Overview

overview

10

Static

static

3

x326.exe

windows7-x64

10

x326.exe

windows10-1703-x64

10

x326.exe

windows10-2004-x64

10

x326.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    82s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-03-2024 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    x326.exe

  • Size

    455KB

  • MD5

    c8d9593196962fa5d706a207c16674cd

  • SHA1

    686a8e674e6615d5cd91f7b2cba0c755054b3f69

  • SHA256

    a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d

  • SHA512

    5ddae80780c6091bfe0ab5e29bc63732c08ce34f677fc341366dcecf6db9e1bd2e0ed24cfe57eface0d19c6f46010f47eb2d74888b91a503dae00651c4a756bf

  • SSDEEP

    12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK

Score
10/10
eternityxwormevasionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.1

C2

104.194.9.116:7000

Mutex

bUezpCDHVjUVS3W9

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845

aes.plain

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes
  • payload_urls

    https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Creates new service(s) 1 TTPs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:644
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:432
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:696
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:992
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:472
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1044
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1080
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1132
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1152
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                        PID:1184
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                        1⤵
                          PID:1236
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1324
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1380
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1464
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                1⤵
                                  PID:1580
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                  1⤵
                                    PID:1620
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1668
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1676
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1784
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1812
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1840
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1972
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:2028
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2036
                                                  • C:\Windows\sysmon.exe
                                                    C:\Windows\sysmon.exe
                                                    1⤵
                                                      PID:2596
                                                    • C:\Users\Admin\AppData\Local\Temp\x326.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\x326.exe"
                                                      1⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4740
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:884
                                                        • C:\Users\Admin\AppData\Local\Temp\shrosz.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\shrosz.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2940
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3224
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "installutil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe"
                                                              5⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3688
                                                              • C:\Windows\SysWOW64\chcp.com
                                                                chcp 65001
                                                                6⤵
                                                                  PID:3944
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping 127.0.0.1
                                                                  6⤵
                                                                  • Runs ping.exe
                                                                  PID:656
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "installutil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe" /rl HIGHEST /f
                                                                  6⤵
                                                                  • Creates scheduled task(s)
                                                                  PID:880
                                                                • C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe
                                                                  "C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:4300
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                                              4⤵
                                                                PID:4288
                                                            • C:\Users\Admin\AppData\Local\Temp\xkdnqz.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\xkdnqz.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2024
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                4⤵
                                                                • Drops file in System32 directory
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1416
                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                  5⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5060
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                  5⤵
                                                                    PID:5084
                                                                    • C:\Windows\system32\wusa.exe
                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                      6⤵
                                                                        PID:3400
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:3312
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:3440
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:4808
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop bits
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:2736
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:1368
                                                                    • C:\Windows\system32\powercfg.exe
                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                      5⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1908
                                                                    • C:\Windows\system32\powercfg.exe
                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                      5⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2704
                                                                    • C:\Windows\system32\powercfg.exe
                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                      5⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1740
                                                                    • C:\Windows\system32\powercfg.exe
                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                      5⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2940
                                                                    • C:\Windows\system32\dialer.exe
                                                                      C:\Windows\system32\dialer.exe
                                                                      5⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3052
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe delete "AHIMMUFK"
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:3948
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe create "AHIMMUFK" binpath= "C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe" start= "auto"
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:1952
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:4952
                                                                    • C:\Windows\system32\sc.exe
                                                                      C:\Windows\system32\sc.exe start "AHIMMUFK"
                                                                      5⤵
                                                                      • Launches sc.exe
                                                                      PID:3644
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                    4⤵
                                                                      PID:1612
                                                                  • C:\Users\Admin\AppData\Local\Temp\ijtcvu.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ijtcvu.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3284
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
                                                                      4⤵
                                                                      • Drops startup file
                                                                      PID:468
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
                                                                      4⤵
                                                                        PID:4360
                                                                • C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe
                                                                  C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:4260

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe
                                                                  Filesize

