Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 14:53

General

  • Target

    cryptedfile.exe

  • Size

    7.5MB

  • MD5

    e6af53b2f350d68371d8a55a244b84f1

  • SHA1

    0e245a4b8c8d421e98dfa537d11ed0d1d1a1f7d5

  • SHA256

    cc9844de1e847151ddb427976e540e146af4508d6c97f86ea5badb7c65cf4437

  • SHA512

    eb788765bfd6600beb08b8e975135c73e232696d70b2e1cc2fca9da63b66eecaba75ac1345e2925268a09f02f5d6d5f752297aa992c5407aed31d4fd71fc130d

  • SSDEEP

    196608:748H+uHTXObt2xDo1Sa4EEY1wM1ZJjWh9+u4:M8H+SbOR2BUSavf1d1Zawu4

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:52733

stories-boulevard.gl.at.ply.gg:52733

points-detect.gl.at.ply.gg:52733

points-detect.gl.at.ply.gg:35608:52733

region-vip.gl.at.ply.gg:52733

Attributes
  • Install_directory

    %AppData%

  • install_file

    explorer.exe

  • telegram

    https://api.telegram.org/bot6976323003:AAGzNfsdTYlBPbGEbbSm--c7mAZ9PZzt9Xw/sendMessage?chat_id=5476035148

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cryptedfile.exe
    "C:\Users\Admin\AppData\Local\Temp\cryptedfile.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Local\Temp\explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Users\Admin\AppData\Local\Temp\Built.exe
        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2460
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4836
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4028
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:408
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:552
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4408
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:6040
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:6140

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              bd5940f08d0be56e65e5f2aaf47c538e

              SHA1

              d7e31b87866e5e383ab5499da64aba50f03e8443

              SHA256

              2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

              SHA512

              c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

            • C:\Users\Admin\AppData\Local\Temp\Built.exe

              Filesize

              7.4MB

              MD5

              022c90d2b607ce098df042969f1ff10c

              SHA1

              ba9e320d766bc4e131c51c115275dc0efe2b8df6

              SHA256

              60e2391c0b640cbed4d5773ad9d65a54dd07e03afa18d410ef8b08d90a2a3b07

              SHA512

              84cbcc875dd977d8b319fa68a472bf6ec3b7f923e43ab10fd88102bc02f46180820e427416bb5a95da57302b151703df298b9eb9c37ac93e98da0e181a7a5f31

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\VCRUNTIME140.dll

              Filesize

              116KB

              MD5

              be8dbe2dc77ebe7f88f910c61aec691a

              SHA1

              a19f08bb2b1c1de5bb61daf9f2304531321e0e40

              SHA256

              4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

              SHA512

              0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_bz2.pyd

              Filesize

              48KB

              MD5

              341a6188f375c6702de4f9d0e1de8c08

              SHA1

              204a508ca6a13eb030ed7953595e9b79b9b9ba3b

              SHA256

              7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e

              SHA512

              5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_ctypes.pyd

              Filesize

              58KB

              MD5

              ee2d4cd284d6bad4f207195bf5de727f

              SHA1

              781344a403bbffa0afb080942cd9459d9b05a348

              SHA256

              2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009

              SHA512

              a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_decimal.pyd

              Filesize

              106KB

              MD5

              918e513c376a52a1046c4d4aee87042d

              SHA1

              d54edc813f56c17700252f487ef978bde1e7f7e1

              SHA256

              f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29

              SHA512

              ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_hashlib.pyd

              Filesize

              35KB

              MD5

              6d2132108825afd85763fc3b8f612b11

              SHA1

              af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0

              SHA256

              aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52

              SHA512

              196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_lzma.pyd

              Filesize

              86KB

              MD5

              5eee7d45b8d89c291965a153d86592ee

              SHA1

              93562dcdb10bd93433c7275d991681b299f45660

              SHA256

              7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9

              SHA512

              0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_queue.pyd

              Filesize

              25KB

              MD5

              8b3ba5fb207d27eb3632486b936396a3

              SHA1

              5ad45b469041d88ec7fd277d84b1e2093ec7f93e

              SHA256

              9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051

              SHA512

              18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_socket.pyd

              Filesize

              43KB

              MD5

              3ea95c5c76ea27ca44b7a55f6cfdcf53

              SHA1

              aace156795cfb6f418b6a68a254bb4adfc2afc56

              SHA256

              7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923

              SHA512

              916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_sqlite3.pyd

              Filesize

              56KB

              MD5

              c9d6ffa3798bb5ae9f1b082d66901350

              SHA1

              25724fecf4369447e77283ece810def499318086

              SHA256

              410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec

              SHA512

              878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\_ssl.pyd

              Filesize

              65KB

              MD5

              936919f3509b2a913bf9e05723bc7cd2

              SHA1

              6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd

              SHA256

              efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3

              SHA512

              2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\base_library.zip

              Filesize

              1.4MB

              MD5

              9d84222015f5e2d8afb5ec74d6808ad0

              SHA1

              38f7c2439e7829cbd2837be1f8b0380ce5c8e444

              SHA256

              20adf37360e803029eb7f0a99ec882f277765193f6d4bed683a391c06959581f

              SHA512

              5939f286d47d8ad459521042781d666ff4f99a7b1e4c5747f32f4b3604abca9171fa777ea6453f2e169a4c62931d960b231894fa8faaae0e531c0f232a30e906

