66a9b6a55484f435f0fb7c84f71bc611

  • SHA1

    721833332c2fbc136adaebdf57013af384fb2cf7

  • SHA256

    59171f457fb4915d408fa293f0ca3cdfeb613a20d6fadc50ae88b1cf58f0b004

  • SHA512

    4aa631e503a41b597285fbb35c92f09c3c277e461f1845c0982006f86fc60fdf1242a4aa59c0ab976b5849da846fa17d36f89e9a1a7bcb4ef55986f7d6251f52

  • SSDEEP

    24576:gvPHgPdvk6fvDNL0mN3OnC/e4jGyIiDWXrPcTwCKvtB2zPJo0:g3Qvzfbd0ZC/eg1NWX6wCKVB2L

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
    "C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
      "C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"
      2⤵
        PID:652
      • C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
        "C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"
        2⤵
          PID:996
        • C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
          "C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"
          2⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4192
      • C:\Windows\System32\alg.exe
        C:\Windows\System32\alg.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:4932
      • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        1⤵
        • Executes dropped EXE
        PID:3056
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
        1⤵
          PID:4112
        • C:\Windows\system32\fxssvc.exe
          C:\Windows\system32\fxssvc.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:844
        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
          1⤵
          • Executes dropped EXE
          PID:3920
        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
          1⤵
          • Executes dropped EXE
          PID:5116
        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
          1⤵
          • Executes dropped EXE
          PID:1780
        • C:\Windows\System32\msdtc.exe
          C:\Windows\System32\msdtc.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:1616
        • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
          "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
          1⤵
          • Executes dropped EXE
          PID:3492
        • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          1⤵
          • Executes dropped EXE
          PID:2028
        • C:\Windows\SysWow64\perfhost.exe
          C:\Windows\SysWow64\perfhost.exe
          1⤵
          • Executes dropped EXE
          PID:3512
        • C:\Windows\system32\locator.exe
          C:\Windows\system32\locator.exe
          1⤵
          • Executes dropped EXE
          PID:2068
        • C:\Windows\System32\SensorDataService.exe
          C:\Windows\System32\SensorDataService.exe
          1⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:808
        • C:\Windows\System32\snmptrap.exe
          C:\Windows\System32\snmptrap.exe
          1⤵
          • Executes dropped EXE
          PID:3656
        • C:\Windows\system32\spectrum.exe
          C:\Windows\system32\spectrum.exe
          1⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:4148
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:2112
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
          1⤵
            PID:2344
          • C:\Windows\system32\TieringEngineService.exe
            C:\Windows\system32\TieringEngineService.exe
            1⤵
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:4632
          • C:\Windows\system32\AgentService.exe
            C:\Windows\system32\AgentService.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1000
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Executes dropped EXE
            PID:2076
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3820
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3880
          • C:\Windows\system32\wbem\WmiApSrv.exe
            C:\Windows\system32\wbem\WmiApSrv.exe
            1⤵
            • Executes dropped EXE
            PID:4704
          • C:\Windows\system32\SearchIndexer.exe
            C:\Windows\system32\SearchIndexer.exe /Embedding
            1⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1644
            • C:\Windows\system32\SearchProtocolHost.exe
              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
              2⤵
              • Modifies data under HKEY_USERS
              PID:4940
            • C:\Windows\system32\SearchFilterHost.exe
              "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
              2⤵
              • Modifies data under HKEY_USERS
              PID:4948

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                  Filesize

                  2.1MB

                  MD5

                  d04b9ca30cb91a3faab649fb0503614a

                  SHA1

                  bf035a01245763d39249bb3b8330d05f28b1731b

                  SHA256

                  acb65cb4f604ce58503f238b4f96b3e6f006093e0e33535b77861df353075166

                  SHA512

                  a46f417fefdfd9172f2f4b442c5cec86a5f955b18f22bebc888bcc880de7b233f9b3d40f0cbf7288c27c1b986f5174703cf37f8f511b74e72be0f8926d9e206c

