Analysis

  • max time kernel
    145s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2023 10:18

General

  • Target

    3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe

  • Size

    208KB

  • MD5

    1f90044095036f77dc1edee283b7ab03

  • SHA1

    2265afa4259496c5b45b8e61c97c98244b3de86d

  • SHA256

    c4efb8d7a199d7b85411e8a109e3d13982a1190be2d6237431379d5228552eba

  • SHA512

    16917231e2435abf74932c77e6935c25e9d26daca6798698e0417addc8953f8f6e5501c5d2fa17f43a6c10e0839be65ee420a17b09ce583401386aa2f03b7885

  • SSDEEP

    3072:4eG4mt57f3YInEGK2U/YetUBaVa0b6AyM9w+Zxwak8e8hV:S4mt57gInEG3YetMb6

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 27 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1220
      • C:\Users\Admin\AppData\Local\Temp\3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe
        "C:\Users\Admin\AppData\Local\Temp\3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe"
        2⤵
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1908
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:2476
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2808
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1720
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:112
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1824
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1284
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:364
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1788
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:952
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:1568
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:1592
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:1596
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:2852
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:1620
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1704
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2520
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1344
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2824
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2460
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Creates scheduled task(s)
            PID:2992
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:2832
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2348
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {CBE94712-5A36-4159-A5B2-95316D682A63} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2332
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:2576

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          f3cd5c16233ee82e5be287976a2f2262

          SHA1

          648cdee4b4194270861ef5dbb9c34b3ff706469f

          SHA256

          33e161225610f8734120a42396e2f2f033019d9d4dc57725d7f45c00e8bdab09

          SHA512

          1d81a59ff36a609d3858682ed6f6f61d7d4540708b76d183249a4960e77f90007e8d780c076398d2e7ebcd77bfa2131e226dca7c40dd4460177ccde700d37f63

        • C:\Users\Admin\AppData\Local\Temp\Cab9C70.tmp

          Filesize

          62KB

          MD5

          3ac860860707baaf32469fa7cc7c0192

          SHA1

          c33c2acdaba0e6fa41fd2f00f186804722477639

          SHA256

          d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

          SHA512

          d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

        • C:\Users\Admin\AppData\Local\Temp\Tar9D00.tmp

          Filesize

          164KB

          MD5

          4ff65ad929cd9a367680e0e5b1c08166

          SHA1

          c0af0d4396bd1f15c45f39d3b849ba444233b3a2

          SHA256

          c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

          SHA512

          f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          1b6e71dc9a30afb8ec6e1cc89aad6ace

          SHA1

          d38b6b72d0a1231959d306df035d2a1d8edb9af3

          SHA256

          e966fb6cdb67eeb23dc0a5285d7241ab8caf84ed1be63bb8153c142d3af346bf

          SHA512

          5f500e2e4734b6cff31e0eb7bda7f41b60f9c9734f031b50214ee1dbed93dc698d98506b7463ceb538f9b807f4490c658ce73537af002154e4e0fa144da91a72

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VV4LD19JGK2CVVLR5233.temp

          Filesize

          7KB

          MD5

          1b6e71dc9a30afb8ec6e1cc89aad6ace

          SHA1

          d38b6b72d0a1231959d306df035d2a1d8edb9af3

          SHA256

          e966fb6cdb67eeb23dc0a5285d7241ab8caf84ed1be63bb8153c142d3af346bf

          SHA512

          5f500e2e4734b6cff31e0eb7bda7f41b60f9c9734f031b50214ee1dbed93dc698d98506b7463ceb538f9b807f4490c658ce73537af002154e4e0fa144da91a72

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          2KB

          MD5

          2b19df2da3af86adf584efbddd0d31c0

          SHA1

          f1738910789e169213611c033d83bc9577373686

          SHA256

          58868a299c5cf1167ed3fbc570a449ecd696406410b24913ddbd0f06a32595bd

          SHA512

          4a1831f42a486a0ad2deef3d348e7220209214699504e29fdfeb2a6f7f25ad1d353158cd05778f76ef755e77ccd94ce9b4a7504039e439e4e90fa7cde589daa6

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • C:\Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Program Files\Google\Chrome\updater.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • \Users\Admin\AppData\Local\Temp\mi.exe

