Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 10:48

General

  • Target

    30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe

  • Size

    515KB

  • MD5

    148b2c38cf0726535d760a703f803c80

  • SHA1

    107503ca149f547d4745fe9b9a3fbae03d60126c

  • SHA256

    30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d

  • SHA512

    6b9c13d80fb24924604245f9046c28df75d009c6cd6f819ef2ac6e99a592acfc84473b4fcc6e2c1ccafd6001bb4a931a8ced6a968bd874e2ebf81cd8c714bdbd

  • SSDEEP

    12288:EMbx504bFjsNfn8lmwaYy//2hWc8CYBMQI4aqNA:Lbw4bR689aYy//2hDPYBMQI4aqN

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    cmd.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe
    "C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1564
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1DD4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:5004
    • C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe
      "C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2948
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1832
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3296
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2980
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
    1⤵
      PID:3456
    • C:\ProgramData\cmd.exe
      C:\ProgramData\cmd.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\cmd.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4148
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1996
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC94.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:5112
      • C:\ProgramData\cmd.exe
        "C:\ProgramData\cmd.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:228
    • C:\ProgramData\cmd.exe
      C:\ProgramData\cmd.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\cmd.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4816
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4524
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA30C.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:4712
      • C:\ProgramData\cmd.exe
        "C:\ProgramData\cmd.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2324

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\cmd.exe

      Filesize

      515KB

      MD5

      148b2c38cf0726535d760a703f803c80

      SHA1

      107503ca149f547d4745fe9b9a3fbae03d60126c

      SHA256

      30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d

      SHA512

      6b9c13d80fb24924604245f9046c28df75d009c6cd6f819ef2ac6e99a592acfc84473b4fcc6e2c1ccafd6001bb4a931a8ced6a968bd874e2ebf81cd8c714bdbd

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cmd.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      4311ae8171a1b4b6f3112bd3e242841d

      SHA1

      79bc53d0cc2de993934c92bf8aa8cae2805240d1

      SHA256

      fbd07a3f61985b3e073181648352c65673ccc25b88605fdf5712db50a162763b

      SHA512

      f2f431a04317b3dfe48fb41a97d2e63120e3c8dfe5cf4fccb289d593d4e4f2c6e0d7d110b166ea40d04a137027199da95041d99102bf4966035f6154cc43512c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      f37a5347c5e0303f901aa11f16889f2c

      SHA1

      fc18b5e5c7ba9ec1bb6a6767b33c27483b30076d

      SHA256

      200639109561a487d0f32220ca00f20bca9006e23515c83e2eea4fc9670993fa

      SHA512

      9089ad71d140240493c94a8fe341c828bfcb9e975598c26118a287688283da4010a5d2aceec755ff3b29f8054df07ba0abfdae8b86663388b77bb407b441a1c8

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      c0f92d8499fcb499af77ae87dd1db298

      SHA1

      213943a776a71477968630cdf186d96d5e483ed0

      SHA256

      1ab10190fb93b1e5686e6fe58f282a9bc57661efb02804a429e40a71387b54de

      SHA512

      879d04940152cbb1b14a737a8511a2f8d603291b770533242335cdcfb089c698d0e29ac10d86f6f875ca11a0932fc92774010c45227a2b797cb8f87069506982

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      b2ce37edad0a562c40c60e2d49b96254

      SHA1

      eb28bcd9d384eb37b2ce9dde9fa09246477c992d

      SHA256

      34bd2daa5eb370cafe05f7b0273a95d2324c8f3506a8f9c8e2c45ab667959b9b

      SHA512

      a04051636a503fe31f0b3dfb1f88902dc47f9a61352251ab7533684a3a4119e791673cf3827bdf1342fe494b35c3d24540ece6925224092985c91201490410f1

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      9KB

      MD5

      5a63b093c01b02ea37355b389a0bd7df

      SHA1

      c25eba0c42312d79dcccba8c67e9ff8ccaea7dc0

      SHA256

      99d6f796bb03d36a78a2e37d059f209baa0541b26ae23efe596bfdae5e428f14

      SHA512

      21e0cd7568d8264d78b7d852a5d18eeab8680e6c7a865a8aa7459f7dca497ccd942558150077357938de43348bfd4498a0fc5c8bf05a5e05b2e16ae91cd9c438

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      116d4b6595f977aa65acc5d1b2c09cba

      SHA1

      c52ff1e93b089098fc153bc3f5ad4ad6ac145fc6

      SHA256

      fd876fd6736d858e9eacb67db89079cc3392b69ef8f443be6fddcdf8ad78a1d2

      SHA512

      3d76df969e17092aecfa364b8ff29ec3d33823d43d2b4152917a7197d668f9645ddc91dbfce30ad255efd6533c0dfb9cc9910f6d228c2fb9115914d662e329fd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      9ac4f0123bc33d81d3f59f95955c457e