                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                  Filesize

                  1.4MB

                  MD5

                  e7fd961fbc91c8307b8a7c86b91fb5bd

                  SHA1

                  66789386235bb02a912133c284f7a5a29e9d0498

                  SHA256

                  22e90eb1eb5500f87c276b7f0a9f78c0d95f846fa9acc4a0d130e1d997578f9f

                  SHA512

                  fdcb069a7d0b20058eba58fae2ed271da31d63275efc889979f85b0af632d618f2cae182f91727c8bff20442bb0f1bbfbe5ab2cf9b3d013eb0b3a842c03e53e8

                • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                  Filesize

                  1.5MB

                  MD5

                  8f95be67a2ce00dbe3556c211db87f35

                  SHA1

                  0e8126d9ec23a93959bcf8039ffbbb176e096204

                  SHA256

                  8ec31f049f51df1a362a49cfc8f37a51b889872a31d7dc2243c2a5bfd3571a14

                  SHA512

                  276fcc1fb8a344e6056639d2311062ce5892414f85ef90ab5fe3f85be0cde814dd3cd16ee7e783ae08cfa0b1a3d95e7884ff576f3f7aad8e83a75fe097b2813b

                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                  Filesize

                  2.1MB

                  MD5

                  8e3d7238bc3e025657f6132ed941d6b8

                  SHA1

                  84d81be5b306ef54dafd440fc7ac89a7487ba7fb

                  SHA256

                  ff06ca14f3f9cebf3e999515ee60690b7f211f8a54166a9b35533faebc38afc2

                  SHA512

                  c7c6cef9f3cbbef0da47b546b1f520bbfcb8ac260c63dc251ecfaf849f048ca6f12b74b1b394d168e1543a2c059abc8e1698e759bd92497b4b9b9000841d27fc

                • C:\Windows\SysWOW64\perfhost.exe

                  Filesize

                  1.2MB

                  MD5

                  d74944d3471004ac1fc86cdcc3dcd3b1

                  SHA1

                  deb58d1a1645d4a95814388cc70a033f4e180172

                  SHA256

                  f051972c0e6db66d374482c3c8f7064fcff08b355efab9b336f0d439a3545788

                  SHA512

                  1d4ff4d5814dd89ad8273326f742df2971f89efa2a5c806957cd4304eaba5bbcdaedcd1fabcd5cae1f4f2d345b32cd3a97718087388693cf2d846379ea838fb0

                • C:\Windows\System32\AgentService.exe

                  Filesize

                  1.7MB

                  MD5

                  82e6ee2e347d323fa122fc5009950cd2

                  SHA1

                  770326883a7b7153ba6a9d53e15e581a35bb08ba

                  SHA256

                  c62685a376ae17c8f640ac78bf8969cbd216df983b494206526e8652a04bf64c

                  SHA512

                  6f5da78787a75c7bc6d5bc8f5d0528a3003aa807ae2962cbbd726e8a12c054eb793646226e783a1f512956cdbcd5a84610284a051158418dd73bca008f532f0d

                • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                  Filesize

                  1.3MB

                  MD5

                  20017d9db1304fdf9c18ac1b1f179dcf

                  SHA1

                  194eeb33949ad1decd88e93b23dbd57d8899eafe

                  SHA256

                  f86133c8503c4c8a95041ac180311630d17702b89b51ad3310599b49b939633a

                  SHA512

                  401e2d668b23f261308326e9895e75706fe2159a66a0c9a608de789ca1f6ada79eff4b0856b62119ce6f06a4b90a8820ea4f6af98afde87dfde5af0c7547b0ee

                • C:\Windows\System32\FXSSVC.exe

                  Filesize

                  1.2MB

                  MD5

                  0dcd020850a8219cf5f59970cae4e5dc

                  SHA1

                  16f0aae13774f2d001545149926aea75d9598c00

                  SHA256

                  adabd0fb6f506c1272d4f44e7ed3b857026e5c41cd0cbdafdd98bc52f2b3667b

                  SHA512

                  7912274c9491e692e7ddab3e5109526a4d5eceb4dfd695ab6c5fe5198cb54c054eeb960f3410cddb63c8708c4e326b46a94b66e7672884121e0b4740ebfc8a30

