Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2023 06:20

General

  • Target

    2588-61-0x0000000003E70000-0x0000000003EA4000-memory.exe

  • Size

    208KB

  • MD5

    d5b12454c999ea8b174e094da3ad1caa

  • SHA1

    78d6f1bcf392587d68b7eb1c0b8de4807e05c944

  • SHA256

    9c7b4f71c5a32da120b8fc3ab5e29facb953196351e2f6f58cf5030f0aa09568

  • SHA512

    a9a6e780629561bf921887bd5270f2d60fdfb5831abdec471bb0cd7dd9b563c9d041191f8490f33181ea702b6c05ca12df2c4e0b89a5d99bc3965ce66b8c042e

  • SSDEEP

    3072:4eG4mt57f3YInEGK2U/YetUBaVa0b6AyM9w+Zxwak8e8hV:S4mt57gInEG3YetMb6

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 28 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\2588-61-0x0000000003E70000-0x0000000003EA4000-memory.exe
        "C:\Users\Admin\AppData\Local\Temp\2588-61-0x0000000003E70000-0x0000000003EA4000-memory.exe"
        2⤵
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1840
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:788
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1448
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3020
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2812
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2992
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:2708
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1584
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:960
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1812
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1560
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:1252
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2416
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3012
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1216
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:2472
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:888
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:1700
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1908
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:2124
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2672
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2392
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1476
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1416
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Creates scheduled task(s)
            PID:1696
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:2316
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {0B40C90E-EDC3-43D9-952E-CCC9B7DF66D7} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1284

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          8cc9943fd06e9a92050887259a4e3abd

          SHA1

          ba8de942c1a4c1a2d73b8e60e17c573029f6582d

          SHA256

          48d3a16fe3dcb8805a4076a2e6e30bd065f898cbbf87a4648414c08486613fb9

          SHA512

          4a8fd1dc6044e1220e94f6f31276e316ff749d93664288492ebee9c66e2e7fd088a80da9a593ba284be170e1055fa8f4d9e0e186c421676326d423fb02d6f6bb

        • C:\Users\Admin\AppData\Local\Temp\CabF93F.tmp

          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

        • C:\Users\Admin\AppData\Local\Temp\TarF9A0.tmp

          Filesize

          164KB

          MD5

          4ff65ad929cd9a367680e0e5b1c08166

          SHA1

          c0af0d4396bd1f15c45f39d3b849ba444233b3a2

          SHA256

          c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

          SHA512

          f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          0bc7b4b4f4ffe0ec4c24f028675b9470

          SHA1

          1af4518b0bc179ea15f8a9140cb2191230b7d1ea

          SHA256

          41f6075998a62c186388d98c805ab7c889befeb85d069367738756cd2b341d06

          SHA512

          ef24ec6b46f113dc12faa71d842d824abee5d1c51f34274c43f435232ae480d732b8acf7c83a6c550e635909cb329c7ffad03a49bd4ee0210e30fdcc516c6fb3

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NRXI7IT8VTPR1E46ZB87.temp

          Filesize

          7KB

          MD5

          0bc7b4b4f4ffe0ec4c24f028675b9470

          SHA1

          1af4518b0bc179ea15f8a9140cb2191230b7d1ea

          SHA256

          41f6075998a62c186388d98c805ab7c889befeb85d069367738756cd2b341d06

          SHA512

          ef24ec6b46f113dc12faa71d842d824abee5d1c51f34274c43f435232ae480d732b8acf7c83a6c550e635909cb329c7ffad03a49bd4ee0210e30fdcc516c6fb3

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          2KB

          MD5

          2b19df2da3af86adf584efbddd0d31c0

          SHA1

          f1738910789e169213611c033d83bc9577373686

          SHA256

          58868a299c5cf1167ed3fbc570a449ecd696406410b24913ddbd0f06a32595bd

          SHA512

          4a1831f42a486a0ad2deef3d348e7220209214699504e29fdfeb2a6f7f25ad1d353158cd05778f76ef755e77ccd94ce9b4a7504039e439e4e90fa7cde589daa6

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • \Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • memory/788-151-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