      SHA1

      09f0880a463c8ce183c8b32b28d283a9e2bcc246

      SHA256

      45811a97c9afbac5faadb5c5e0f6340fc8f7781aa3f013df0efff9eb9e24d23f

      SHA512

      c9f25f716bd7848c1497f26b2e0a362f1ed641ebc45bbbc24a88d0b9c2cfec2a8df40a44471b4a2c1b1771d8b62ceed67b4276e5d7dbde678e7d759051ae9bd1

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      3d93e9b3b1828d167b45a70a3d585191

      SHA1

      293da9aab3091897ca5580f7aae9d77cdc11a2b2

      SHA256

      80fe0d5a7ae8fe54487d23b2521ef26a04abd7dff54cfe1930bcccee0f2d66d0

      SHA512

      0f96c187c97a435856ad9514e429b67628ead7c44b78886ab0229ff36db0069d12511ca07017e508e16cd588888b5b634c5a7c0b910cd452f232acd3f364cb98

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c5ytugco.fwl.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\explorer.exe

      Filesize

      1KB

      MD5

      47a1349d06eae691dabf98cc933f2e0f

      SHA1

      ce62a5aa67e8c167aa0b6b64ecbdac7d29f4730b

      SHA256

      4b91eb0a8142ae93d284d57613f21a8112fcbea026dbf4e810cf130d0ed51bcd

      SHA512

      5d9ad8bc9340ed851cf2a76158cb91b122e1bd52322fc131bb49a1c959e628197aad3cc56f215c9488ea161f9137dab0ad8ed6cffc87726447b662e2830eb92e

    • C:\Users\Admin\AppData\Local\Temp\explorer.exe

      Filesize

      1KB

      MD5

      c61ec9a30fca46b0b8f3edb41b0e0bde

      SHA1

      508f13282b4d41009f60dddc939246bb41c5beb6

      SHA256

      4972ec42fe96e910399b8323b6af5f8a80a966ea567e8d6ee08558c6c750b15b

      SHA512

      b2dc4c652e4e5388cd00e6ad041fc639ab2c82f25bed82b12bf3d4f685985f3a0e1b73c83d99e872d4149fbc59a161b285a4c0f2ba3b3c6a6cb3fba80f6936f6

    • C:\Users\Admin\AppData\Local\Temp\explorer.exe

      Filesize

      1KB

      MD5

      a58e024a498d2d65891d53c48db4359c

      SHA1

      22baf45820cf21b769debfa98d4afcf2b7306161

      SHA256

      38cce372b260b28b834ccf81a6628bfe43f449c3a391e1ad7913efe33162230a

      SHA512

      3d99f7fa228d27499eab0343622eec0d54e45d40a2828cd10349155d35a26a3d1220c1bfcbc8f6507c44db9a034dcfc0e0bb6b06bbbd2e786a399a89cfce3500

    • C:\Users\Admin\AppData\Local\Temp\tmp1DD4.tmp

      Filesize

      1KB

      MD5

      80e59a8b52173ac74b711bc8a50c85be

      SHA1

      931d8a1b799b6537bec2a980952a1b553732d5ae

      SHA256

      b669b5a788b72fcf3993906424a416f4e3c4e20ecb7cb7fad9b7796f85d0f320

      SHA512

      8394be8a38f83b87092031714cc71837033b879462bdfab41605a1a9a51e641215d521473612757f38b6e21b930cc5fe43545dc6de2a2c8bc96e0b9e00d5229e

    • memory/1564-83-0x0000000007390000-0x00000000073A1000-memory.dmp

      Filesize

      68KB

    • memory/1564-85-0x00000000073D0000-0x00000000073E4000-memory.dmp

      Filesize

      80KB

    • memory/1564-86-0x00000000074D0000-0x00000000074EA000-memory.dmp

      Filesize

      104KB

    • memory/1564-72-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

      Filesize

      304KB

    • memory/1832-130-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/1996-239-0x000000006EF00000-0x000000006EF4C000-memory.dmp

      Filesize

      304KB

    • memory/2012-3-0x0000000004CA0000-0x0000000004D32000-memory.dmp

      Filesize

      584KB

    • memory/2012-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

      Filesize

      4KB

    • memory/2012-9-0x0000000008C10000-0x0000000008CAC000-memory.dmp

      Filesize

      624KB

    • memory/2012-51-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-2-0x0000000005250000-0x00000000057F4000-memory.dmp

