Analysis

  • max time kernel
    95s
  • max time network
    89s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-01-2024 20:03

General

  • Target

    testing.exe

  • Size

    2.7MB

  • MD5

    7bc2995d24a569dc7d65a2b92ca894bb

  • SHA1

    76e210f61f66f055592139336985a7d00bc484d2

  • SHA256

    e48229eccce19f5b00299a9d70d9a8afa4cb6abdc4e46dcb62e95843f5e1274d

  • SHA512

    862f03bea1cbeb0a7646ef0ff13c916a74833628894d517bd0f2ad093a84c2aa0819fc542d8229b88db2c9635de34001aa09b31047c9684b74188429f00ec445

  • SSDEEP

    49152:yw4Gb/hZZxF9qQ1JaXKOVAWJpB4YWtA4Pofg40xPfVV8WW4V2mya/hm:y2Vlv1JaXJXpB4YWv7X3Va0QYhm

Score
8/10

Malware Config

Signatures

  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:664
  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:612
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:1020
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:96
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
      1⤵
        PID:744
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservice -s nsi
        1⤵
          PID:1176
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s SENS
          1⤵
            PID:1528
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
            1⤵
              PID:1784
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
              1⤵
                PID:2268
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                1⤵
                  PID:2852
                • C:\Windows\system32\ApplicationFrameHost.exe
                  C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                  1⤵
                    PID:3572
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    1⤵
                      PID:4944
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                      1⤵
                        PID:688
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 688 -s 908
                          2⤵
                            PID:1172
                        • C:\Windows\System32\InstallAgent.exe
                          C:\Windows\System32\InstallAgent.exe -Embedding
                          1⤵
                            PID:3584
                          • C:\Windows\system32\DllHost.exe
                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                            1⤵
                              PID:3004
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                              1⤵
                                PID:2484
                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                1⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                PID:676
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                1⤵
                                • Modifies data under HKEY_USERS
                                PID:760
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                1⤵
                                  PID:4572
                                • C:\Windows\system32\DllHost.exe
                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                  1⤵
                                    PID:396
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 396 -s 892
                                      2⤵
                                        PID:544
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:4040
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3240
                                        • C:\Users\Admin\AppData\Local\Temp\testing.exe
                                          "C:\Users\Admin\AppData\Local\Temp\testing.exe"
                                          2⤵
                                          • Drops file in System32 directory
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4536
                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1668
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4152
                                            • C:\Windows\system32\wusa.exe
                                              wusa /uninstall /kb:890830 /quiet /norestart
                                              4⤵
                                                PID:4520
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop UsoSvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:2328
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:3444
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop wuauserv
                                              3⤵
                                              • Launches sc.exe
                                              PID:2396
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop bits
                                              3⤵
                                              • Launches sc.exe
                                              PID:4528
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop dosvc
                                              3⤵
                                              • Launches sc.exe
                                              PID:5024
                                            • C:\Windows\system32\dialer.exe
                                              C:\Windows\system32\dialer.exe
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4120
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe delete "UDIYNDRV"
                                              3⤵
                                              • Launches sc.exe
                                              PID:3988
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4448
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2512
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4700
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4440
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe create "UDIYNDRV" binpath= "C:\ProgramData\usjsffdilasf\pcwfqbzkkage.exe" start= "auto"
                                              3⤵
                                              • Launches sc.exe
                                              PID:5020
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe start "UDIYNDRV"
                                              3⤵
                                              • Launches sc.exe
                                              PID:3168
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop eventlog
                                              3⤵
                                              • Launches sc.exe
                                              PID:8
                                          • C:\Windows\system32\taskmgr.exe
                                            "C:\Windows\system32\taskmgr.exe" /4
                                            2⤵
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            • Checks processor information in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:4376
                                        • C:\Windows\system32\wbem\unsecapp.exe
                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                          1⤵
                                            PID:3136
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                            1⤵
                                              PID:2992
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                              1⤵
                                                PID:2976
                                              • C:\Windows\sysmon.exe
                                                C:\Windows\sysmon.exe
                                                1⤵
                                                  PID:2968
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                  1⤵
                                                    PID:2916
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                    1⤵
                                                      PID:2900
                                                    • c:\windows\system32\svchost.exe
                                                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                      1⤵
                                                        PID:2820
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                        1⤵
                                                          PID:2692
                                                        • c:\windows\system32\taskhostw.exe
                                                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                                          1⤵
                                                            PID:2644
                                                          • c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                            1⤵
                                                              PID:2632
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                              1⤵
                                                                PID:2540
                                                              • c:\windows\system32\sihost.exe
                                                                sihost.exe
                                                                1⤵
