fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
Size

1.7MB
MD5

8c7b3a9ca83c08bc24837572034f7ddb
SHA1

bda6d0b4d0e79a303ce95ac76e953a80edb7eab0
SHA256

fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af
SHA512

83cbecb1d0735e082efb04cb2916977eaf735b78cd55a1898f34ef2908be980e591246a5de7dc189322b5fffe5534071e1cf84b6d1b2b13af3cfd849722e00d9
SSDEEP

24576:rQa+rRep38knZGbO4oFya8ZbRxaiXvnEc3Suvb7sNPwEFfTPCRi4Vz:rZ+rRe3zn4ioa8ZbRMiXO07sNPwERWV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe

Executes dropped EXE 1 IoCs

pid	Process
3364	services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\Idle.exe	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
File created	C:\Program Files\Microsoft Office 15\6ccacd8608530f	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\services.exe	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\c5b4cb5e9653cc	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\sysmon.exe	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
File created	C:\Windows\twain_32\121e5b5079f7c0	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
956	powershell.exe
956	powershell.exe
936	powershell.exe
936	powershell.exe
888	powershell.exe
888	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	3364	services.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4720	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	91
PID 1424 wrote to memory of 4720	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	91
PID 1424 wrote to memory of 936	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	90
PID 1424 wrote to memory of 936	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	90
PID 1424 wrote to memory of 956	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	89
PID 1424 wrote to memory of 956	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	89
PID 1424 wrote to memory of 1112	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	88
PID 1424 wrote to memory of 1112	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	88
PID 1424 wrote to memory of 888	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	87
PID 1424 wrote to memory of 888	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	87
PID 1424 wrote to memory of 4980	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	98
PID 1424 wrote to memory of 4980	1424	fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe	98
PID 4980 wrote to memory of 4952	4980	cmd.exe	100
PID 4980 wrote to memory of 4952	4980	cmd.exe	100
PID 4980 wrote to memory of 812	4980	cmd.exe	101
PID 4980 wrote to memory of 812	4980	cmd.exe	101
PID 4980 wrote to memory of 3364	4980	cmd.exe	104
PID 4980 wrote to memory of 3364	4980	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe
"C:\Users\Admin\AppData\Local\Temp\fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\hrtfs\services.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\Idle.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\sysmon.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AzpN37wDFu.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4952
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:812
- - C:\Program Files\VideoLAN\VLC\hrtfs\services.exe
    "C:\Program Files\VideoLAN\VLC\hrtfs\services.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\hrtfs\services.exe

Filesize
1.7MB

MD5
8c7b3a9ca83c08bc24837572034f7ddb

SHA1
bda6d0b4d0e79a303ce95ac76e953a80edb7eab0

SHA256
fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af

SHA512
83cbecb1d0735e082efb04cb2916977eaf735b78cd55a1898f34ef2908be980e591246a5de7dc189322b5fffe5534071e1cf84b6d1b2b13af3cfd849722e00d9

Download Submit
C:\Program Files\VideoLAN\VLC\hrtfs\services.exe

Filesize
1.7MB

MD5
8c7b3a9ca83c08bc24837572034f7ddb

SHA1
bda6d0b4d0e79a303ce95ac76e953a80edb7eab0

SHA256
fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af

SHA512
83cbecb1d0735e082efb04cb2916977eaf735b78cd55a1898f34ef2908be980e591246a5de7dc189322b5fffe5534071e1cf84b6d1b2b13af3cfd849722e00d9

Download Submit
C:\Recovery\WindowsRE\upfc.exe

Filesize
1.7MB

MD5
8c7b3a9ca83c08bc24837572034f7ddb

SHA1
bda6d0b4d0e79a303ce95ac76e953a80edb7eab0

SHA256
fb6c66afee480eac1225f803d1890abe5c11bd84c0037bcef64a24f5549bd9af

SHA512
83cbecb1d0735e082efb04cb2916977eaf735b78cd55a1898f34ef2908be980e591246a5de7dc189322b5fffe5534071e1cf84b6d1b2b13af3cfd849722e00d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
85502ce8813f7174d5989a982a473094

SHA1
767982aed807f5f28ad7037139db874adebae5ed

SHA256
df0b71db6a6f78fcea4a935928560506f0c099e75aba717fd04cc9226d720ec6

SHA512
224ba8f3fc1d9a04bceb006af989f2838f4253074ba58b9082c7761daa1067e9d742ae51212d9116c89bda346538e8806790121deacf67a1c7b4a81bc95e6f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AzpN37wDFu.bat