      Filesize

      5.6MB

    • memory/2012-4-0x0000000004C50000-0x0000000004C5A000-memory.dmp

      Filesize

      40KB

    • memory/2012-1-0x0000000000310000-0x0000000000398000-memory.dmp

      Filesize

      544KB

    • memory/2012-5-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2012-6-0x0000000004E50000-0x0000000004E6A000-memory.dmp

      Filesize

      104KB

    • memory/2012-7-0x0000000004E70000-0x0000000004E80000-memory.dmp

      Filesize

      64KB

    • memory/2012-8-0x0000000006120000-0x000000000617A000-memory.dmp

      Filesize

      360KB

    • memory/2120-44-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2948-105-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

      Filesize

      304KB

    • memory/2948-106-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/2948-103-0x0000000006300000-0x0000000006654000-memory.dmp

      Filesize

      3.3MB

    • memory/2948-116-0x0000000007BF0000-0x0000000007C93000-memory.dmp

      Filesize

      652KB

    • memory/2948-117-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

      Filesize

      68KB

    • memory/2948-118-0x0000000007EF0000-0x0000000007F04000-memory.dmp

      Filesize

      80KB

    • memory/3296-152-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/3296-150-0x0000000006190000-0x00000000064E4000-memory.dmp

      Filesize

      3.3MB

    • memory/3960-173-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/4148-238-0x00000000073A0000-0x00000000073B4000-memory.dmp

      Filesize

      80KB

    • memory/4148-237-0x0000000007360000-0x0000000007371000-memory.dmp

      Filesize

      68KB

    • memory/4148-236-0x0000000007080000-0x0000000007123000-memory.dmp

      Filesize

      652KB

    • memory/4148-226-0x000000006EF00000-0x000000006EF4C000-memory.dmp

      Filesize

      304KB

    • memory/4148-211-0x0000000005E60000-0x0000000005EAC000-memory.dmp

      Filesize

      304KB

    • memory/4148-191-0x00000000057D0000-0x0000000005B24000-memory.dmp

      Filesize

      3.3MB

    • memory/4292-67-0x0000000006F10000-0x0000000006F2E000-memory.dmp

      Filesize

      120KB

    • memory/4292-82-0x00000000074F0000-0x0000000007586000-memory.dmp

      Filesize

      600KB

    • memory/4292-87-0x0000000007590000-0x0000000007598000-memory.dmp

      Filesize

      32KB

    • memory/4292-57-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

      Filesize

      304KB

    • memory/4292-30-0x0000000005FE0000-0x000000000602C000-memory.dmp

      Filesize

      304KB

    • memory/4292-28-0x0000000005F50000-0x0000000005F6E000-memory.dmp

      Filesize

      120KB

    • memory/4292-56-0x0000000006510000-0x0000000006542000-memory.dmp

      Filesize

      200KB

    • memory/4292-27-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-69-0x00000000078B0000-0x0000000007F2A000-memory.dmp

      Filesize

      6.5MB

    • memory/4292-26-0x0000000005A60000-0x0000000005DB4000-memory.dmp

      Filesize

      3.3MB

    • memory/4292-21-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-70-0x0000000007270000-0x000000000728A000-memory.dmp

      Filesize

      104KB

    • memory/4292-71-0x00000000072E0000-0x00000000072EA000-memory.dmp

      Filesize

      40KB

    • memory/4292-68-0x0000000007130000-0x00000000071D3000-memory.dmp

      Filesize

      652KB

    • memory/4292-84-0x00000000074A0000-0x00000000074AE000-memory.dmp

      Filesize

      56KB

    • memory/4292-93-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/4292-19-0x0000000005880000-0x00000000058E6000-memory.dmp

      Filesize

      408KB

    • memory/4292-20-0x00000000058F0000-0x0000000005956000-memory.dmp

      Filesize

      408KB

    • memory/4292-13-0x00000000056E0000-0x0000000005702000-memory.dmp

      Filesize

      136KB

    • memory/4292-10-0x0000000002620000-0x0000000002656000-memory.dmp

      Filesize

      216KB

    • memory/4292-12-0x0000000005060000-0x0000000005688000-memory.dmp

      Filesize

      6.2MB

    • memory/4292-11-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/4524-300-0x000000006EFA0000-0x000000006EFEC000-memory.dmp

      Filesize

      304KB

    • memory/4816-267-0x0000000006CE0000-0x0000000006D2C000-memory.dmp

      Filesize

      304KB

    • memory/4816-290-0x000000006EFA0000-0x000000006EFEC000-memory.dmp

      Filesize

      304KB

    • memory/4816-265-0x0000000006210000-0x0000000006564000-memory.dmp

      Filesize

      3.3MB