Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2023 06:06

General

  • Target

    fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe

  • Size

    385KB

  • MD5

    b289e58e4bfd1f1577b480dcbd0b00d1

  • SHA1

    70700a0b417fbbe9285984e7925d88a4091a2aff

  • SHA256

    fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d618bd91f2102c9c3760

  • SHA512

    9387fe7fc4f561f832e7069597d05f39df8ecf9513fa787913567dbc52f9fa49ed3559cbe78af8605b98e04176b1521a97d701245e092f710a2f6d0a8915d707

  • SSDEEP

    6144:6ziAiPfbfHD4kF4Ncf1N6lGOnF+ZNi9Vwsa:6uhPzfj4kF43T0P2ys

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 26 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe
        "C:\Users\Admin\AppData\Local\Temp\fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe"
        2⤵
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:2692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:368
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2424
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:1632
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2224
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1844
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1056
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1336
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:832
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:688
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:908
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:2604
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:2900
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:1752
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:2404
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:804
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2412
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3020
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2688
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2408
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Creates scheduled task(s)
            PID:2972
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:2668
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2704
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {4B039321-D243-4C0B-979E-2845BE7C5C5E} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1028

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          6c1e68954c21ae279ed0c0cf7948c7e8

          SHA1

          6296c19322fde9da6deb2e1448dd0f6266d9f829

          SHA256

          33ae8c280e32a5d489dd13df1a249e008e6c09dcb8a3607fce906b09269bdc38

          SHA512

          22e6ac1ec81cd90b734d721912af730c26fa65e2b250bf1050bd286931ea7da6372553e44e8411ee0d2a02a5e52ee7eaf36208a8579e5cbbef58a02c363978f1

        • C:\Users\Admin\AppData\Local\Temp\CabBC30.tmp

          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

        • C:\Users\Admin\AppData\Local\Temp\TarBD1D.tmp

          Filesize

          164KB

          MD5

          4ff65ad929cd9a367680e0e5b1c08166

          SHA1

          c0af0d4396bd1f15c45f39d3b849ba444233b3a2

          SHA256

          c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

          SHA512

          f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          b89560217118a1645c561ebd3e025412

          SHA1

          02ca57a3ca2aa2abed2a2eda11c576ab751d9463

          SHA256

          1214a47f1f0d504e4fd74e398d05c656297964ee40e9e42498b1a158f2610455

          SHA512

          29d05418fc5dd7a656c379d3bd641ade2b331af00346b01540131e2034d6d2c6002f4cf1e903519e640c7978a7da624000f90236e2b60df45a992fda003bbdec

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1VFB2A0487RHW50JMPL.temp

          Filesize

          7KB

          MD5

          b89560217118a1645c561ebd3e025412

          SHA1

          02ca57a3ca2aa2abed2a2eda11c576ab751d9463

          SHA256

          1214a47f1f0d504e4fd74e398d05c656297964ee40e9e42498b1a158f2610455

          SHA512

          29d05418fc5dd7a656c379d3bd641ade2b331af00346b01540131e2034d6d2c6002f4cf1e903519e640c7978a7da624000f90236e2b60df45a992fda003bbdec

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          2KB

          MD5

          2b19df2da3af86adf584efbddd0d31c0

          SHA1

          f1738910789e169213611c033d83bc9577373686

          SHA256

          58868a299c5cf1167ed3fbc570a449ecd696406410b24913ddbd0f06a32595bd

          SHA512

          4a1831f42a486a0ad2deef3d348e7220209214699504e29fdfeb2a6f7f25ad1d353158cd05778f76ef755e77ccd94ce9b4a7504039e439e4e90fa7cde589daa6

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • \Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • memory/364-194-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/364-204-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/368-170-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/368-169-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/368-168-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/368-167-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/368-171-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/368-164-0x000000001B180000-0x000000001B462000-memory.dmp

          Filesize

          2.9MB

        • memory/368-166-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/368-165-0x0000000002420000-0x0000000002428000-memory.dmp

          Filesize

          32KB

        • memory/1028-206-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/1028-196-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-230-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/1028-228-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-205-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-203-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-202-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-201-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-200-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-199-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-198-0x000000013F6E0000-0x0000000140906000-memory.dmp