                                                                  PID:2532
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                  1⤵
                                                                    PID:2116
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                                    1⤵
                                                                      PID:2064
                                                                    • C:\Windows\System32\spoolsv.exe
                                                                      C:\Windows\System32\spoolsv.exe
                                                                      1⤵
                                                                        PID:1992
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                        1⤵
                                                                          PID:1888
                                                                        • c:\windows\system32\svchost.exe
                                                                          c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                                          1⤵
                                                                            PID:1828
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                                            1⤵
                                                                              PID:1772
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                                              1⤵
                                                                                PID:1748
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                                                1⤵
                                                                                  PID:1712
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                                                                  1⤵
                                                                                    PID:1620
                                                                                  • c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                                                                    1⤵
                                                                                      PID:1612
                                                                                    • c:\windows\system32\svchost.exe
                                                                                      c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                                                                      1⤵
                                                                                        PID:1520
                                                                                      • c:\windows\system32\svchost.exe
                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                        1⤵
                                                                                        • Checks SCSI registry key(s)
                                                                                        • Modifies data under HKEY_USERS
                                                                                        PID:1492
                                                                                      • c:\windows\system32\svchost.exe
                                                                                        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                                                                        1⤵
                                                                                          PID:1376
                                                                                        • c:\windows\system32\svchost.exe
                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                          1⤵
                                                                                            PID:1332
                                                                                          • c:\windows\system32\svchost.exe
                                                                                            c:\windows\system32\svchost.exe -k localservice -s EventSystem
                                                                                            1⤵
                                                                                              PID:1312
                                                                                            • c:\windows\system32\svchost.exe
                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                              1⤵
                                                                                                PID:1292
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                                                                                                1⤵
                                                                                                  PID:1160
                                                                                                • c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                  1⤵
                                                                                                    PID:1116
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                    1⤵
                                                                                                      PID:1036
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                                                                                                      1⤵
                                                                                                        PID:416
                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
                                                                                                        1⤵
                                                                                                          PID:388
                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                          1⤵
                                                                                                            PID:376
                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
                                                                                                            1⤵
                                                                                                              PID:928
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                                PID:2928
                                                                                                              • C:\ProgramData\usjsffdilasf\pcwfqbzkkage.exe
                                                                                                                C:\ProgramData\usjsffdilasf\pcwfqbzkkage.exe
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4268
                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                  2⤵
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3432
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    3⤵
                                                                                                                      PID:3360
                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                  C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                  1⤵
                                                                                                                    PID:1920

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1B8.tmp.csv

                                                                                                                    Filesize

                                                                                                                    33KB

                                                                                                                    MD5

                                                                                                                    43be54d53a5311d8cdcee0a28e2a711d

                                                                                                                    SHA1

                                                                                                                    a69362536fd2aa2e1d5f0cbcfc8248f879c06483

                                                                                                                    SHA256

                                                                                                                    5357ae99fcfe3cb23444048a7a804d39dc46f1091a4675209ec6bc470180f987

                                                                                                                    SHA512

                                                                                                                    fb182b124439586f3e2401078ef0ecc3c1ff4d50408bfca0011b5812fcb153c2996054f7293169cdd2513eedd71cb49cd7b3bfd06c53541285001f68c05ec86a