                                                                  824KB

                                                                  MD5

                                                                  65a9eed4730752578861699bc945b3bf

                                                                  SHA1

                                                                  2cc7f50010d4ff1dc5006f2436c7ccbb6a0e01d8

                                                                  SHA256

                                                                  4e37a9dd6e6ccd52a8fc94657298072359021fe529017e232f4487693ad4697c

                                                                  SHA512

                                                                  2739f68e0b7424e84c1d849a19edb00295e3adea4b184df26e9c0c02628cebf077431b6129a1478c36d9267e37400bd82523a30c693fab2effa1a098f54c9ed8

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log
                                                                  Filesize

                                                                  321B

                                                                  MD5

                                                                  f67fe6df08d4663b0496e9a0cc94640a

                                                                  SHA1

                                                                  d07396cfcf0c6ac3baef97ce55da213a87923095

                                                                  SHA256

                                                                  f7ebc9ed3149ecb8a190fbcb1d4e5524e1bdd0e603ab695d8ebff41da59fa2d4

                                                                  SHA512

                                                                  4f92d4a762675eee10856d08921c75cf3f9a6f92e94c21f0ef0aa5147f9a84e168e6cdb001e9a66986b0cff1c454d50a5b44715676875cf5343a3cbc5c0d5e31

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\ServiceHub\installutil.exe
                                                                  Filesize

                                                                  41KB

                                                                  MD5

                                                                  3c94b02364ba067e6c181191a5273824

                                                                  SHA1

                                                                  a44d2d25e0c36bee0fd319f4b990a67d8c34e852

                                                                  SHA256

                                                                  56763f94d6998304d137f5c202fb2147da5f14a39f318c68a810fc351701486f

                                                                  SHA512

                                                                  4b8bbcd2c0105170142a2b1f74569fac542180953bde7bdc7625c4d17e860cbfcb818a6813aedff39fe6e13bd71cfd5e3b3187b984e81532a6ed5998bab89cb9

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4nqr41c.mbm.ps1
                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\ijtcvu.exe
                                                                  Filesize

                                                                  756KB

                                                                  MD5

                                                                  d76027fe4cfd48c7f8999c796e50e731

                                                                  SHA1

                                                                  5026422e84bf445e2d141529e2b808187a30d9f6

                                                                  SHA256

                                                                  148da274864c690a7c01119e025bdc0ab94fa9c110c30afb42e51b1c990a2799

                                                                  SHA512

                                                                  2e2c4a5319a61555913648702ddcfb8b40d548dcfda1a536a2e85f9cb85d25d9a463743dc866f86b4de99fd10f9c402def424b9e8a203189518f45e924b89d2d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\shrosz.exe
                                                                  Filesize

                                                                  393KB

                                                                  MD5

                                                                  3f3a51617811e9581aba50376599efa6

                                                                  SHA1

                                                                  9b26aa73f43a4db9b216b90d1aa3e2e4d602fde8

                                                                  SHA256

                                                                  5f3403e13e316d9320d46233e9f62b183623c46ec80c6c55139efdd72c5ada37

                                                                  SHA512

                                                                  9ad5cfb29281dd462b726c7ee239926f83050181fe4f6c3e9057e51df65ae7f850cecbf1cb453287720314275335df36bb8d5299d09a1f73329a5b9292db3ee3

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\xkdnqz.exe
                                                                  Filesize

                                                                  3.1MB

                                                                  MD5

                                                                  86e00d529b3b454a84b942ac916211e3

                                                                  SHA1

                                                                  021c733e5448436b384bf0d3a0ba81f4d0d93f9a

                                                                  SHA256

                                                                  30e01b261cb5d7524a303cdbe9d177fc05d74279642e4a87b46ee70045e68d53

                                                                  SHA512

                                                                  9a08379b35a3bf1699b925c6dbfc6e85123f1155e567929eaff3683e5e9f196a16775e3a2f6a7585f7c0f0f201ef4be009cda5cf94b160742642145837c3de1e