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\blank.aes

              Filesize

              117KB

              MD5

              fcd2a0afcdd171e5fbb84b4cfaac2bf2

              SHA1

              227f2b1ccebd278897d83ce8213c8a092828d8e8

              SHA256

              b9eec542fc7fca3229d8ae9d4f47a7d9dc1543aaaeb5babe5bbe62300955fbc5

              SHA512

              f8f425cc73c1703415c722b8f327eaf16739e4a83e6f41abbf2e9c8f0fefe29988c7ad903dffa8f988e6fde7695f36b9ad2ef5c0123c73b1bbcc09a8eb84d6b1

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\blank.aes

              Filesize

              117KB

              MD5

              291948ee8e8927f3a74e829695ff9b43

              SHA1

              2d28ac4941f4095b8ac4340e4b626af45da15625

              SHA256

              035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a

              SHA512

              924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\libcrypto-3.dll

              Filesize

              1.6MB

              MD5

              27515b5bb912701abb4dfad186b1da1f

              SHA1

              3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

              SHA256

              fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

              SHA512

              087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\libffi-8.dll

              Filesize

              29KB

              MD5

              08b000c3d990bc018fcb91a1e175e06e

              SHA1

              bd0ce09bb3414d11c91316113c2becfff0862d0d

              SHA256

              135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

              SHA512

              8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\libssl-3.dll

              Filesize

              223KB

              MD5

              6eda5a055b164e5e798429dcd94f5b88

              SHA1

              2c5494379d1efe6b0a101801e09f10a7cb82dbe9

              SHA256

              377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

              SHA512

              74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\python311.dll

              Filesize

              1.6MB

              MD5

              76eb1ad615ba6600ce747bf1acde6679

              SHA1

              d3e1318077217372653be3947635b93df68156a4

              SHA256

              30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

              SHA512

              2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\rar.exe

              Filesize

              615KB

              MD5

              9c223575ae5b9544bc3d69ac6364f75e

              SHA1

              8a1cb5ee02c742e937febc57609ac312247ba386

              SHA256

              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

              SHA512

              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\rarreg.key

              Filesize

              456B

              MD5

              4531984cad7dacf24c086830068c4abe

              SHA1

              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

              SHA256

              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

              SHA512

              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\select.pyd

              Filesize

              25KB

              MD5

              2398a631bae547d1d33e91335e6d210b

              SHA1

              f1f10f901da76323d68a4c9b57f5edfd3baf30f5

              SHA256

              487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435

              SHA512

              6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\sqlite3.dll

              Filesize

              630KB

              MD5

              cc9d1869f9305b5a695fc5e76bd57b72

              SHA1

              c6a28791035e7e10cfae0ab51e9a5a8328ea55c1

              SHA256

              31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee

              SHA512

              e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

            • C:\Users\Admin\AppData\Local\Temp\_MEI36482\unicodedata.pyd

              Filesize

              295KB

              MD5

              6279c26d085d1b2efd53e9c3e74d0285

              SHA1

              bd0d274fb9502406b6b9a5756760b78919fa2518

              SHA256

              411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6

              SHA512

              30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjkdxtym.gum.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\explorer.exe

              Filesize

              81KB

              MD5

              6d2de4d8e6da9b41140a5c67bdf549b0

              SHA1

              8774a939e41a7debb2bb784c0bb953d28fc53274

              SHA256

              0c652dbd9acd1062ebd77d70f2f71d174e6584fc7ba52f2bb52435dd3c9c21f5

              SHA512

              3959a3be932ef26109755663dca3ea2c2d6383163c26fb8011d242405a4ee533e73c60ef667c4025f23ba9d252cb07c1ac64715f7c00b8497fc320e019035a97

            • memory/1652-124-0x0000000002B60000-0x0000000002B70000-memory.dmp

              Filesize

              64KB

            • memory/1652-152-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/1652-25-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/1652-17-0x0000000000B70000-0x0000000000B8A000-memory.dmp

              Filesize

              104KB

            • memory/1652-179-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/2460-142-0x000001B0C2510000-0x000001B0C2520000-memory.dmp

              Filesize

              64KB

            • memory/2460-137-0x000001B0DAC70000-0x000001B0DAC92000-memory.dmp

              Filesize

              136KB

            • memory/2460-166-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/2460-138-0x000001B0C2510000-0x000001B0C2520000-memory.dmp

              Filesize

              64KB

            • memory/2460-125-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/2460-126-0x000001B0C2510000-0x000001B0C2520000-memory.dmp

              Filesize

              64KB

            • memory/2460-127-0x000001B0C2510000-0x000001B0C2520000-memory.dmp

              Filesize

              64KB

            • memory/3664-1-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/3664-3-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