          Filesize

          9.6MB

        • memory/788-156-0x00000000021E0000-0x00000000021E8000-memory.dmp

          Filesize

          32KB

        • memory/788-157-0x0000000002750000-0x00000000027D0000-memory.dmp

          Filesize

          512KB

        • memory/788-158-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

          Filesize

          9.6MB

        • memory/788-155-0x0000000002750000-0x00000000027D0000-memory.dmp

          Filesize

          512KB

        • memory/788-154-0x000000001B180000-0x000000001B462000-memory.dmp

          Filesize

          2.9MB

        • memory/788-153-0x0000000002750000-0x00000000027D0000-memory.dmp

          Filesize

          512KB

        • memory/788-152-0x0000000002750000-0x00000000027D0000-memory.dmp

          Filesize

          512KB

        • memory/1284-190-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-189-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-185-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-191-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-192-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-193-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1284-201-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-184-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1284-183-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-186-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-217-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1284-215-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-187-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1284-188-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/1676-165-0x000000001B120000-0x000000001B402000-memory.dmp

          Filesize

          2.9MB

        • memory/1676-166-0x0000000001FA0000-0x0000000001FA8000-memory.dmp

          Filesize

          32KB

        • memory/1676-169-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1676-170-0x0000000002760000-0x00000000027E0000-memory.dmp

          Filesize

          512KB

        • memory/1676-171-0x0000000002760000-0x00000000027E0000-memory.dmp

          Filesize

          512KB

        • memory/1676-172-0x0000000002760000-0x00000000027E0000-memory.dmp

          Filesize

          512KB

        • memory/1676-173-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1676-168-0x0000000002760000-0x00000000027E0000-memory.dmp

          Filesize

          512KB

        • memory/1676-167-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1748-210-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1748-208-0x0000000000E10000-0x0000000000E90000-memory.dmp

          Filesize

          512KB

        • memory/1748-209-0x0000000000E10000-0x0000000000E90000-memory.dmp

          Filesize

          512KB

        • memory/1748-207-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1748-206-0x0000000000E10000-0x0000000000E90000-memory.dmp

          Filesize

          512KB

        • memory/1748-205-0x000007FEF4BC0000-0x000007FEF555D000-memory.dmp

          Filesize

          9.6MB

        • memory/1840-143-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-138-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1840-178-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1840-176-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-146-0x0000000076E30000-0x0000000076FD9000-memory.dmp

          Filesize

          1.7MB

        • memory/1840-145-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-140-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-139-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-142-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-136-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1840-141-0x000000013F680000-0x00000001408A6000-memory.dmp

          Filesize

          18.1MB

        • memory/1984-182-0x000000013F0D0000-0x00000001402F6000-memory.dmp

          Filesize

          18.1MB

        • memory/2316-218-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/2316-222-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/2600-54-0x0000000073E50000-0x000000007453E000-memory.dmp

          Filesize

          6.9MB

        • memory/2600-127-0x0000000073E50000-0x000000007453E000-memory.dmp

          Filesize

          6.9MB

        • memory/2600-53-0x0000000000A10000-0x0000000000A44000-memory.dmp

          Filesize

          208KB

        • memory/2600-55-0x0000000000230000-0x0000000000236000-memory.dmp

          Filesize

          24KB

        • memory/2600-56-0x0000000004880000-0x00000000048C0000-memory.dmp

          Filesize

          256KB

        • memory/2600-57-0x0000000073E50000-0x000000007453E000-memory.dmp

          Filesize

          6.9MB

        • memory/2600-58-0x0000000004880000-0x00000000048C0000-memory.dmp

          Filesize

          256KB

        • memory/2720-137-0x00000000044E0000-0x0000000005706000-memory.dmp

          Filesize

          18.1MB

        • memory/2720-144-0x00000000044E0000-0x0000000005706000-memory.dmp

          Filesize

          18.1MB

        • memory/2816-219-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-223-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-233-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-216-0x0000000000340000-0x0000000000360000-memory.dmp

          Filesize

          128KB

        • memory/2816-221-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-231-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-229-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-227-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2816-225-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/3012-196-0x0000000000F20000-0x0000000000FA0000-memory.dmp

          Filesize

          512KB

        • memory/3012-200-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

          Filesize

          9.6MB

        • memory/3012-199-0x0000000000F20000-0x0000000000FA0000-memory.dmp

          Filesize

          512KB

        • memory/3012-198-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

          Filesize

          9.6MB

        • memory/3012-195-0x0000000000F20000-0x0000000000FA0000-memory.dmp

          Filesize

          512KB

        • memory/3012-194-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

          Filesize

          9.6MB

        • memory/3012-197-0x0000000000F20000-0x0000000000FA0000-memory.dmp

          Filesize

          512KB