Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 06:06

General

  • Target

    fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe

  • Size

    385KB

  • MD5

    b289e58e4bfd1f1577b480dcbd0b00d1

  • SHA1

    70700a0b417fbbe9285984e7925d88a4091a2aff

  • SHA256

    fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d618bd91f2102c9c3760

  • SHA512

    9387fe7fc4f561f832e7069597d05f39df8ecf9513fa787913567dbc52f9fa49ed3559cbe78af8605b98e04176b1521a97d701245e092f710a2f6d0a8915d707

  • SSDEEP

    6144:6ziAiPfbfHD4kF4Ncf1N6lGOnF+ZNi9Vwsa:6uhPzfj4kF43T0P2ys

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 25 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3108
      • C:\Users\Admin\AppData\Local\Temp\fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe
        "C:\Users\Admin\AppData\Local\Temp\fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3872
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:4432
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1780
          3⤵
          • Program crash
          PID:3324
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4568
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2732
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3600
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3280
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1088
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:2696
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2780
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2432
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3708
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3696
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:1640
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1200
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:3684
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:4100
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:3164
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:3092
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:3312
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:3848
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:4040
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:968
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:4544
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3400
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:416
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3840
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2692 -ip 2692
                  1⤵
                    PID:2040
                  • C:\Program Files\Google\Chrome\updater.exe
                    "C:\Program Files\Google\Chrome\updater.exe"
                    1⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2452

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\Google\Chrome\updater.exe

                    Filesize

                    9.7MB

                    MD5

                    84741bc02d2e9226a943aa03b6a4568d

                    SHA1

                    617d01316011faf77fba30d49ae1e86ff988380a

                    SHA256

                    fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                    SHA512

                    1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                  • C:\Program Files\Google\Chrome\updater.exe

                    Filesize

                    9.7MB

                    MD5

                    84741bc02d2e9226a943aa03b6a4568d

                    SHA1

                    617d01316011faf77fba30d49ae1e86ff988380a

                    SHA256

                    fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                    SHA512

                    1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                    Filesize

                    2KB

                    MD5

                    d85ba6ff808d9e5444a4b369f5bc2730

                    SHA1

                    31aa9d96590fff6981b315e0b391b575e4c0804a

                    SHA256

                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                    SHA512

                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    6d3e9c29fe44e90aae6ed30ccf799ca8

                    SHA1

                    c7974ef72264bbdf13a2793ccf1aed11bc565dce

                    SHA256

                    2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                    SHA512

                    60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vk1l3so1.qrx.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\mi.exe

                    Filesize

                    9.9MB

                    MD5

                    80b0b41decb53a01e8c87def18400267

                    SHA1

                    885f327c4e91065486137ca96105190f7a29d0f9

                    SHA256

                    10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                    SHA512

                    19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                  • C:\Users\Admin\AppData\Local\Temp\mi.exe

                    Filesize

                    9.9MB

                    MD5

                    80b0b41decb53a01e8c87def18400267

                    SHA1

                    885f327c4e91065486137ca96105190f7a29d0f9

                    SHA256

                    10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                    SHA512

                    19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                  • C:\Users\Admin\AppData\Local\Temp\mi.exe

                    Filesize

                    9.9MB

                    MD5

                    80b0b41decb53a01e8c87def18400267

                    SHA1

                    885f327c4e91065486137ca96105190f7a29d0f9

                    SHA256

                    10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                    SHA512

                    19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                  • C:\Windows\System32\drivers\etc\hosts

                    Filesize

                    3KB

                    MD5

                    2d29fd3ae57f422e2b2121141dc82253

                    SHA1

                    c2464c857779c0ab4f5e766f5028fcc651a6c6b7

                    SHA256

                    80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

                    SHA512

                    077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

                  • C:\Windows\Temp\setup.exe

                    Filesize

                    9.7MB

                    MD5

                    84741bc02d2e9226a943aa03b6a4568d

                    SHA1

                    617d01316011faf77fba30d49ae1e86ff988380a

                    SHA256

                    fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                    SHA512

                    1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                  • C:\Windows\Temp\setup.exe

                    Filesize

                    9.7MB

                    MD5

                    84741bc02d2e9226a943aa03b6a4568d

                    SHA1

                    617d01316011faf77fba30d49ae1e86ff988380a

                    SHA256

                    fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                    SHA512

                    1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                  • C:\Windows\Temp\setup.exe

                    Filesize

                    9.7MB

                    MD5

                    84741bc02d2e9226a943aa03b6a4568d

                    SHA1

                    617d01316011faf77fba30d49ae1e86ff988380a

                    SHA256

                    fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                    SHA512

                    1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                  • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                    Filesize

                    4KB

                    MD5

                    bdb25c22d14ec917e30faf353826c5de

                    SHA1

                    6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                    SHA256

                    e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                    SHA512

                    b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                  • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    1KB

                    MD5

                    b42c70c1dbf0d1d477ec86902db9e986

                    SHA1

                    1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                    SHA256

                    8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                    SHA512

                    57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                  • memory/416-314-0x00007FF710F20000-0x00007FF710F4A000-memory.dmp