          Filesize

          9.9MB

          MD5

          80b0b41decb53a01e8c87def18400267

          SHA1

          885f327c4e91065486137ca96105190f7a29d0f9

          SHA256

          10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

          SHA512

          19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

        • \Windows\Temp\setup.exe

          Filesize

          9.7MB

          MD5

          84741bc02d2e9226a943aa03b6a4568d

          SHA1

          617d01316011faf77fba30d49ae1e86ff988380a

          SHA256

          fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

          SHA512

          1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

        • memory/1044-170-0x0000000002290000-0x0000000002310000-memory.dmp

          Filesize

          512KB

        • memory/1044-171-0x0000000002290000-0x0000000002310000-memory.dmp

          Filesize

          512KB

        • memory/1044-167-0x0000000002290000-0x0000000002310000-memory.dmp

          Filesize

          512KB

        • memory/1044-166-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1044-165-0x00000000023B0000-0x00000000023B8000-memory.dmp

          Filesize

          32KB

        • memory/1044-164-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

          Filesize

          2.9MB

        • memory/1044-169-0x0000000002290000-0x0000000002310000-memory.dmp

          Filesize

          512KB

        • memory/1044-168-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1044-172-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1300-209-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/1300-210-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/1300-213-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1300-211-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1300-207-0x000007FEF52E0000-0x000007FEF5C7D000-memory.dmp

          Filesize

          9.6MB

        • memory/1300-212-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/1300-208-0x0000000001100000-0x0000000001180000-memory.dmp

          Filesize

          512KB

        • memory/1632-154-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-153-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-158-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/1632-157-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-149-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/1632-155-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-148-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-163-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-150-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-151-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-152-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/1632-190-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/1632-189-0x000000013F420000-0x0000000140646000-memory.dmp

          Filesize

          18.1MB

        • memory/2060-179-0x000000001B140000-0x000000001B422000-memory.dmp

          Filesize

          2.9MB

        • memory/2060-186-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2060-185-0x0000000002620000-0x00000000026A0000-memory.dmp

          Filesize

          512KB

        • memory/2060-184-0x0000000002620000-0x00000000026A0000-memory.dmp

          Filesize

          512KB

        • memory/2060-181-0x0000000002620000-0x00000000026A0000-memory.dmp

          Filesize

          512KB

        • memory/2060-183-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2060-182-0x00000000022E0000-0x00000000022E8000-memory.dmp

          Filesize

          32KB

        • memory/2060-180-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2332-193-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2348-236-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2348-234-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2348-232-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2348-230-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2348-227-0x00000000004E0000-0x0000000000500000-memory.dmp

          Filesize

          128KB

        • memory/2348-238-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2348-240-0x0000000140000000-0x00000001407EF000-memory.dmp

          Filesize

          7.9MB

        • memory/2444-146-0x00000000037D0000-0x00000000049F6000-memory.dmp

          Filesize

          18.1MB

        • memory/2444-156-0x00000000037D0000-0x00000000049F6000-memory.dmp

          Filesize

          18.1MB

        • memory/2460-218-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2460-216-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2460-221-0x000007FEF4940000-0x000007FEF52DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2460-220-0x0000000001040000-0x00000000010C0000-memory.dmp

          Filesize

          512KB

        • memory/2460-219-0x0000000001040000-0x00000000010C0000-memory.dmp

          Filesize

          512KB

        • memory/2460-217-0x0000000001040000-0x00000000010C0000-memory.dmp

          Filesize

          512KB

        • memory/2556-58-0x0000000073EE0000-0x00000000745CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2556-55-0x0000000073EE0000-0x00000000745CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2556-57-0x0000000004B30000-0x0000000004B70000-memory.dmp

          Filesize

          256KB

        • memory/2556-56-0x0000000000200000-0x0000000000206000-memory.dmp

          Filesize

          24KB

        • memory/2556-59-0x0000000004B30000-0x0000000004B70000-memory.dmp

          Filesize

          256KB

        • memory/2556-138-0x0000000073EE0000-0x00000000745CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2556-54-0x0000000000100000-0x0000000000134000-memory.dmp

          Filesize

          208KB

        • memory/2576-200-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-195-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-204-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/2576-202-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-205-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-226-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-228-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/2576-203-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-199-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-198-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-201-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-197-0x000000013FDF0000-0x0000000141016000-memory.dmp

          Filesize

          18.1MB

        • memory/2576-196-0x00000000770D0000-0x0000000077279000-memory.dmp

          Filesize

          1.7MB

        • memory/2832-229-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB

        • memory/2832-233-0x0000000140000000-0x000000014002A000-memory.dmp

          Filesize

          168KB