Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:02

General

  • Target

    4f069274cbda8e32401c5c9715e4d52fb292f25380d066dec1b34c90c08ff85b.exe

  • Size

    1.8MB

  • MD5

    50a992ea9dd26394d22fb62cb5e81945

  • SHA1

    209d1dd77dc602c66ebca38e42d3cf6b06e669a4

  • SHA256

    4f069274cbda8e32401c5c9715e4d52fb292f25380d066dec1b34c90c08ff85b

  • SHA512

    bd79b798c7677db1214a9e0053c93c0c236ee9acb143c17e5ae7acb744b46daa06cdc1bc095de5f202ddf45f7552c9457cea81738159d5e29977777864c77ec8

  • SSDEEP

    49152:Gx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAMzzNG4QjJOL:GvbjVkjjCAzJNxG4k6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Modifies data under HKEY_USERS 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f069274cbda8e32401c5c9715e4d52fb292f25380d066dec1b34c90c08ff85b.exe
    "C:\Users\Admin\AppData\Local\Temp\4f069274cbda8e32401c5c9715e4d52fb292f25380d066dec1b34c90c08ff85b.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1688
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2172
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:1612
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2540
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1512
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1028
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1d8 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2428
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 260 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1f0 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 258 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1468
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 258 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:660
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:744
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2500
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2768
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:488
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1288
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1460
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1544
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1284
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1316
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2780
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2716
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    1.6MB

    MD5

    da88b29361e911330a4b347b5395ca84

    SHA1

    c11a45178d23ce49f9ae6b223f31559d6136d656

    SHA256

    be531bdc1def8f2c2e2bc2456e351633c180c1bb91b8efab9af9056224ed5f92

    SHA512

    3a344fcd761eec60642db4551ccc3cc4c9390cfcc727f3c1474066c885352948ad009d4a7081eba5ca17e8731e33572e106be435d96db411c344a8ae8832619f

  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

    Filesize

    30.1MB

    MD5

    e47d7614b7bd9d9f71c9744e0387560f

    SHA1

    55b80dc123e6b07b831e047f6360cef594bf4694

    SHA256

    acd3883418e72939ef7a7482fdd3a6c43158423f73c12804cab0360ff34168ef

    SHA512

    98f816a07f107a1cbfc2dc9f59fab860dc1a11ed9b8c1f2f39fd3ac0971a3d9a16f86cf422e8046fbfe6485a1df02d28a286c9ecc96e2dd39b12dc7badde7261

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    1.7MB

    MD5

    8cb7b0e44e8ebf16e2bc15c1dcabb605

    SHA1

    335c98843c7b579c40c2692360136eef0f51f129

    SHA256

    84b3111500332f45679c64479d31809293f167b25df37325713724a2e41150f0

    SHA512

    27f6540c6492b68ad294554e56d2909250b4cf283fbde186ca8b7c3cf1c28409e838a00d0c955adc9162d77b2fbb3b9d7f00402cb5db7becbd062134d137ff56

  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    Filesize

    5.2MB

    MD5

    92ccd06a4b2e43872f0b2b0dfc90d528

    SHA1

    a4faad5eecf91fc3201ab90d5c8fbcad78e021fb

    SHA256

    d58f052de6d285b823324819552034975da1df2c3c7d9893f57b3b551149fae8

    SHA512

    d2335c31d8ee92a03ba87a2125cb21a17e1d65c9ee306006aa1cf200c90dae538b64bcc824aa85d7b407c9b23a32da5dc7eb2fa3454ea58a8b089fc9df9305f2

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

    Filesize

    2.1MB

    MD5

    57c069f8fc0b254ea4513a0c1f9b2845

    SHA1

    f75956e1b7bdc4020157fe1379fea6cf7ea62325

    SHA256

    5dec75dfe39b34c05f6032028a04447f8f6632831b9cdb35c70e61f41ae38adb

    SHA512

    e7572cef648bcc2668da93d812e24291a31f9ccc3c8e81c1e57b1a756743f148397dccac56bb65523596c778a0ec439dee94325f16e5c0e80c24232034c52800

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

    Filesize

    24B

    MD5

    b9bd716de6739e51c620f2086f9c31e4

    SHA1

    9733d94607a3cba277e567af584510edd9febf62

    SHA256

    7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

    SHA512

    cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

    Filesize

    1.5MB

    MD5

    13cf2a44e88c250086e0b9b75334e069

    SHA1

    486eba83b6482f3407e1e22419808f7b40faf616

    SHA256

    b0608220d5e7f8d33d2860cdc21014f481a7593300622935f09582502a7d2a3b

    SHA512

    c44612fca646b73a682adcddffd8a8e3ad47e4074f93269a4933eeafd9bbf3c758809c86e736492e651f7f80e27d15e00e3faaa3393b7c19f880313870dc4c96