                                                                                                                  • C:\ProgramData\Microsoft\Windows\WER\Temp\WERE311.tmp.txt

                                                                                                                    Filesize

                                                                                                                    12KB

                                                                                                                    MD5

                                                                                                                    6789bd657e47c3fd025897add0da967f

                                                                                                                    SHA1

                                                                                                                    f516b2b441b24927d2ea936c3ff0ef8546f2f9eb

                                                                                                                    SHA256

                                                                                                                    87d59244e1c42f24f5f17e109f3d6aa44507a95752b75b0fe4d2fdb3a67a4e1f

                                                                                                                    SHA512

                                                                                                                    f755c33567c75edda4dd1097b72045a4801da199fb4a84a77807802e14296068aac84eef74ff85bf9d95aab3aa4a75c672209bb120728a8ac354abf926974e95

                                                                                                                  • C:\ProgramData\usjsffdilasf\pcwfqbzkkage.exe

                                                                                                                    Filesize

                                                                                                                    2.7MB

                                                                                                                    MD5

                                                                                                                    f3774de7e5a8aa2572d5ba7d3452cc25

                                                                                                                    SHA1

                                                                                                                    b7b20ae9b60eb6b91c5c3dc260e68676767e165c

                                                                                                                    SHA256

                                                                                                                    d6af59b93296f00418fece33e5a3a4c7f6cc818b68bb95dd8ee289729116d910

                                                                                                                    SHA512

                                                                                                                    412c94f11d48b59dc7487c7c1b79c7a0dc171bddcb948a5a19c5380b0baa1cffd5f2e44ed458ebe7b7546976e57185fa0ac753efd45f370c89db4f94e4b98552

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_chnz0lrj.bf5.ps1

                                                                                                                    Filesize

                                                                                                                    1B

                                                                                                                    MD5

                                                                                                                    c4ca4238a0b923820dcc509a6f75849b

                                                                                                                    SHA1

                                                                                                                    356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                    SHA256

                                                                                                                    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                    SHA512

                                                                                                                    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                  • memory/96-241-0x000001C298FD0000-0x000001C298FFB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/96-314-0x000001C298FD0000-0x000001C298FFB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/96-309-0x00007FFFD3880000-0x00007FFFD3A5B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.9MB

                                                                                                                  • memory/96-255-0x00007FFFD3880000-0x00007FFFD3A5B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.9MB

                                                                                                                  • memory/376-101-0x0000020B8D460000-0x0000020B8D48B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/376-104-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/376-120-0x0000020B8D460000-0x0000020B8D48B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/388-103-0x0000013EDF680000-0x0000013EDF6AB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/388-108-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/388-195-0x0000013EDF680000-0x0000013EDF6AB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/416-107-0x0000021B59DC0000-0x0000021B59DEB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/416-125-0x0000021B59DC0000-0x0000021B59DEB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/416-112-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/612-74-0x000001EFC7720000-0x000001EFC774B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/612-75-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/612-77-0x00007FFFD3925000-0x00007FFFD3926000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/612-69-0x000001EFC76F0000-0x000001EFC7714000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    144KB