          Filesize

          18.1MB

        • memory/1028-197-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/1720-215-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1720-209-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1720-214-0x0000000000E40000-0x0000000000EC0000-memory.dmp

          Filesize

          512KB

        • memory/1720-213-0x0000000000E40000-0x0000000000EC0000-memory.dmp

          Filesize

          512KB

        • memory/1720-212-0x0000000000E40000-0x0000000000EC0000-memory.dmp

          Filesize

          512KB

        • memory/1720-211-0x0000000000E40000-0x0000000000EC0000-memory.dmp

          Filesize

          512KB

        • memory/1720-210-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

          Filesize

          9.6MB

        • memory/1948-182-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/1948-181-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/1948-183-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/1948-180-0x0000000002320000-0x0000000002328000-memory.dmp

          Filesize

          32KB

        • memory/1948-184-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/1948-178-0x000000001B1A0000-0x000000001B482000-memory.dmp

          Filesize

          2.9MB

        • memory/1948-185-0x00000000025C0000-0x0000000002640000-memory.dmp

          Filesize

          512KB

        • memory/1948-186-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/1948-179-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/2136-148-0x00000000043F0000-0x0000000005616000-memory.dmp

          Filesize

          18.1MB

        • memory/2408-219-0x0000000000DD0000-0x0000000000E50000-memory.dmp

          Filesize

          512KB

        • memory/2408-218-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/2408-223-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/2408-222-0x0000000000DD0000-0x0000000000E50000-memory.dmp

          Filesize

          512KB

        • memory/2408-221-0x0000000000DD0000-0x0000000000E50000-memory.dmp

          Filesize

          512KB

        • memory/2408-220-0x000007FEF4C70000-0x000007FEF560D000-memory.dmp

          Filesize

          9.6MB

        • memory/2588-55-0x0000000000400000-0x0000000002308000-memory.dmp

          Filesize

          31.0MB

        • memory/2588-54-0x0000000000250000-0x0000000000350000-memory.dmp

          Filesize

          1024KB

        • memory/2588-138-0x0000000000250000-0x0000000000350000-memory.dmp

          Filesize

          1024KB

        • memory/2588-137-0x0000000000400000-0x0000000002308000-memory.dmp

          Filesize

          31.0MB

        • memory/2588-61-0x0000000003E70000-0x0000000003EA4000-memory.dmp

          Filesize

          208KB

        • memory/2588-60-0x0000000006760000-0x00000000067A0000-memory.dmp

          Filesize

          256KB

        • memory/2588-59-0x0000000006760000-0x00000000067A0000-memory.dmp

          Filesize

          256KB

        • memory/2588-58-0x0000000074410000-0x0000000074AFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2588-139-0x0000000074410000-0x0000000074AFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2588-56-0x0000000003A30000-0x0000000003A6F000-memory.dmp

          Filesize

          252KB

        • memory/2588-57-0x0000000003F90000-0x0000000003FC8000-memory.dmp

          Filesize

          224KB

        • memory/2588-62-0x0000000003F40000-0x0000000003F46000-memory.dmp

          Filesize

          24KB

        • memory/2588-63-0x0000000006760000-0x00000000067A0000-memory.dmp

          Filesize

          256KB

        • memory/2588-64-0x0000000000250000-0x0000000000350000-memory.dmp

          Filesize

          1024KB

        • memory/2588-66-0x0000000074410000-0x0000000074AFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2588-67-0x0000000006760000-0x00000000067A0000-memory.dmp

          Filesize

          256KB

        • memory/2668-231-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/2668-235-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/2692-187-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-153-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-151-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-154-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-155-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-156-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-157-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-191-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2692-150-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-149-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2692-152-0x000000013F090000-0x00000001402B6000-memory.dmp

          Filesize

          18.1MB

        • memory/2692-158-0x0000000077420000-0x00000000775C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2704-232-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2704-234-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2704-236-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2704-229-0x00000000000B0000-0x00000000000D0000-memory.dmp

          Filesize

          128KB

        • memory/2704-238-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2704-240-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2704-242-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB