8eeda0849b8bffc5d26ee56f02162f2e75e4271c4257c309197f3645fac47c03

Analysis

max time kernel
37s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build.exe
Size 11.9MB
Sample240302-vvtvmsfc9v
SHA256 8eeda0849b8bffc5d26ee56f02162f2e75e4271c4257c309197f3645fac47c03
MD5 2fbf75fbac01d42161fdeb6adbd0d979
SHA1 3ef5530a433923276191eec8d98aa462194aa829
SHA512 1c208f3a5202c578e6f70474566f0929954b5678215ad962f84a7febee1b9c7a0a1cc3040763192a3ed9ebdf395bd9aa113ee313bf6f951973a717fec423472d
SSDEEP 196608:AFH/xtSYJodEawY/7HPjloM1LiUIX099RYU9ptAzvZaZoM2S5HQoFKArPWug0Vg:AFfxtjJ/an7HPZ12TE99R3zmhbShKArI
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Build.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Setup.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Build.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	Build.exe

Executes dropped EXE 3 IoCs

pid	Process
2272	Setup.exe
4024	Updater.exe
1452	kvkinxkledtt.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1724-0-0x0000000000400000-0x000000000141D000-memory.dmp	themida
behavioral2/memory/1724-83-0x0000000000400000-0x000000000141D000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Build.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	icanhazip.com
29	ipinfo.io
30	ipinfo.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1724	Build.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
1452	kvkinxkledtt.exe
1452	kvkinxkledtt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 1624	2272	Setup.exe	117

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
2848	sc.exe
4052	sc.exe
1648	sc.exe
1628	sc.exe
4444	sc.exe
4352	sc.exe
2920	sc.exe
980	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Build.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1724	Build.exe
1724	Build.exe
2272	Setup.exe
2120	powershell.exe
2120	powershell.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
1624	dialer.exe
1624	dialer.exe
2272	Setup.exe
2272	Setup.exe
2272	Setup.exe
1624	dialer.exe
1624	dialer.exe
1452	kvkinxkledtt.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	Updater.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	2272	Setup.exe
Token: SeShutdownPrivilege	5116	powercfg.exe
Token: SeCreatePagefilePrivilege	5116	powercfg.exe
Token: SeShutdownPrivilege	3280	powercfg.exe
Token: SeCreatePagefilePrivilege	3280	powercfg.exe
Token: SeShutdownPrivilege	1284	powercfg.exe
Token: SeCreatePagefilePrivilege	1284	powercfg.exe
Token: SeShutdownPrivilege	2556	powercfg.exe
Token: SeCreatePagefilePrivilege	2556	powercfg.exe
Token: SeDebugPrivilege	1624	dialer.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2272	1724	Build.exe	92
PID 1724 wrote to memory of 2272	1724	Build.exe	92
PID 1724 wrote to memory of 4024	1724	Build.exe	93
PID 1724 wrote to memory of 4024	1724	Build.exe	93
PID 1724 wrote to memory of 4024	1724	Build.exe	93
PID 2032 wrote to memory of 1104	2032	cmd.exe	102
PID 2032 wrote to memory of 1104	2032	cmd.exe	102
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 2272 wrote to memory of 1624	2272	Setup.exe	117
PID 1624 wrote to memory of 612	1624	dialer.exe	5
PID 1624 wrote to memory of 660	1624	dialer.exe	7
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 952	1624	dialer.exe	12
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 1020	1624	dialer.exe	13
PID 1624 wrote to memory of 508	1624	dialer.exe	14
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 432	1624	dialer.exe	15
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 608	1624	dialer.exe	16
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 1036	1624	dialer.exe	17
PID 660 wrote to memory of 2640	660	lsass.exe	48
PID 1624 wrote to memory of 1060	1624	dialer.exe	18
PID 1624 wrote to memory of 1168	1624	dialer.exe	20
PID 1624 wrote to memory of 1232	1624	dialer.exe	21
PID 660 wrote to memory of 2640	660	lsass.exe	48

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1232

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4444
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4352
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2920
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:980
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4600
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1624
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WindowsComplite"
    3⤵
    - Launches sc.exe
    PID:2848
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WindowsComplite" binpath= "C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1628
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WindowsComplite"
    3⤵
    - Launches sc.exe
    PID:1648
- C:\Users\Admin\AppData\Local\Temp\Updater.exe
  "C:\Users\Admin\AppData\Local\Temp\Updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4024

C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1452
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:5072

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3560

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2820

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3924

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4624

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

kvkinxkledtt.exe

Path C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 768KB
SHA256 e2ab6738b98397ae73821b40010df0147de8f07fa1379348ab0172c2dada68a4
MD5 f3a2ed6a1317db87ebd6b7da445d162b
SHA1 2e2ae84d4a1f67122ac72ca568036b8f7a13b7d5
SHA512 1eb0ca93f70ce603e439e38a68f15312cb2ccb74391043f0e94474598dfab58e63fc3554534fb8c0a52712f60fa2d3771a7a885cdb78d7e1f54602d2bff525ed
SSDEEP 12288:SuzIs2WYSuLqLP/bjQK41yZqFDtUL927oH1I2FeL5N0BWz3j35EBG:Su14DqTbF44ZqB77geL5Wmjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvkinxkledtt.exe

Path C:\ProgramData\hmtufamemhvn\kvkinxkledtt.exe
Size 832KB
SHA256 8cb013b239bee9f9ed998d4dac74d05b49e998d1f0d40559d2f9ae291b8e0a76
MD5 3787d2dc7b86ea16814f9749f1a5aa76
SHA1 efa3d5e403f8712724746d898f545d1f647e39b2
SHA512 cdaad9f3b4750b228c7e03cfaf3456553be5526a51d75c067acede21bc71955dd8f655a93b0d29ef16e77e3a5abca44dbf3cb8ab067776023f40cad0433b6ab6
SSDEEP 12288:SuzIs2WYSuLqLP/bjQK41yZqFDtUL927oH1I2FeL5N0BWz3j35EBe9BCD:Su14DqTbF44ZqB77geL5WmjR9Bi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 2.0MB
SHA256 723ba9213bd78093c17d3e42599cc22c7cfc95a6953518bcadcbaad891289afc
MD5 982c8f3e77911e9e9734f16d70240b52
SHA1 b4d3f30e772d31b451221356c9cc80336d5da321
SHA512 9b4efe012d4ca136667d4348440dfa762a20bdd3009c52578c3e7dc6fb291375643b01c9271b6739d52d7d07eb9272298f7ec8ff756eaae8f1e58e6446c86004
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKMqN/yQ3bvAN0zIecv0Dn2odA:SuyDWzSZDRR2LaGJoQ3jAQIecy28U/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 1.1MB
SHA256 a93a353ca8473b9fc9b194223110b022dc7ca4e0dfab5bec79971a0ee1df5c03
MD5 8ef571f41a9131022796aaa0cb60a64c
SHA1 490b3580a49b1c18cb50d3efc6033a6b8212da58
SHA512 8fa4752e04a348f5cfa55e1a4795388294bc5a2f305fae9dbedca6a8568c70b5722e1cd959a7e8a8fb502e0094eaee189eedc01a26afebd0e24900f51c24bcdf
SSDEEP 24576:Su14DqTbF44ZqB77geL5WmjR9BHxb9T2LtEGwxXKM3:SuyDWzSZDRR2LaGe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 8.5MB
SHA256 e49aec48358a65ac8d93539528d239cf5b9346e83efe7e67a8fa434283fa2d25
MD5 c97018b83acc1099cdd171647a50ec1f
SHA1 1acdb17298ee25d9042c79346cc53f72767e6607
SHA512 02c64c328a2fff1292c82ce270fcd173af85edf6db699b0d6a757c0ac233966d521f37d819c2a0a5f4ceeb44b9035914012548c28066fcfcdfd2a3942449f07b
SSDEEP 196608:S/bETeQIhTyunsvebUhnuFQB2B2QwdufGWMdq:GQ+hTyukebmXC2Qw8+q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\Updater.exe
Size 755KB
SHA256 556150647d272430bdf82d860796a167f1737a53e0df19def62220f32eef58ea
MD5 3ca4a2253a3947eb98f196344561ea6b
SHA1 faf971c2281596a001888972071566c62d9ccd37
SHA512 6e776373a8e4e945caedb7a991998119c3cfa8457601df0c9b635705e3ca2c2e16330526a53f189bd44949f7aded79aa8dbf07f2b062f30427b2aa97f343d9fa
SSDEEP 12288:m+FgZdfrXg+JwuKt/S/60pOGmcg8g5kjo5Bda7EGDtOqib/SA0pDK:mffw+Jwz/S/6S+8Zk5BkAOtlaapc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\Updater.exe
Size 984KB
SHA256 2e5a498e9299a5a6d7ca9d36def6d2f546812a34db0fe91528ab586dd9d07a18
MD5 d5ea67d392c23f20921d26cba0fdf284
SHA1 572013524756c6323a198810cf63c32d90044f46
SHA512 d5159344dd389c18f2d6ec9911a4a5a9b1240cefb88ab8bf8099f9ce3918915ccd39466ef750f3b3cafab2096e550e7fd07a8680780b7383f45c601603b49b7d
SSDEEP 24576:mffw+Jwz/S/6S+8Zk5BkAOtlaapjMkKTo:mnw+W7SCS+8qch
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_h2uvcqmn.ivw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2uvcqmn.ivw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/432-173-0x000002BCAB370000-0x000002BCAB39B000-memory.dmp

