umbral | f13ef71b6d5e9a6872adb20673aa42a6d7cc6ab305bd20bc8fed059a6597f29f

Analysis

max time kernel
121s
max time network
306s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a513e62b9e97d52553248d22e37f25f.exe
Size

215KB
MD5

022cd619c82b6c15b502afbfeec6debf
SHA1

cbb40b18c6ee74346efab7ac2a1e69100b6c3e00
SHA256

f13ef71b6d5e9a6872adb20673aa42a6d7cc6ab305bd20bc8fed059a6597f29f
SHA512

01f997451d33002d8502209afd816b7b6e5a3bc964230da351d70c11e0f144390cdf276b850f13815f414f92370bf6cfd89231eb4b9b1a75b4a8b8bb7f307758
SSDEEP

6144:oDAi86jCtMC5q+gXctZ8eGJ8rhNb8Imc:o0T6DCPxeJMx8+

Score

10^/10

umbral xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1211176678466916392/99VOwP9dc7iQz2Is-QlZ872KZaiUa4r3sEvXqZ6NmS-fFuTojiUjOg2SjIUWBCIoPNFA

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0034000000016c93-18.dat	family_umbral
behavioral1/memory/2428-29-0x0000000001260000-0x00000000012AE000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1912-33-0x0000000000110000-0x0000000000136000-memory.dmp	family_xworm
behavioral1/files/0x0007000000016d04-31.dat	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	controllloader.exe