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

    Filesize

    872KB

    MD5

    78cd264e35c9e415ec40be9f2e431c79

    SHA1

    bbf44efc08101898cd1ac8603fa88e3d5e48f0db

    SHA256

    694ecc4ce520143fbfbe9bf2198b88548790f65ef8c0fd123f03c90cff90573e

    SHA512

    a224eaf594b1ab57e5dc27e5df995694f36c453aba70a404eeed8f9c205ece60688db61eb82a70ea30f7f1d0a01767bce7dd610efe293395d99eaf062cf5a6c6

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    Filesize

    1.6MB

    MD5

    41a5670930e57d39c842cffc5d108add

    SHA1

    5a8e6a765d8a297df64282b2c3f757a633357ac6

    SHA256

    acc6ef48546c04d8bb72319c217365110beb4e638ecdd1ebc8c2ecdc799bd9d8

    SHA512

    9e3691668b00c37f21f9d731e121cde6ffd06effa1b64ccc96d1514e966f01a4c2332dd936cd996a3abeb438f3d68e8f134ddb8e21319415ac7929f212adf5e0

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

    Filesize

    1.5MB

    MD5

    298d934c3bd6c72e32b236f4d7a1a457

    SHA1

    bc628d3576b89815c2e8d4609a5ce6813f8b67ee

    SHA256

    87cbafd3cded0c01add4a7b7100635c676488742f25d2e1edc0b98038f1f7274

    SHA512

    8a68333811941d693c071a24f393244178d50386a2512a9227562297e87642e31a6e25bb29b5653a42674073e88ad38ab3ac0ffab4b00559bc803d5a10294c8b

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

    Filesize

    1003KB

    MD5

    d49cb2f6ff88b6537f1c1ffbd6ebf12d

    SHA1

    3102823ef27f61346fa94912f3f67e66ebfdf1bd

    SHA256

    8a2b165be7c5bc67438ca4011c17f9a58c89206eab548a85e23fc92fa1577439

    SHA512

    27305438a21b43e5954ac7ba0891c92aa838ff4dcbe6d244651b3488dec865fdea785a2efe4b35ab336bb6886c36f318b2c5e7be74746d65838c28ed35b516a7

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    Filesize

    1.5MB

    MD5

    3d82440480f3a0b082d39575d29a53e5

    SHA1

    21b6abf1b03d2be1b474a1766eb4d6533bb1ab77

    SHA256

    6968260fb4f5830e63964bc29ba77f40396580f1c5e6ea45d0f781946493b9eb

    SHA512

    c77c5431dfe49c5fe35c7aa07ad3d055c96d8cd165fa08ab7f6632518af5e10341457c9413ed37070a6b230c9411759edcba33c9531d4cdda49bcdc6b8901aa3

  • C:\Windows\System32\dllhost.exe

    Filesize

    1.5MB

    MD5

    81349d8fb3d131db56a5af455470ade7

    SHA1

    3261d12bdf15e4235ff154823ec9ff0f08828926

    SHA256

    b703e81b83a86f0aee36e2073e9d40683c96aeca30d14de6d449ba7856b9fef9

    SHA512

    65957ecf30b089d448b8aceaa4c7bf9eb053f76249d336623205f6b246949cb2f78e701bc8de664cd1ecb81fabcaba63ecd79c5bf7da53f0553795fd9dc43e62

  • C:\Windows\system32\fxssvc.exe

    Filesize

    1.2MB

    MD5

    8435100289ad9c5b8b6fbcf07e39f9b5

    SHA1

    236f3e270a1b6412e0640f2213d0a4c0e94efa30

    SHA256

    c40c98f0e57a8b63b5d6068cb6b913d6102040e59487f2776d19d0f10f0940cb

    SHA512

    857fcdda6f7c8e4e2f2e16337ec197c2e346f758fed9d6a076de0ac21fc7e53bb2e3c08e19246fa650e7921ffcac370d9f905eeed9e0be20fad7758cee5f09fe

  • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

    Filesize

    1.5MB

    MD5

    a72ecd810cd5ea78d84512ea7c2fbf16

    SHA1

    8618043d305c61cace58c63eb6799be83c1e74d6

    SHA256

    a7edd3ec7633f938d0cba7d0841051fb83a96f4d7e0115ccfa599abe4e5a2076

    SHA512

    f7789150a147b28aa3394501a802aa289d5f22345c3494d490289b62102aac619afc4757776cee13f4b1846b14fac4f3e6e36bc7165e4529f4923b7bd4de9890

  • \Windows\System32\alg.exe

    Filesize

    1.5MB

    MD5

    e12b61da24e6b3bb92a4092ab5e4e6a6

    SHA1

    6ee4bdc95c58c8877c1bd1b497d1f143bdfbc009

    SHA256

    5bf88a11cd78e8177d6d90a32f1b2b2920ac33c0188928a0e4a071c6baa152a4

    SHA512

    aaf8c43164ebd79e0799ff9f9087666d0fb7430394662c74dedc521d88f9130515db2c5afa7dda6506247d3ba7d3087776803188cae7d4e6f3803f43e01f3fb7

  • \Windows\ehome\ehrecvr.exe

    Filesize

    1.2MB

    MD5

    88f72595181689004835456047bf6d9c

    SHA1

    f52d34588b6136bcff140914aa59084e7d016771

    SHA256

    d383be7a26b86a78a545f7b84155b88c93d42e895ea703217d8c8745c7f8c8ec

    SHA512

    7392f67c48576093ca4370f69e59f28a201c2a99bdefc848e67d2951113f2e6cb3327e1c63fd39b1d34196eef1648924680671748fb0d99e4e955147a9f6f870

  • \Windows\ehome\ehsched.exe

    Filesize

    1.6MB

    MD5

    058f3010c6f6dacd8c889e86d8804ab1

    SHA1

    528a0dd521e06c941e11c5c78ad4261d1eb13958

    SHA256

    75c0431994a6817890f887243473732f61794d2e9aa83fadf7b3cb533f22e696

    SHA512

    ebe8ec0dfe9e2cf8f9475e9b41704966208dc56601caff3124da68457de9666a0161c21a4e8b7be2c6d2bb06554857e7d481a5aab21dd347c88b0e75e23b150b

  • memory/488-174-0x0000000140000000-0x0000000140199000-memory.dmp

    Filesize

    1.6MB

  • memory/488-335-0x0000000140000000-0x0000000140199000-memory.dmp

    Filesize

    1.6MB

  • memory/488-173-0x0000000000BC0000-0x0000000000C20000-memory.dmp

    Filesize

    384KB

  • memory/488-183-0x0000000000BC0000-0x0000000000C20000-memory.dmp

    Filesize

    384KB

  • memory/744-294-0x0000000000220000-0x0000000000280000-memory.dmp

    Filesize

    384KB

  • memory/744-296-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/744-268-0x0000000000220000-0x0000000000280000-memory.dmp

    Filesize

    384KB

  • memory/744-295-0x0000000140000000-0x0000000140195000-memory.dmp

    Filesize

    1.6MB

  • memory/744-281-0x0000000000220000-0x0000000000280000-memory.dmp

    Filesize

    384KB

  • memory/744-367-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/1028-390-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/1028-393-0x0000000000AD0000-0x0000000000B37000-memory.dmp

    Filesize

    412KB

  • memory/1028-411-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1028-355-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1028-341-0x0000000000AD0000-0x0000000000B37000-memory.dmp

    Filesize

    412KB

  • memory/1028-337-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-128-0x0000000000B50000-0x0000000000BB7000-memory.dmp

    Filesize

    412KB

  • memory/1032-123-0x0000000000B50000-0x0000000000BB7000-memory.dmp

    Filesize

    412KB

  • memory/1032-122-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/1032-192-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/1284-368-0x00000000001D0000-0x0000000000230000-memory.dmp