                • C:\Windows\System32\Locator.exe

                  Filesize

                  1.2MB

                  MD5

                  50be656239a16b23efa3d2a25d5f6da9

                  SHA1

                  ea59a5ea20651832e22fd0b4e20c77b82e1d9410

                  SHA256

                  318c17dbc83ec4fca3f5708db7a634ca41d19fb4d7707cec9407f8fb838419cb

                  SHA512

                  c67b5dcb7ba474bef26013d3420c06e88854fc6de0eccc7db1e1e87cffee28f82446f50c5dd2615cddfe32de960637586955318fd6c498f2595d7e339fbea1cd

                • C:\Windows\System32\OpenSSH\ssh-agent.exe

                  Filesize

                  1.6MB

                  MD5

                  d45f77cd35eefad25251cb02567b5a6e

                  SHA1

                  a3976b3a3a541e8cfee4ae21a8d5561d34ed4ccb

                  SHA256

                  ce0bede9bb6a76f09849d1b32063a9b13f85342497579883bff58740c94de8c3

                  SHA512

                  0f8c7322a60f82737de755fb2033686f00873a46dfd046ac5e590b9ea5f73c19c54fb9428bec4ad2538524c586ba6785c816ed36cc569e67ffba221dbba04303

                • C:\Windows\System32\OpenSSH\ssh-agent.exe

                  Filesize

                  1.6MB

                  MD5

                  d45f77cd35eefad25251cb02567b5a6e

                  SHA1

                  a3976b3a3a541e8cfee4ae21a8d5561d34ed4ccb

                  SHA256

                  ce0bede9bb6a76f09849d1b32063a9b13f85342497579883bff58740c94de8c3

                  SHA512

                  0f8c7322a60f82737de755fb2033686f00873a46dfd046ac5e590b9ea5f73c19c54fb9428bec4ad2538524c586ba6785c816ed36cc569e67ffba221dbba04303

                • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                  Filesize

                  1.3MB

                  MD5

                  34303b41680f77b205d9b21b6023a4e2

                  SHA1

                  f93aa7b1f5961981398d49be09f0e172c652c89f

                  SHA256

                  f62275b77cbdb8c43a0094232bedd797d173ca7335c052f941e657334ad5357a

                  SHA512

                  359aca96ce6fd6de5229edc4453a4537a14e82135a69941706952ef6c803c95984b5aee8ed153569180ffbfbfa9c9db1d43e88dd1fcc8c5c78ccbd6e0f910e93

                • C:\Windows\System32\SearchIndexer.exe

                  Filesize

                  1.4MB

                  MD5

                  dffa5648a8c8ad2c30ff61d127c521c6

                  SHA1

                  f49c34baee4c551775214d3acba7f06702418b16

                  SHA256

                  c55aee63c87b6234f29d57295732fb4e855236f654ba09078151f2d518d3717a

                  SHA512

                  502877b0a4dae35ccc2cd43e89845a03ab8f5ca15a0b19d7b87b35a1790e372e1eaff55af5349097b2e0c15e29d1d018ef4d71ca31ece5c9e661e697613a168d

                • C:\Windows\System32\SensorDataService.exe

                  Filesize

                  1.8MB

                  MD5

                  f053977e53e2da0b52d2401bea7b6c18

                  SHA1

                  037c97e1a8855a5ea2ead278522bd5ddfb369872

                  SHA256

                  413e982e621b55db5c0a113411e3455d406e3fb1cc80cea33a1ac69196c1093e

                  SHA512

                  c6523b0a1b1b974c30bcbf365c42b5ed1cf0db5eee6e46887ccfb187756d712f2373e63f582f3980a26a2acaaceb56281c7448689259d7b3f8addbb187e9e6be

                • C:\Windows\System32\Spectrum.exe

                  Filesize

                  1.4MB

                  MD5

                  2702417ee26c153a9fc3929fa0aac867

                  SHA1

                  d45c9bb53b21ba5652adb1aa6aa61be6c4ded981

                  SHA256

                  730aa61c36e9fc6eea48aca60bd057fcd58cc9ad7caea4ee297d5933e1bbb7fe

                  SHA512

                  368d2f9af7da9eff5b91b01789dd50814f7ab289d6e25e61ef97a55370232a55ee577ffdfa90c639d011d93467f6408feaafe7e39e1b07c7f64678197a92d563