Download

memory/432-181-0x000002BCAB370000-0x000002BCAB39B000-memory.dmp

Download

memory/432-176-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/508-180-0x000001ABAA320000-0x000001ABAA34B000-memory.dmp

Download

memory/508-170-0x000001ABAA320000-0x000001ABAA34B000-memory.dmp

Download

memory/508-172-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/608-188-0x000001D61BFC0000-0x000001D61BFEB000-memory.dmp

Download

memory/608-191-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/612-150-0x00000175D8EE0000-0x00000175D8F0B000-memory.dmp

Download

memory/612-209-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/612-147-0x00000175D8EB0000-0x00000175D8ED4000-memory.dmp

Download

memory/612-148-0x00000175D8EE0000-0x00000175D8F0B000-memory.dmp

Download

memory/612-155-0x00007FF8A1D0D000-0x00007FF8A1D0E000-memory.dmp

Download

memory/612-210-0x00000175D8EE0000-0x00000175D8F0B000-memory.dmp

Download

memory/660-167-0x00007FF8A1D0F000-0x00007FF8A1D10000-memory.dmp

Download

memory/660-158-0x0000018951C30000-0x0000018951C5B000-memory.dmp

Download

memory/660-208-0x0000018951C30000-0x0000018951C5B000-memory.dmp

Download

memory/660-153-0x0000018951C30000-0x0000018951C5B000-memory.dmp

Download

memory/660-156-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/660-163-0x00007FF8A1D0D000-0x00007FF8A1D0E000-memory.dmp

Download

memory/952-179-0x00007FF8A1D0C000-0x00007FF8A1D0D000-memory.dmp

Download

memory/952-174-0x0000027B755F0000-0x0000027B7561B000-memory.dmp

Download

memory/952-164-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/952-160-0x0000027B755F0000-0x0000027B7561B000-memory.dmp

Download

memory/1020-165-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/1020-161-0x000001E46A0D0000-0x000001E46A0FB000-memory.dmp

Download

memory/1020-177-0x000001E46A0D0000-0x000001E46A0FB000-memory.dmp

Download

memory/1036-192-0x0000016100570000-0x000001610059B000-memory.dmp

Download

memory/1036-195-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/1060-198-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/1060-193-0x000002289E120000-0x000002289E14B000-memory.dmp

Download

memory/1168-200-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/1168-197-0x000001339A3C0000-0x000001339A3EB000-memory.dmp

Download

memory/1232-203-0x0000027E34650000-0x0000027E3467B000-memory.dmp

Download

memory/1232-205-0x00007FF861CF0000-0x00007FF861D00000-memory.dmp

Download

memory/1264-228-0x00000229CA3D0000-0x00000229CA3FB000-memory.dmp

Download

memory/1308-232-0x0000022C5CD30000-0x0000022C5CD5B000-memory.dmp

Download

memory/1344-236-0x000001C762090000-0x000001C7620BB000-memory.dmp

Download

memory/1444-240-0x0000018EAAF40000-0x0000018EAAF6B000-memory.dmp

Download

memory/1452-289-0x00007FF728EE0000-0x00007FF72A417000-memory.dmp

Download

memory/1452-171-0x00007FF46E0E0000-0x00007FF46E4B1000-memory.dmp

Download

memory/1452-206-0x00007FF728EE0000-0x00007FF72A417000-memory.dmp

Download

memory/1452-182-0x00007FF728EE0000-0x00007FF72A417000-memory.dmp

Download

memory/1452-184-0x00007FF728EE0000-0x00007FF72A417000-memory.dmp

Download

memory/1452-273-0x00007FF46E0E0000-0x00007FF46E4B1000-memory.dmp

Download

memory/1456-248-0x0000011E32A40000-0x0000011E32A6B000-memory.dmp

Download

memory/1528-244-0x000002732C9B0000-0x000002732C9DB000-memory.dmp

Download

memory/1548-257-0x00000215D9600000-0x00000215D962B000-memory.dmp

Download

memory/1624-139-0x00007FF8A1C70000-0x00007FF8A1E65000-memory.dmp

Download

memory/1624-135-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1624-133-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1624-134-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1624-144-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1624-140-0x00007FF8A1B50000-0x00007FF8A1C0E000-memory.dmp