                                                                                                                  • memory/664-76-0x000001FEE0340000-0x000001FEE036B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/664-80-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/664-81-0x000001FEE0340000-0x000001FEE036B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/676-338-0x000001B2C15E0000-0x000001B2C160B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/744-84-0x0000027332620000-0x000002733264B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/744-87-0x0000027332620000-0x000002733264B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/744-86-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/760-334-0x0000019A66BA0000-0x0000019A66BCB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/928-94-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/928-90-0x0000023C80F60000-0x0000023C80F8B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/928-95-0x0000023C80F60000-0x0000023C80F8B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1020-183-0x00000165C5DD0000-0x00000165C5DFB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1020-99-0x00007FFFD3925000-0x00007FFFD3926000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1020-91-0x00000165C5DD0000-0x00000165C5DFB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1036-110-0x000002A0F3D00000-0x000002A0F3D2B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1036-117-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1036-129-0x000002A0F3D00000-0x000002A0F3D2B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1116-133-0x000001FD2C9F0000-0x000001FD2CA1B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1116-122-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1116-115-0x000001FD2C9F0000-0x000001FD2CA1B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1160-121-0x000002A5AA350000-0x000002A5AA37B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1160-126-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1160-147-0x000002A5AA350000-0x000002A5AA37B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1176-136-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1176-198-0x000001D602760000-0x000001D60278B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1176-131-0x000001D602760000-0x000001D60278B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1292-204-0x0000021EFB0A0000-0x0000021EFB0CB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1292-139-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1292-134-0x0000021EFB0A0000-0x0000021EFB0CB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1312-135-0x000001C0E1B90000-0x000001C0E1BBB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1312-152-0x000001C0E1B90000-0x000001C0E1BBB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1312-140-0x00007FFF93910000-0x00007FFF93920000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1332-210-0x00000246B1420000-0x00000246B144B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1376-158-0x000001BA7EC70000-0x000001BA7EC9B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1492-165-0x0000022D5AF60000-0x0000022D5AF8B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1520-169-0x00000294B4870000-0x00000294B489B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1528-174-0x00000183464C0000-0x00000183464EB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1612-180-0x000001BCA7670000-0x000001BCA769B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1620-186-0x0000029B2A170000-0x0000029B2A19B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1668-11-0x000001CA35860000-0x000001CA35870000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1668-10-0x00007FFFB6CA0000-0x00007FFFB768C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    9.9MB

                                                                                                                  • memory/1668-55-0x00007FFFB6CA0000-0x00007FFFB768C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    9.9MB

                                                                                                                  • memory/1668-51-0x000001CA35860000-0x000001CA35870000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1668-9-0x000001CA357C0000-0x000001CA357E2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/1668-28-0x000001CA35860000-0x000001CA35870000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1668-13-0x000001CA35860000-0x000001CA35870000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/1668-15-0x000001CA35AF0000-0x000001CA35B66000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    472KB

                                                                                                                  • memory/1712-190-0x000001973E240000-0x000001973E26B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1748-216-0x000001B980330000-0x000001B98035B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1772-220-0x00000257C9940000-0x00000257C996B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1828-226-0x000001D3BA6D0000-0x000001D3BA6FB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1888-231-0x0000018E49EA0000-0x0000018E49ECB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/1992-237-0x00000000017F0000-0x000000000181B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2064-250-0x00000241E2720000-0x00000241E274B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2116-246-0x000001D24D610000-0x000001D24D63B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2268-265-0x000001B8D5D80000-0x000001B8D5DAB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2484-342-0x000001F908A40000-0x000001F908A6B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2532-270-0x0000022D81150000-0x0000022D8117B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2632-276-0x00000171FD230000-0x00000171FD25B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2820-281-0x00000190376A0000-0x00000190376CB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2852-286-0x00000246A7F40000-0x00000246A7F6B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2900-293-0x0000027E60300000-0x0000027E6032B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2916-299-0x0000020525850000-0x000002052587B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2968-305-0x0000026C00050000-0x0000026C0007B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2976-311-0x000001B011340000-0x000001B01136B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/2992-316-0x00000279E14C0000-0x00000279E14EB000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/3136-320-0x000002B08A5E0000-0x000002B08A60B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/3240-324-0x0000000003220000-0x000000000324B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/3432-137-0x000001F76D640000-0x000001F76D650000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/3432-113-0x00007FFFB6CA0000-0x00007FFFB768C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    9.9MB

                                                                                                                  • memory/3432-142-0x000001F76D640000-0x000001F76D650000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/4040-329-0x0000017300F00000-0x0000017300F2B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-63-0x00007FFFD3880000-0x00007FFFD3A5B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.9MB

                                                                                                                  • memory/4120-56-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-57-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-58-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-59-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-61-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB

                                                                                                                  • memory/4120-64-0x00007FFFD3190000-0x00007FFFD323E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    696KB

                                                                                                                  • memory/4120-66-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    172KB