                • C:\Windows\System32\TieringEngineService.exe

                  Filesize

                  1.5MB

                  MD5

                  d64441988c96be8db277fb5b36003bcd

                  SHA1

                  4a117c179f980833954e3aa5567d034f16eb0d67

                  SHA256

                  27cbc6ce6331b60f8b6803e595cf1abffc8338eb69c843b27c7bf03371d958cf

                  SHA512

                  13527315d593c0ec8bb8a9984554d027bbf91843b06ef8d47ee733d37233b9eae35fb7d6fb392ec2d99657ef735e6d20b3340a1ccda89dd16569a6a2bcd50def

                • C:\Windows\System32\VSSVC.exe

                  Filesize

                  2.0MB

                  MD5

                  86c308b2f83e42aef78ff3fd59911ddd

                  SHA1

                  e2cc50ad58cf7e400a7b1b07ba182e180a31fc6f

                  SHA256

                  75ea2a1b0f91a85825749f2935d313f1a8f22a58cb5c43dd13cb90e643f15ad0

                  SHA512

                  0e15490765ed8b4bd6a87f8107e0421f927831991958c421972aff537c56411290ef286a64bc35d0bcecc72d1976b34bedfee872a931d3c0af4f4d9583a16b64

                • C:\Windows\System32\alg.exe

                  Filesize

                  1.3MB

                  MD5

                  d0c94dd810b273a9c789849533b037c5

                  SHA1

                  f99c09bc6f0c1d6bc8c3b5920dfa7d8f9e299d33

                  SHA256

                  29d243cddc1a6df44fe412496c6100244df3f9921f79284f1f3a2893e437f628

                  SHA512

                  dfe9cf85f804c6a5a4ee5b3aa959e910a6ab634471bc2f741ab442c9585c54df9eda8a37e5e2b84010728b3310d111d97439a34b8e0aa687256c92fe0d3ff27f

                • C:\Windows\System32\msdtc.exe

                  Filesize

                  1.4MB

                  MD5

                  3002e9a3eb52d579d75ef53cabc2b2da

                  SHA1

                  f4519d4166058e4f55946b918727a4b32a73e407

                  SHA256

                  89eaf4a80069dea74a881fedcf44ec9f4dbc54cccb31812b84552f8b49f03c62

                  SHA512

                  d94984b71f0d2a3301b9ac6051139360458c89ea72cf9a44de16e73b2a97ce5733f09a02b2dd8f8a4278b0812bd9c324614f80ca6e0e9e7488c01428507192a2

                • C:\Windows\System32\snmptrap.exe

                  Filesize

                  1.2MB

                  MD5

                  9a2f722ed7ad887b6baf741adee11ac8

                  SHA1

                  360babb56b0521d0aa6aa026308055940925d753

                  SHA256

                  beeaad2b492e3e5b75b751a65edb2810e5c99917421c1b2c2d61512d9cc25770

                  SHA512

                  61348ac426c63a7c4c786c247d59d76587e25b744e4f99592066c647b25e7d08ccfe5ca57dc9e493358cfd91bf136d3d064ab2173303f8787effad10f14e216a

                • C:\Windows\System32\vds.exe

                  Filesize

                  1.3MB

                  MD5

                  8392d3ae7459f5d1786dd7f5eb878a83

                  SHA1

                  f5022d85b8ef124003f8ca5225da3e6ae057c962

                  SHA256

                  2669de31392d0fcf75721505526f39116b9f77504d664c3092a91893c82607ba

                  SHA512

                  690fe35ba1b45e9e72d9cacacc55a50fe17a80d39a3ac7184b72455e82a942a8bd245161da793c442dd7401ae4d2362a55582e5f6273555d74066b711376bfa6