                                                                  Download Submit

                                                                • memory/432-526-0x00000244D9C00000-0x00000244D9C2B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/468-424-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                  Filesize

                                                                  248KB

                                                                  Download

                                                                • memory/468-426-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                  Filesize

                                                                  248KB

                                                                  Download

                                                                • memory/472-533-0x000002603EA60000-0x000002603EA8B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/472-535-0x00007FFB25E10000-0x00007FFB25E20000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/644-515-0x000001B92EDB0000-0x000001B92EDD4000-memory.dmp

                                                                  Filesize

                                                                  144KB

                                                                  Download

                                                                • memory/644-516-0x000001B92F000000-0x000001B92F02B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/696-521-0x00007FFB25E10000-0x00007FFB25E20000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/696-518-0x0000022DBB6F0000-0x0000022DBB71B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/884-12-0x0000000007210000-0x00000000072A2000-memory.dmp

                                                                  Filesize

                                                                  584KB

                                                                  Download

                                                                • memory/884-11-0x0000000005B20000-0x0000000005B30000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/884-10-0x0000000005990000-0x00000000059F6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/884-8-0x0000000074C30000-0x00000000753E1000-memory.dmp

                                                                  Filesize

                                                                  7.7MB

                                                                  Download

                                                                • memory/884-7-0x00000000058F0000-0x000000000598C000-memory.dmp

                                                                  Filesize

                                                                  624KB

                                                                  Download

                                                                • memory/884-6-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/884-13-0x0000000007860000-0x0000000007E06000-memory.dmp

                                                                  Filesize

                                                                  5.6MB

                                                                  Download

                                                                • memory/992-529-0x00007FFB25E10000-0x00007FFB25E20000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/992-525-0x00000231EB2A0000-0x00000231EB2CB000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/1416-363-0x0000000140000000-0x00000001402CA000-memory.dmp

                                                                  Filesize

                                                                  2.8MB

                                                                  Download

                                                                • memory/2024-403-0x00007FFB51FF0000-0x00007FFB52032000-memory.dmp

                                                                  Filesize

                                                                  264KB

                                                                  Download

                                                                • memory/2024-396-0x00007FFB57320000-0x00007FFB57339000-memory.dmp

                                                                  Filesize

                                                                  100KB

                                                                  Download

                                                                • memory/2024-393-0x00007FFB40030000-0x00007FFB401C7000-memory.dmp

                                                                  Filesize

                                                                  1.6MB

                                                                  Download

                                                                • memory/2024-391-0x00007FFB57320000-0x00007FFB5733C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/2024-389-0x00007FFB570F0000-0x00007FFB57111000-memory.dmp

                                                                  Filesize

                                                                  132KB

                                                                  Download

                                                                • memory/2024-384-0x00007FFB562F0000-0x00007FFB56327000-memory.dmp

                                                                  Filesize

                                                                  220KB

                                                                  Download

                                                                • memory/2024-379-0x00007FFB40690000-0x00007FFB407C9000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2024-400-0x00007FFB56B80000-0x00007FFB56BA2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2024-405-0x00007FFB51FF0000-0x00007FFB52034000-memory.dmp

                                                                  Filesize

                                                                  272KB

                                                                  Download

                                                                • memory/2024-409-0x00007FFB57320000-0x00007FFB5733A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2024-411-0x00007FFB3FF80000-0x00007FFB401C4000-memory.dmp

                                                                  Filesize

                                                                  2.3MB

                                                                  Download

                                                                • memory/2940-39-0x0000029F6AED0000-0x0000029F6AF00000-memory.dmp

                                                                  Filesize

                                                                  192KB

                                                                  Download

                                                                • memory/2940-311-0x00007FFB57320000-0x00007FFB5733A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2940-49-0x0000029F6ADE0000-0x0000029F6ADE8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-50-0x0000029F6B090000-0x0000029F6B0B2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2940-51-0x0000029F6AFB0000-0x0000029F6AFCA000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2940-52-0x0000029F6ADE0000-0x0000029F6ADEA000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/2940-53-0x0000029F6AFB0000-0x0000029F6AFC2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/2940-54-0x0000029F6AFB0000-0x0000029F6AFD0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2940-55-0x0000029F6B740000-0x0000029F6B7F0000-memory.dmp