Download

memory/1624-138-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1624-136-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1664-253-0x000002A995180000-0x000002A9951AB000-memory.dmp

Download

memory/1708-294-0x0000024E00FB0000-0x0000024E00FDB000-memory.dmp

Download

memory/1724-83-0x0000000000400000-0x000000000141D000-memory.dmp

Download

memory/1724-0-0x0000000000400000-0x000000000141D000-memory.dmp

Download

memory/1724-1-0x00000000774F4000-0x00000000774F6000-memory.dmp

Download

memory/2120-111-0x000001C8D7440000-0x000001C8D7462000-memory.dmp

Download

memory/2120-124-0x000001C8BCD60000-0x000001C8BCD70000-memory.dmp

Download

memory/2120-122-0x000001C8BCD60000-0x000001C8BCD70000-memory.dmp

Download

memory/2120-125-0x000001C8BCD60000-0x000001C8BCD70000-memory.dmp

Download

memory/2120-123-0x000001C8BCD60000-0x000001C8BCD70000-memory.dmp

Download

memory/2120-131-0x00007FF882DF0000-0x00007FF8838B1000-memory.dmp

Download

memory/2120-121-0x00007FF882DF0000-0x00007FF8838B1000-memory.dmp

Download

memory/2272-143-0x00007FF4D2530000-0x00007FF4D2901000-memory.dmp

Download

memory/2272-91-0x00007FF68B500000-0x00007FF68CA37000-memory.dmp

Download

memory/2272-84-0x00007FF4D2530000-0x00007FF4D2901000-memory.dmp

Download

memory/2272-45-0x00007FF68B500000-0x00007FF68CA37000-memory.dmp

Download

memory/2272-142-0x00007FF68B500000-0x00007FF68CA37000-memory.dmp

Download

memory/2272-105-0x00007FF68B500000-0x00007FF68CA37000-memory.dmp

Download

memory/4024-110-0x0000000007E30000-0x0000000008184000-memory.dmp

Download

memory/4024-102-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

Download

memory/4024-87-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/4024-88-0x0000000002FF0000-0x0000000003000000-memory.dmp

Download

memory/4024-89-0x00000000055C0000-0x0000000005624000-memory.dmp

Download

memory/4024-90-0x0000000005640000-0x000000000565A000-memory.dmp

Download

memory/4024-92-0x0000000005660000-0x000000000567C000-memory.dmp

Download

memory/4024-93-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/4024-94-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Download

memory/4024-95-0x0000000006D30000-0x0000000006DB2000-memory.dmp

Download

memory/4024-96-0x0000000006DB0000-0x0000000006DD6000-memory.dmp

Download

memory/4024-97-0x0000000006DE0000-0x0000000006DE8000-memory.dmp

Download

memory/4024-130-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/4024-109-0x0000000007520000-0x0000000007542000-memory.dmp

Download

memory/4024-98-0x0000000006E10000-0x0000000006E18000-memory.dmp

Download

memory/4024-108-0x0000000007410000-0x00000000074C0000-memory.dmp

Download

memory/4024-99-0x0000000006E20000-0x0000000006E2A000-memory.dmp

Download

memory/4024-100-0x0000000006E60000-0x0000000006E76000-memory.dmp

Download

memory/4024-101-0x0000000006E80000-0x0000000006E8A000-memory.dmp

Download

memory/4024-86-0x0000000000B60000-0x0000000000C5C000-memory.dmp

Download

memory/4024-103-0x0000000006F80000-0x0000000006FE6000-memory.dmp

Download

memory/4024-104-0x0000000007880000-0x0000000007E24000-memory.dmp

Download

memory/4024-107-0x0000000007070000-0x000000000707A000-memory.dmp

Download

memory/5072-224-0x000001BAF9140000-0x000001BAF9150000-memory.dmp

Download

memory/5072-222-0x000001BAF9140000-0x000001BAF9150000-memory.dmp

Download

memory/5072-212-0x00007FF882DF0000-0x00007FF8838B1000-memory.dmp

Download