                • C:\Windows\System32\wbem\WmiApSrv.exe

                  Filesize

                  1.4MB

                  MD5

                  9b77c41ef1941e59b7da42004b0cee35

                  SHA1

                  235d924407507edba2b29531ce3d7fa008f267ad

                  SHA256

                  86ff7bc2952c04214840a602223ad9b819684db0755d614c6f5e3aeb4ce8a334

                  SHA512

                  d3134a6d7295125c0834283457ceec50a5cb6f544c90f55bec6aff30ae2a6565fc7b48d01d0ad7b97f534ce42d0120395fed5b93812bf5f8c5f1b6137f5c1164

                • C:\Windows\System32\wbengine.exe

                  Filesize

                  2.1MB

                  MD5

                  ca0bda2a7dad69a66e00648dd4cb9337

                  SHA1

                  ba4200699cf001f95632d0324042a612713041e7

                  SHA256

                  d79596c79c61dd2a1e6c6caea13f89b556ea176683abfba4ad2b19caf4269ff2

                  SHA512

                  518ffcbf6b9ee889897f0545c833c8afbf9645a23979028cb84b83b5a1c7987638c2ba1ec66094543756fc5ca44803f1640581df828883cae537a5a5e597dc87

                • memory/808-300-0x0000000140000000-0x00000001401D7000-memory.dmp

                  Filesize

                  1.8MB

                • memory/808-516-0x0000000140000000-0x00000001401D7000-memory.dmp

                  Filesize

                  1.8MB

                • memory/844-181-0x0000000000EA0000-0x0000000000F00000-memory.dmp

                  Filesize

                  384KB

                • memory/844-187-0x0000000000EA0000-0x0000000000F00000-memory.dmp

                  Filesize

                  384KB

                • memory/844-190-0x0000000000EA0000-0x0000000000F00000-memory.dmp

                  Filesize

                  384KB

                • memory/844-192-0x0000000140000000-0x0000000140135000-memory.dmp

                  Filesize

                  1.2MB

                • memory/844-407-0x0000000140000000-0x0000000140135000-memory.dmp

                  Filesize

                  1.2MB

                • memory/1000-356-0x0000000140000000-0x00000001401C0000-memory.dmp

                  Filesize

                  1.8MB

                • memory/1616-498-0x0000000140000000-0x0000000140210000-memory.dmp

                  Filesize

                  2.1MB

                • memory/1616-231-0x00000000007C0000-0x0000000000820000-memory.dmp

                  Filesize

                  384KB

                • memory/1616-230-0x0000000140000000-0x0000000140210000-memory.dmp

                  Filesize

                  2.1MB

                • memory/1644-597-0x0000000140000000-0x0000000140179000-memory.dmp

                  Filesize

                  1.5MB

                • memory/1644-411-0x0000000140000000-0x0000000140179000-memory.dmp

                  Filesize

                  1.5MB

                • memory/1780-222-0x00000000014D0000-0x0000000001530000-memory.dmp

                  Filesize

                  384KB

                • memory/1780-228-0x0000000140000000-0x0000000140221000-memory.dmp

                  Filesize

                  2.1MB

                • memory/1780-226-0x00000000014D0000-0x0000000001530000-memory.dmp

                  Filesize

                  384KB

                • memory/1780-216-0x00000000014D0000-0x0000000001530000-memory.dmp

                  Filesize

                  384KB

                • memory/2028-266-0x0000000140000000-0x0000000140202000-memory.dmp

                  Filesize

                  2.0MB

                • memory/2068-297-0x0000000140000000-0x00000001401EC000-memory.dmp

                  Filesize

                  1.9MB

                • memory/2076-578-0x0000000140000000-0x0000000140147000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2076-359-0x0000000140000000-0x0000000140147000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2112-342-0x0000000140000000-0x0000000140259000-memory.dmp

                  Filesize

                  2.3MB

                • memory/3056-177-0x0000000000690000-0x00000000006F0000-memory.dmp

                  Filesize

                  384KB

                • memory/3056-168-0x0000000000690000-0x00000000006F0000-memory.dmp

                  Filesize

                  384KB

                • memory/3056-176-0x0000000140000000-0x0000000140200000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3056-405-0x0000000140000000-0x0000000140200000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3492-264-0x0000000140000000-0x0000000140226000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3512-296-0x0000000000400000-0x00000000005EE000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3656-320-0x0000000140000000-0x00000001401ED000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3820-585-0x0000000140000000-0x00000001401FC000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3820-385-0x0000000140000000-0x00000001401FC000-memory.dmp