                                                                  Filesize

                                                                  704KB

                                                                  Download

                                                                • memory/2940-56-0x0000029F6BEE0000-0x0000029F6C056000-memory.dmp

                                                                  Filesize

                                                                  1.5MB

                                                                  Download

                                                                • memory/2940-57-0x0000029F6B380000-0x0000029F6B3A2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2940-58-0x0000029F6C1E0000-0x0000029F6C3EA000-memory.dmp

                                                                  Filesize

                                                                  2.0MB

                                                                  Download

                                                                • memory/2940-59-0x0000029F6AEC0000-0x0000029F6AED0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/2940-60-0x0000029F6B380000-0x0000029F6B3AA000-memory.dmp

                                                                  Filesize

                                                                  168KB

                                                                  Download

                                                                • memory/2940-61-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-63-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-62-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-64-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-65-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-67-0x0000029F6B560000-0x0000029F6B5AA000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/2940-66-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-68-0x0000029F6AEC0000-0x0000029F6AED0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/2940-69-0x0000029F6B3A0000-0x0000029F6B3C0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2940-70-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-71-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-72-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-73-0x0000029F6AEC0000-0x0000029F6AEC8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-74-0x0000029F6B910000-0x0000029F6B976000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/2940-75-0x0000029F6B5A0000-0x0000029F6B5BA000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2940-26-0x00007FFB44F70000-0x00007FFB45A32000-memory.dmp

                                                                  Filesize

                                                                  10.8MB

                                                                  Download

                                                                • memory/2940-266-0x00007FFB56C10000-0x00007FFB56C46000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                  Download

                                                                • memory/2940-267-0x0000029F6AC70000-0x0000029F6ACA6000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                  Download

                                                                • memory/2940-277-0x0000029F6AE00000-0x0000029F6AE14000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                  Download

                                                                • memory/2940-282-0x00007FFB40690000-0x00007FFB407C9000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2940-287-0x00007FFB562F0000-0x00007FFB56327000-memory.dmp

                                                                  Filesize

                                                                  220KB

                                                                  Download

                                                                • memory/2940-294-0x00007FFB570F0000-0x00007FFB57111000-memory.dmp

                                                                  Filesize

                                                                  132KB

                                                                  Download

                                                                • memory/2940-296-0x00007FFB57320000-0x00007FFB5733C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/2940-298-0x00007FFB40030000-0x00007FFB401C7000-memory.dmp

                                                                  Filesize

                                                                  1.6MB

                                                                  Download

                                                                • memory/2940-301-0x00007FFB57320000-0x00007FFB57339000-memory.dmp

                                                                  Filesize

                                                                  100KB

                                                                  Download

                                                                • memory/2940-304-0x00007FFB56B80000-0x00007FFB56BA2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2940-307-0x00007FFB51FF0000-0x00007FFB52032000-memory.dmp

                                                                  Filesize

                                                                  264KB

                                                                  Download

                                                                • memory/2940-48-0x0000029F6ADE0000-0x0000029F6ADEE000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/2940-308-0x00007FFB51FF0000-0x00007FFB52034000-memory.dmp

                                                                  Filesize

                                                                  272KB

                                                                  Download

                                                                • memory/2940-313-0x00007FFB3FF80000-0x00007FFB401C4000-memory.dmp

                                                                  Filesize

                                                                  2.3MB

                                                                  Download

                                                                • memory/2940-47-0x0000029F6ADE0000-0x0000029F6ADE8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/2940-46-0x0000029F6B500000-0x0000029F6B59C000-memory.dmp