    Filesize

    384KB

  • memory/1284-360-0x0000000100000000-0x000000010017C000-memory.dmp

    Filesize

    1.5MB

  • memory/1316-386-0x000000002E000000-0x000000002FE1E000-memory.dmp

    Filesize

    30.1MB

  • memory/1408-145-0x0000000140000000-0x0000000140195000-memory.dmp

    Filesize

    1.6MB

  • memory/1408-146-0x0000000000480000-0x00000000004E0000-memory.dmp

    Filesize

    384KB

  • memory/1408-297-0x0000000140000000-0x0000000140195000-memory.dmp

    Filesize

    1.6MB

  • memory/1408-138-0x0000000000480000-0x00000000004E0000-memory.dmp

    Filesize

    384KB

  • memory/1460-354-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

  • memory/1460-189-0x00000000008D0000-0x0000000000930000-memory.dmp

    Filesize

    384KB

  • memory/1460-402-0x00000000008D0000-0x0000000000930000-memory.dmp

    Filesize

    384KB

  • memory/1460-352-0x00000000008D0000-0x0000000000930000-memory.dmp

    Filesize

    384KB

  • memory/1460-190-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

  • memory/1512-115-0x0000000010000000-0x000000001018E000-memory.dmp

    Filesize

    1.6MB

  • memory/1544-317-0x0000000000E30000-0x0000000000EB0000-memory.dmp

    Filesize

    512KB

  • memory/1544-278-0x000007FEF3FE0000-0x000007FEF497D000-memory.dmp

    Filesize

    9.6MB

  • memory/1544-280-0x000007FEF3FE0000-0x000007FEF497D000-memory.dmp

    Filesize

    9.6MB

  • memory/1544-346-0x000007FEF3FE0000-0x000007FEF497D000-memory.dmp

    Filesize

    9.6MB

  • memory/1544-279-0x0000000000E30000-0x0000000000EB0000-memory.dmp

    Filesize

    512KB

  • memory/1544-316-0x0000000000E30000-0x0000000000EB0000-memory.dmp

    Filesize

    512KB

  • memory/1600-401-0x0000000000230000-0x0000000000297000-memory.dmp

    Filesize

    412KB

  • memory/1600-395-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/1612-172-0x0000000140000000-0x0000000140184000-memory.dmp

    Filesize

    1.5MB

  • memory/1612-95-0x0000000140000000-0x0000000140184000-memory.dmp

    Filesize

    1.5MB

  • memory/1688-129-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/1688-270-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/1688-7-0x00000000005E0000-0x0000000000647000-memory.dmp

    Filesize

    412KB

  • memory/1688-1-0x00000000005E0000-0x0000000000647000-memory.dmp

    Filesize

    412KB

  • memory/1688-0-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2172-16-0x0000000000890000-0x00000000008F0000-memory.dmp

    Filesize

    384KB

  • memory/2172-17-0x0000000100000000-0x000000010018B000-memory.dmp

    Filesize

    1.5MB

  • memory/2172-89-0x0000000000890000-0x00000000008F0000-memory.dmp

    Filesize

    384KB

  • memory/2172-87-0x0000000000890000-0x00000000008F0000-memory.dmp

    Filesize

    384KB

  • memory/2172-159-0x0000000100000000-0x000000010018B000-memory.dmp

    Filesize

    1.5MB

  • memory/2428-388-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2428-406-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2428-375-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/2428-405-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/2428-383-0x0000000000800000-0x0000000000867000-memory.dmp

    Filesize

    412KB

  • memory/2500-314-0x0000000000530000-0x0000000000590000-memory.dmp

    Filesize

    384KB

  • memory/2500-298-0x0000000000530000-0x0000000000590000-memory.dmp

    Filesize

    384KB

  • memory/2500-359-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2500-313-0x0000000140000000-0x0000000140195000-memory.dmp

    Filesize

    1.6MB

  • memory/2500-315-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2540-99-0x0000000010000000-0x0000000010186000-memory.dmp

    Filesize

    1.5MB

  • memory/2540-98-0x0000000000410000-0x0000000000477000-memory.dmp

    Filesize

    412KB

  • memory/2540-136-0x0000000010000000-0x0000000010186000-memory.dmp

    Filesize

    1.5MB

  • memory/2540-105-0x0000000000410000-0x0000000000477000-memory.dmp

    Filesize

    412KB

  • memory/2552-329-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2552-344-0x0000000073A10000-0x00000000740FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2552-342-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/2552-326-0x0000000000400000-0x000000000058F000-memory.dmp

    Filesize

    1.6MB

  • memory/2552-327-0x0000000000600000-0x0000000000667000-memory.dmp

    Filesize

    412KB

  • memory/2768-161-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

  • memory/2768-328-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

  • memory/2768-167-0x00000000002B0000-0x0000000000310000-memory.dmp

    Filesize

    384KB

  • memory/2768-160-0x00000000002B0000-0x0000000000310000-memory.dmp

    Filesize

    384KB

  • memory/2768-176-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

    Filesize

    64KB

  • memory/2768-178-0x0000000000DF0000-0x0000000000E00000-memory.dmp

    Filesize

    64KB

  • memory/2768-185-0x0000000001A30000-0x0000000001A31000-memory.dmp

    Filesize

    4KB