                  Filesize

                  2.0MB

                • memory/3880-587-0x0000000140000000-0x0000000140216000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3880-388-0x0000000140000000-0x0000000140216000-memory.dmp

                  Filesize

                  2.1MB

                • memory/3920-472-0x0000000140000000-0x0000000140237000-memory.dmp

                  Filesize

                  2.2MB

                • memory/3920-194-0x00000000004D0000-0x0000000000530000-memory.dmp

                  Filesize

                  384KB

                • memory/3920-200-0x00000000004D0000-0x0000000000530000-memory.dmp

                  Filesize

                  384KB

                • memory/3920-213-0x0000000140000000-0x0000000140237000-memory.dmp

                  Filesize

                  2.2MB

                • memory/3992-137-0x0000000005610000-0x0000000005620000-memory.dmp

                  Filesize

                  64KB

                • memory/3992-136-0x0000000005590000-0x000000000559A000-memory.dmp

                  Filesize

                  40KB

                • memory/3992-134-0x0000000005BE0000-0x0000000006184000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3992-139-0x0000000007590000-0x000000000762C000-memory.dmp

                  Filesize

                  624KB

                • memory/3992-138-0x0000000005610000-0x0000000005620000-memory.dmp

                  Filesize

                  64KB

                • memory/3992-135-0x0000000005630000-0x00000000056C2000-memory.dmp

                  Filesize

                  584KB

                • memory/3992-133-0x0000000000A50000-0x0000000000BDC000-memory.dmp

                  Filesize

                  1.5MB

                • memory/4148-550-0x0000000140000000-0x0000000140169000-memory.dmp

                  Filesize

                  1.4MB

                • memory/4148-322-0x0000000140000000-0x0000000140169000-memory.dmp

                  Filesize

                  1.4MB

                • memory/4192-149-0x0000000001300000-0x0000000001366000-memory.dmp

                  Filesize

                  408KB

                • memory/4192-403-0x0000000000400000-0x000000000065B000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4192-143-0x0000000000400000-0x000000000065B000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4192-144-0x0000000001300000-0x0000000001366000-memory.dmp

                  Filesize

                  408KB

                • memory/4192-172-0x0000000000400000-0x000000000065B000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4192-140-0x0000000000400000-0x000000000065B000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4632-344-0x0000000140000000-0x0000000140239000-memory.dmp

                  Filesize

                  2.2MB

                • memory/4704-596-0x0000000140000000-0x000000014021D000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4704-409-0x0000000140000000-0x000000014021D000-memory.dmp

                  Filesize

                  2.1MB

                • memory/4932-174-0x0000000140000000-0x0000000140201000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4932-162-0x00000000004A0000-0x0000000000500000-memory.dmp

                  Filesize

                  384KB

                • memory/4932-156-0x00000000004A0000-0x0000000000500000-memory.dmp

                  Filesize

                  384KB

                • memory/4948-761-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-699-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-784-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-783-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-636-0x00000164F8B30000-0x00000164F8B31000-memory.dmp

                  Filesize

                  4KB

                • memory/4948-637-0x00000164F8B50000-0x00000164F8D50000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-638-0x00000164F8B50000-0x00000164F8D50000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-673-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-672-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-674-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-676-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-675-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-677-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

                  Filesize

                  64KB

                • memory/4948-782-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-706-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-727-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-728-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

                  Filesize

                  2.0MB

                • memory/4948-765-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-762-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-763-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4948-764-0x00000164FAC80000-0x00000164FB080000-memory.dmp

                  Filesize

                  4.0MB

                • memory/5116-474-0x0000000140000000-0x000000014022B000-memory.dmp

                  Filesize

                  2.2MB

                • memory/5116-204-0x0000000000190000-0x00000000001F0000-memory.dmp

                  Filesize

                  384KB

                • memory/5116-210-0x0000000000190000-0x00000000001F0000-memory.dmp

                  Filesize

                  384KB

                • memory/5116-214-0x0000000140000000-0x000000014022B000-memory.dmp

                  Filesize

                  2.2MB