                                                                  Filesize

                                                                  624KB

                                                                  Download

                                                                • memory/2940-45-0x0000029F6B500000-0x0000029F6B57C000-memory.dmp

                                                                  Filesize

                                                                  496KB

                                                                  Download

                                                                • memory/2940-44-0x0000029F6AE40000-0x0000029F6AE5E000-memory.dmp

                                                                  Filesize

                                                                  120KB

                                                                  Download

                                                                • memory/2940-43-0x0000029F6B740000-0x0000029F6BB09000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/2940-42-0x0000029F6AEA0000-0x0000029F6AEC2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2940-41-0x0000029F6B090000-0x0000029F6B0F0000-memory.dmp

                                                                  Filesize

                                                                  384KB

                                                                  Download

                                                                • memory/2940-40-0x0000029F6B5C0000-0x0000029F6B67A000-memory.dmp

                                                                  Filesize

                                                                  744KB

                                                                  Download

                                                                • memory/2940-25-0x0000029F4F9F0000-0x0000029F4F9FE000-memory.dmp

                                                                  Filesize

                                                                  56KB

                                                                  Download

                                                                • memory/2940-38-0x0000029F517A0000-0x0000029F517B0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/2940-37-0x0000029F6AEF0000-0x0000029F6AF34000-memory.dmp

                                                                  Filesize

                                                                  272KB

                                                                  Download

                                                                • memory/2940-36-0x0000029F6B2A0000-0x0000029F6B3C2000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/2940-35-0x0000029F6AE40000-0x0000029F6AE5A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2940-34-0x0000029F6AF30000-0x0000029F6AFD4000-memory.dmp

                                                                  Filesize

                                                                  656KB

                                                                  Download

                                                                • memory/2940-33-0x0000029F6AFE0000-0x0000029F6B13A000-memory.dmp

                                                                  Filesize

                                                                  1.4MB

                                                                  Download

                                                                • memory/2940-32-0x0000029F6AE40000-0x0000029F6AE58000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/2940-31-0x0000029F517A0000-0x0000029F517B0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/2940-30-0x0000029F6ADE0000-0x0000029F6ADF4000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                  Download

                                                                • memory/2940-27-0x0000029F4FE70000-0x0000029F4FE80000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/2940-29-0x0000029F6ADE0000-0x0000029F6ADFC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/2940-28-0x0000029F4FE90000-0x0000029F4FE9A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/3052-504-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3052-503-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3052-506-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3052-509-0x00007FFB65260000-0x00007FFB6531D000-memory.dmp

                                                                  Filesize

                                                                  756KB

                                                                  Download

                                                                • memory/3052-501-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3052-512-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3052-502-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                  Download

                                                                • memory/3224-259-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/3284-482-0x000001EEDC980000-0x000001EEDCA28000-memory.dmp

                                                                  Filesize

                                                                  672KB

                                                                  Download

                                                                • memory/4740-0-0x0000020946180000-0x0000020946196000-memory.dmp

                                                                  Filesize

                                                                  88KB

                                                                  Download

                                                                • memory/4740-9-0x00007FFB44F70000-0x00007FFB45A32000-memory.dmp

                                                                  Filesize

                                                                  10.8MB

                                                                  Download

                                                                • memory/4740-5-0x0000020960690000-0x00000209606F4000-memory.dmp

                                                                  Filesize

                                                                  400KB

                                                                  Download

                                                                • memory/4740-4-0x0000020947F90000-0x0000020947FAE000-memory.dmp

                                                                  Filesize

                                                                  120KB

                                                                  Download

                                                                • memory/4740-3-0x0000020960850000-0x00000209608C6000-memory.dmp

                                                                  Filesize

                                                                  472KB

                                                                  Download

                                                                • memory/4740-2-0x0000020960750000-0x0000020960760000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/4740-1-0x00007FFB44F70000-0x00007FFB45A32000-memory.dmp

                                                                  Filesize

                                                                  10.8MB

                                                                  Download