Filesize
224B

MD5
16078509682954e6034e11f9f5618e4e

SHA1
38d6a96d700b07006cee587ed75d453c0386bd94

SHA256
9d831d99da5d699fa6cf0acccb5aae9bc527daab7d8deb0016118185eaa45305

SHA512
072441e3856130d9ad044f175962cf656d5862ef9e7b93fc806d34d72fae2120eef57c73235b546ce0d7990326beffae70322754432167a01f8fda7f5abf31ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hrn5yfnn.pwf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/888-116-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/888-39-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/888-102-0x0000025ED94A0000-0x0000025ED94B0000-memory.dmp

Filesize
64KB

Download
memory/936-114-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/936-103-0x00000240F6B40000-0x00000240F6B50000-memory.dmp

Filesize
64KB

Download
memory/936-48-0x00000240F6B40000-0x00000240F6B50000-memory.dmp

Filesize
64KB

Download
memory/936-98-0x00000240F6B40000-0x00000240F6B50000-memory.dmp

Filesize
64KB

Download
memory/936-45-0x00000240F6850000-0x00000240F6872000-memory.dmp

Filesize
136KB

Download
memory/936-49-0x00000240F6B40000-0x00000240F6B50000-memory.dmp

Filesize
64KB

Download
memory/936-47-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/956-96-0x0000020AB0AD0000-0x0000020AB0AE0000-memory.dmp

Filesize
64KB

Download
memory/956-36-0x0000020AB0AD0000-0x0000020AB0AE0000-memory.dmp

Filesize
64KB

Download
memory/956-35-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/956-101-0x0000020AB0AD0000-0x0000020AB0AE0000-memory.dmp

Filesize
64KB

Download
memory/956-113-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1112-84-0x0000020DF78A0000-0x0000020DF78B0000-memory.dmp

Filesize
64KB

Download
memory/1112-117-0x0000020DF78A0000-0x0000020DF78B0000-memory.dmp

Filesize
64KB

Download
memory/1112-120-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1112-77-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1112-78-0x0000020DF78A0000-0x0000020DF78B0000-memory.dmp

Filesize
64KB

Download
memory/1424-19-0x0000000003200000-0x000000000320C000-memory.dmp

Filesize
48KB

Download
memory/1424-9-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1424-1-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1424-2-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/1424-46-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/1424-38-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/1424-20-0x00007FFE64090000-0x00007FFE64091000-memory.dmp

Filesize
4KB

Download
memory/1424-3-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/1424-4-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/1424-0-0x0000000000DF0000-0x0000000000FB0000-memory.dmp

Filesize
1.8MB

Download
memory/1424-17-0x00000000031F0000-0x00000000031FC000-memory.dmp

Filesize
48KB

Download
memory/1424-15-0x00007FFE640A0000-0x00007FFE640A1000-memory.dmp

Filesize
4KB

Download
memory/1424-12-0x00007FFE640B0000-0x00007FFE640B1000-memory.dmp

Filesize
4KB

Download
memory/1424-14-0x00000000030C0000-0x00000000030CE000-memory.dmp

Filesize
56KB

Download
memory/1424-7-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/1424-11-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/1424-10-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/1424-6-0x0000000003070000-0x000000000307E000-memory.dmp

Filesize
56KB

Download
memory/1424-8-0x00007FFE640C0000-0x00007FFE640C1000-memory.dmp

Filesize
4KB

Download
memory/3364-131-0x00007FFE640B0000-0x00007FFE640B1000-memory.dmp

Filesize
4KB

Download
memory/3364-129-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/3364-137-0x000000001DC40000-0x000000001DD55000-memory.dmp

Filesize
1.1MB

Download
memory/3364-135-0x00007FFE64090000-0x00007FFE64091000-memory.dmp

Filesize
4KB

Download
memory/3364-133-0x00007FFE640A0000-0x00007FFE640A1000-memory.dmp

Filesize
4KB

Download
memory/3364-130-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/3364-124-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/3364-127-0x00007FFE640C0000-0x00007FFE640C1000-memory.dmp

Filesize
4KB

Download
memory/3364-126-0x00007FFE640D0000-0x00007FFE6418E000-memory.dmp

Filesize
760KB

Download
memory/3364-125-0x000000001AD90000-0x000000001AD91000-memory.dmp

Filesize
4KB

Download
memory/4720-115-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/4720-95-0x000001E5666E0000-0x000001E5666F0000-memory.dmp

Filesize
64KB

Download
memory/4720-93-0x00007FFE45F80000-0x00007FFE46A41000-memory.dmp

Filesize
10.8MB

Download
memory/4720-94-0x000001E5666E0000-0x000001E5666F0000-memory.dmp

Filesize
64KB

Download
memory/4720-99-0x000001E5666E0000-0x000001E5666F0000-memory.dmp

Filesize
64KB

Download
memory/4720-100-0x000001E5666E0000-0x000001E5666F0000-memory.dmp

Filesize
64KB

Download