              Filesize

              64KB

            • memory/3664-46-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/3664-0-0x0000000000380000-0x0000000000AD2000-memory.dmp

              Filesize

              7.3MB

            • memory/4124-122-0x00007FFC80340000-0x00007FFC80359000-memory.dmp

              Filesize

              100KB

            • memory/4124-93-0x00007FFC875B0000-0x00007FFC875C9000-memory.dmp

              Filesize

              100KB

            • memory/4124-107-0x00007FFC73990000-0x00007FFC73B06000-memory.dmp

              Filesize

              1.5MB

            • memory/4124-121-0x00007FFC88DB0000-0x00007FFC88DBD000-memory.dmp

              Filesize

              52KB

            • memory/4124-94-0x00007FFC73CB0000-0x00007FFC73CD3000-memory.dmp

              Filesize

              140KB

            • memory/4124-57-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp

              Filesize

              5.9MB

            • memory/4124-123-0x00007FFC70710000-0x00007FFC7082C000-memory.dmp

              Filesize

              1.1MB

            • memory/4124-171-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp

              Filesize

              5.9MB

            • memory/4124-119-0x00007FFC73720000-0x00007FFC73734000-memory.dmp

              Filesize

              80KB

            • memory/4124-117-0x00000159B7E10000-0x00000159B8332000-memory.dmp

              Filesize

              5.1MB

            • memory/4124-113-0x00007FFC73810000-0x00007FFC738DD000-memory.dmp

              Filesize

              820KB

            • memory/4124-109-0x00007FFC88FA0000-0x00007FFC88FAD000-memory.dmp

              Filesize

              52KB

            • memory/4124-172-0x00007FFC70710000-0x00007FFC7082C000-memory.dmp

              Filesize

              1.1MB

            • memory/4124-80-0x00007FFC8A2B0000-0x00007FFC8A2BF000-memory.dmp

              Filesize

              60KB

            • memory/4124-115-0x00007FFC6FD10000-0x00007FFC70232000-memory.dmp

              Filesize

              5.1MB

            • memory/4124-169-0x00007FFC73720000-0x00007FFC73734000-memory.dmp

              Filesize

              80KB

            • memory/4124-111-0x00007FFC738E0000-0x00007FFC73913000-memory.dmp

              Filesize

              204KB

            • memory/4124-170-0x00007FFC88DB0000-0x00007FFC88DBD000-memory.dmp

              Filesize

              52KB

            • memory/4124-165-0x00007FFC738E0000-0x00007FFC73913000-memory.dmp

              Filesize

              204KB

            • memory/4124-168-0x00007FFC6FD10000-0x00007FFC70232000-memory.dmp

              Filesize

              5.1MB

            • memory/4124-167-0x00007FFC73810000-0x00007FFC738DD000-memory.dmp

              Filesize

              820KB

            • memory/4124-164-0x00007FFC88FA0000-0x00007FFC88FAD000-memory.dmp

              Filesize

              52KB

            • memory/4124-92-0x00007FFC73CE0000-0x00007FFC73D0D000-memory.dmp

              Filesize

              180KB

            • memory/4124-79-0x00007FFC84AC0000-0x00007FFC84AE4000-memory.dmp

              Filesize

              144KB

            • memory/4124-163-0x00007FFC80340000-0x00007FFC80359000-memory.dmp

              Filesize

              100KB

            • memory/4124-154-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp

              Filesize

              5.9MB

            • memory/4124-156-0x00007FFC8A2B0000-0x00007FFC8A2BF000-memory.dmp

              Filesize

              60KB

            • memory/4124-155-0x00007FFC84AC0000-0x00007FFC84AE4000-memory.dmp

              Filesize

              144KB

            • memory/4124-157-0x00007FFC73CE0000-0x00007FFC73D0D000-memory.dmp

              Filesize

              180KB

            • memory/4124-158-0x00007FFC875B0000-0x00007FFC875C9000-memory.dmp

              Filesize

              100KB

            • memory/4124-159-0x00007FFC73CB0000-0x00007FFC73CD3000-memory.dmp

              Filesize

              140KB

            • memory/4124-160-0x00007FFC73990000-0x00007FFC73B06000-memory.dmp

              Filesize

              1.5MB

            • memory/4408-91-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-120-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-116-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-118-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-112-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-82-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-106-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-81-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-108-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4408-114-0x0000018DD0690000-0x0000018DD0691000-memory.dmp

              Filesize

              4KB

            • memory/4836-139-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/4836-173-0x0000026B8FAB0000-0x0000026B8FAC0000-memory.dmp

              Filesize

              64KB

            • memory/4836-153-0x0000026B8FAB0000-0x0000026B8FAC0000-memory.dmp

              Filesize

              64KB

            • memory/4836-141-0x0000026B8FAB0000-0x0000026B8FAC0000-memory.dmp

              Filesize

              64KB

            • memory/4836-178-0x00007FFC78140000-0x00007FFC78C01000-memory.dmp

              Filesize

              10.8MB

            • memory/4836-140-0x0000026B8FAB0000-0x0000026B8FAC0000-memory.dmp

              Filesize

              64KB