                    Filesize

                    168KB

                  • memory/416-318-0x00007FF710F20000-0x00007FF710F4A000-memory.dmp

                    Filesize

                    168KB

                  • memory/1200-270-0x000001DFD19C0000-0x000001DFD19C8000-memory.dmp

                    Filesize

                    32KB

                  • memory/1200-265-0x000001DFD19D0000-0x000001DFD19EC000-memory.dmp

                    Filesize

                    112KB

                  • memory/1200-250-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/1200-251-0x000001DFCF3A0000-0x000001DFCF3B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1200-252-0x000001DFCF3A0000-0x000001DFCF3B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1200-276-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/1200-273-0x000001DFCF3A0000-0x000001DFCF3B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1200-272-0x000001DFD1A00000-0x000001DFD1A0A000-memory.dmp

                    Filesize

                    40KB

                  • memory/1200-271-0x000001DFD19F0000-0x000001DFD19F6000-memory.dmp

                    Filesize

                    24KB

                  • memory/1200-269-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/1200-268-0x000001DFD1A10000-0x000001DFD1A2A000-memory.dmp

                    Filesize

                    104KB

                  • memory/1200-267-0x000001DFD19B0000-0x000001DFD19BA000-memory.dmp

                    Filesize

                    40KB

                  • memory/1200-253-0x00007FF4321F0000-0x00007FF432200000-memory.dmp

                    Filesize

                    64KB

                  • memory/1200-263-0x000001DFD1790000-0x000001DFD17AC000-memory.dmp

                    Filesize

                    112KB

                  • memory/1200-264-0x000001DFD1580000-0x000001DFD158A000-memory.dmp

                    Filesize

                    40KB

                  • memory/2452-232-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-266-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-303-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-312-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-313-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2452-240-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2452-239-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-238-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-237-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-236-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-235-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-234-0x00007FF69FDD0000-0x00007FF6A0FF6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/2452-233-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/2692-140-0x0000000006AD0000-0x0000000007074000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/2692-145-0x0000000002340000-0x0000000002440000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2692-135-0x0000000002490000-0x00000000024CF000-memory.dmp

                    Filesize

                    252KB

                  • memory/2692-136-0x0000000000400000-0x0000000002308000-memory.dmp

                    Filesize

                    31.0MB

                  • memory/2692-143-0x000000000CD20000-0x000000000CD32000-memory.dmp

                    Filesize

                    72KB

                  • memory/2692-153-0x000000000D150000-0x000000000D1B6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2692-154-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2692-137-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2692-142-0x000000000CC10000-0x000000000CD1A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/2692-155-0x000000000D960000-0x000000000DB22000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/2692-138-0x0000000075120000-0x00000000758D0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2692-139-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2692-152-0x000000000D0B0000-0x000000000D142000-memory.dmp

                    Filesize

                    584KB

                  • memory/2692-141-0x000000000C5B0000-0x000000000CBC8000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/2692-156-0x000000000DB30000-0x000000000E05C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/2692-144-0x000000000CD40000-0x000000000CD7C000-memory.dmp

                    Filesize

                    240KB

                  • memory/2692-157-0x000000000E270000-0x000000000E2C0000-memory.dmp

                    Filesize

                    320KB

                  • memory/2692-158-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2692-151-0x000000000D030000-0x000000000D0A6000-memory.dmp

                    Filesize

                    472KB

                  • memory/2692-134-0x0000000002340000-0x0000000002440000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2692-150-0x0000000075120000-0x00000000758D0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2692-189-0x0000000075120000-0x00000000758D0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/2692-149-0x0000000006AC0000-0x0000000006AD0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2692-148-0x0000000002490000-0x00000000024CF000-memory.dmp

                    Filesize

                    252KB

                  • memory/2692-185-0x0000000000400000-0x0000000002308000-memory.dmp

                    Filesize

                    31.0MB

                  • memory/2692-146-0x0000000000400000-0x0000000002308000-memory.dmp

                    Filesize

                    31.0MB

                  • memory/3400-293-0x00007FF483570000-0x00007FF483580000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-290-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3400-306-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3400-304-0x0000018533C40000-0x0000018533C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-292-0x0000018533C40000-0x0000018533C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-291-0x0000018533C40000-0x0000018533C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/3696-222-0x000002C289A70000-0x000002C289A80000-memory.dmp

                    Filesize

                    64KB

                  • memory/3696-225-0x000002C289A70000-0x000002C289A80000-memory.dmp

                    Filesize

                    64KB

                  • memory/3696-212-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3696-227-0x00007FFE27D00000-0x00007FFE287C1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3696-223-0x000002C289A70000-0x000002C289A80000-memory.dmp

                    Filesize

                    64KB

                  • memory/3840-325-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-323-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-321-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-319-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-317-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-315-0x00007FF7182E0000-0x00007FF718ACF000-memory.dmp

                    Filesize

                    7.9MB

                  • memory/3840-311-0x0000000001270000-0x0000000001290000-memory.dmp

                    Filesize

                    128KB

                  • memory/4432-229-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-194-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4432-184-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-183-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4432-182-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-186-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-187-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-181-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-188-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-190-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-230-0x00007FFE46930000-0x00007FFE46B25000-memory.dmp

                    Filesize

                    2.0MB

                  • memory/4432-191-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4432-192-0x00007FF741B80000-0x00007FF742DA6000-memory.dmp

                    Filesize

                    18.1MB

                  • memory/4568-205-0x00007FFE27BE0000-0x00007FFE286A1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4568-206-0x000001A2C8350000-0x000001A2C8360000-memory.dmp

                    Filesize

                    64KB

                  • memory/4568-195-0x000001A2AFDD0000-0x000001A2AFDF2000-memory.dmp

                    Filesize

                    136KB

                  • memory/4568-209-0x00007FFE27BE0000-0x00007FFE286A1000-memory.dmp

                    Filesize

                    10.8MB