Executes dropped EXE 3 IoCs

pid	Process
2548	explorer.exe
2428	controllloader.exe
1912	systemload.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\.NET\\explorer.exe"	5a513e62b9e97d52553248d22e37f25f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
7	ip-api.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\.NET\controllloader.exe	explorer.exe
File created	C:\Windows\.NET\start.cmd	explorer.exe
File created	C:\Windows\.NET\systemload.exe	explorer.exe
File created	C:\Windows\.NET\explorer.exe	5a513e62b9e97d52553248d22e37f25f.exe
File opened for modification	C:\Windows\.NET\explorer.exe	5a513e62b9e97d52553248d22e37f25f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
440	wmic.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2948	5a513e62b9e97d52553248d22e37f25f.exe
2948	5a513e62b9e97d52553248d22e37f25f.exe
2948	5a513e62b9e97d52553248d22e37f25f.exe
2816	powershell.exe
1520	powershell.exe
2660	powershell.exe
2176	powershell.exe
1108	powershell.exe
1912	systemload.exe
1444	powershell.exe
1628	powershell.exe
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	5a513e62b9e97d52553248d22e37f25f.exe
Token: SeDebugPrivilege	2548	explorer.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2428	controllloader.exe
Token: SeDebugPrivilege	1912	systemload.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1912	systemload.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeIncreaseQuotaPrivilege	840	wmic.exe
Token: SeSecurityPrivilege	840	wmic.exe
Token: SeTakeOwnershipPrivilege	840	wmic.exe
Token: SeLoadDriverPrivilege	840	wmic.exe
Token: SeSystemProfilePrivilege	840	wmic.exe
Token: SeSystemtimePrivilege	840	wmic.exe
Token: SeProfSingleProcessPrivilege	840	wmic.exe
Token: SeIncBasePriorityPrivilege	840	wmic.exe
Token: SeCreatePagefilePrivilege	840	wmic.exe
Token: SeBackupPrivilege	840	wmic.exe
Token: SeRestorePrivilege	840	wmic.exe
Token: SeShutdownPrivilege	840	wmic.exe
Token: SeDebugPrivilege	840	wmic.exe
Token: SeSystemEnvironmentPrivilege	840	wmic.exe
Token: SeRemoteShutdownPrivilege	840	wmic.exe
Token: SeUndockPrivilege	840	wmic.exe
Token: SeManageVolumePrivilege	840	wmic.exe
Token: 33	840	wmic.exe
Token: 34	840	wmic.exe
Token: 35	840	wmic.exe
Token: SeIncreaseQuotaPrivilege	840	wmic.exe
Token: SeSecurityPrivilege	840	wmic.exe
Token: SeTakeOwnershipPrivilege	840	wmic.exe
Token: SeLoadDriverPrivilege	840	wmic.exe
Token: SeSystemProfilePrivilege	840	wmic.exe
Token: SeSystemtimePrivilege	840	wmic.exe
Token: SeProfSingleProcessPrivilege	840	wmic.exe
Token: SeIncBasePriorityPrivilege	840	wmic.exe
Token: SeCreatePagefilePrivilege	840	wmic.exe
Token: SeBackupPrivilege	840	wmic.exe
Token: SeRestorePrivilege	840	wmic.exe
Token: SeShutdownPrivilege	840	wmic.exe
Token: SeDebugPrivilege	840	wmic.exe
Token: SeSystemEnvironmentPrivilege	840	wmic.exe
Token: SeRemoteShutdownPrivilege	840	wmic.exe
Token: SeUndockPrivilege	840	wmic.exe
Token: SeManageVolumePrivilege	840	wmic.exe
Token: 33	840	wmic.exe
Token: 34	840	wmic.exe
Token: 35	840	wmic.exe
Token: SeIncreaseQuotaPrivilege	1880	wmic.exe
Token: SeSecurityPrivilege	1880	wmic.exe
Token: SeTakeOwnershipPrivilege	1880	wmic.exe
Token: SeLoadDriverPrivilege	1880	wmic.exe
Token: SeSystemProfilePrivilege	1880	wmic.exe
Token: SeSystemtimePrivilege	1880	wmic.exe
Token: SeProfSingleProcessPrivilege	1880	wmic.exe
Token: SeIncBasePriorityPrivilege	1880	wmic.exe
Token: SeCreatePagefilePrivilege	1880	wmic.exe
Token: SeBackupPrivilege	1880	wmic.exe
Token: SeRestorePrivilege	1880	wmic.exe
Token: SeShutdownPrivilege	1880	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1912	systemload.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2548	2948	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2948 wrote to memory of 2548	2948	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2948 wrote to memory of 2548	2948	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2548 wrote to memory of 2428	2548	explorer.exe	31
PID 2548 wrote to memory of 2428	2548	explorer.exe	31
PID 2548 wrote to memory of 2428	2548	explorer.exe	31
PID 2548 wrote to memory of 1876	2548	explorer.exe	33
PID 2548 wrote to memory of 1876	2548	explorer.exe	33
PID 2548 wrote to memory of 1876	2548	explorer.exe	33
PID 2548 wrote to memory of 1912	2548	explorer.exe	34
PID 2548 wrote to memory of 1912	2548	explorer.exe	34
PID 2548 wrote to memory of 1912	2548	explorer.exe	34
PID 1876 wrote to memory of 2816	1876	cmd.exe	37
PID 1876 wrote to memory of 2816	1876	cmd.exe	37
PID 1876 wrote to memory of 2816	1876	cmd.exe	37
PID 1912 wrote to memory of 1520	1912	systemload.exe	38
PID 1912 wrote to memory of 1520	1912	systemload.exe	38
PID 1912 wrote to memory of 1520	1912	systemload.exe	38
PID 2428 wrote to memory of 2660	2428	controllloader.exe	40
PID 2428 wrote to memory of 2660	2428	controllloader.exe	40
PID 2428 wrote to memory of 2660	2428	controllloader.exe	40
PID 2428 wrote to memory of 2176	2428	controllloader.exe	42
PID 2428 wrote to memory of 2176	2428	controllloader.exe	42
PID 2428 wrote to memory of 2176	2428	controllloader.exe	42
PID 1912 wrote to memory of 1108	1912	systemload.exe	44
PID 1912 wrote to memory of 1108	1912	systemload.exe	44
PID 1912 wrote to memory of 1108	1912	systemload.exe	44
PID 2428 wrote to memory of 1444	2428	controllloader.exe	46
PID 2428 wrote to memory of 1444	2428	controllloader.exe	46
PID 2428 wrote to memory of 1444	2428	controllloader.exe	46
PID 2428 wrote to memory of 1628	2428	controllloader.exe	48
PID 2428 wrote to memory of 1628	2428	controllloader.exe	48
PID 2428 wrote to memory of 1628	2428	controllloader.exe	48
PID 2428 wrote to memory of 840	2428	controllloader.exe	50
PID 2428 wrote to memory of 840	2428	controllloader.exe	50
PID 2428 wrote to memory of 840	2428	controllloader.exe	50
PID 2428 wrote to memory of 1880	2428	controllloader.exe	52
PID 2428 wrote to memory of 1880	2428	controllloader.exe	52
PID 2428 wrote to memory of 1880	2428	controllloader.exe	52
PID 2428 wrote to memory of 1168	2428	controllloader.exe	55
PID 2428 wrote to memory of 1168	2428	controllloader.exe	55
PID 2428 wrote to memory of 1168	2428	controllloader.exe	55
PID 2428 wrote to memory of 2656	2428	controllloader.exe	57
PID 2428 wrote to memory of 2656	2428	controllloader.exe	57
PID 2428 wrote to memory of 2656	2428	controllloader.exe	57
PID 2428 wrote to memory of 440	2428	controllloader.exe	59
PID 2428 wrote to memory of 440	2428	controllloader.exe	59
PID 2428 wrote to memory of 440	2428	controllloader.exe	59

C:\Users\Admin\AppData\Local\Temp\5a513e62b9e97d52553248d22e37f25f.exe
"C:\Users\Admin\AppData\Local\Temp\5a513e62b9e97d52553248d22e37f25f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\.NET\explorer.exe
  "C:\Windows\.NET\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\.NET\controllloader.exe
    "C:\Windows\.NET\controllloader.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\.NET\controllloader.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:840
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1880
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:1168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2656
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:440
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Windows\.NET\start.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\.NET\'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\Windows\.NET\systemload.exe
    "C:\Windows\.NET\systemload.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\.NET\systemload.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemload.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1108

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2964

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
430714e25a3d30e5e292f62148c59012

SHA1
9fbcb29f13f4fcea9aead24dd6ee4ea1d701a7b6

SHA256
a2e138d53a6eac90fa40ef373c38de1892bd018fd18a1d70ef1c1747f094b343

SHA512
301c15ee176b3d6a0801887c2fdba7293d12a79bb5544660ae4fb21286fb6b42afee6845410f8c5f7163f3c7f1907082a3d33748d262d2b3c1ec0d53f2040394

Download Submit
C:\Windows\.NET\controllloader.exe

Filesize
286KB

MD5
e41a0fa0c1e39af92d22090d4df61a1f

SHA1
c971a4089b1ab116c34b5ab0dc54d9977f86e834

SHA256
c0966533c2bc8c8b9ee176d774eae0ca1c4d6fe6e8efe5d87d4cac8c04b84372

SHA512
d42798fa9115f3c3775798a26ef7c28e4f173bdc2b74884b01a4e7905b17a2da09508766a626652eec3622a15a891b6859f4e9a422eb052a59b3fd3eafe1a7fd

Download Submit
C:\Windows\.NET\explorer.exe

Filesize
245KB

MD5
6e582594dff7429cd41f7cd46fba7970

SHA1
d91416e8a80c3ba9db036218921a976bab5e651b

SHA256
0bb6471d08e761a6ba31f6b9bc54f1b039dc15dd17faa1e7c996baebd08eb33c

SHA512
64ed27a592c4f0aca400e4a61c571326882a24c044afe0303c2a090e5f5d38a7fa97ff9fbdf85b0a0a657e96991818692688c1179a38c2903c562fc2a179115b

Download Submit
C:\Windows\.NET\start.cmd

Filesize
93B

MD5
f960abd9684a879e8eca03b8c864ea96

SHA1
fb4b9a9b40af84ae46b70bb40ac3e1f45e4b4ad3

SHA256
7389178da21f4e2d4ef73ab199b7beeb97247a6c1afec3f3c48a7f561cbfaf90

SHA512
2c6267ab25c364c5b13059ed593bb47dfae586ae7b1411634efa3f45aaf07b4d8f491fe93bfd34482a1250c955f1e8c27e1afa0460672a5e9584ebe007ab2054

Download Submit
C:\Windows\.NET\systemload.exe

Filesize
130KB

MD5
352a162df9ca5605e1a1910c7a24cb7c

SHA1
4b4ed1c740a03c15eb47d875b65c76941debcaf7

SHA256
87e9d9a7a197a0cd483f8e73f307af53a7518cabc001257c8235743181b9a7b8

SHA512
0c2bae3f66748cc3448eaf60c5079ae3afba6d585e19e54857f7c152a1bd69c3b8e3df7feb413f3eb2df0f2bc01b44be5bcdefd5427af154a221f2b808a2399d

Download Submit
memory/1108-98-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/1108-89-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1108-93-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/1108-88-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/1108-87-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1108-101-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1108-84-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/1444-117-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/1444-116-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/1444-118-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/1444-119-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/1444-121-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/1444-120-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/1520-69-0x0000000001CD0000-0x0000000001D50000-memory.dmp

Filesize
512KB

Download
memory/1520-65-0x0000000001CD0000-0x0000000001D50000-memory.dmp

Filesize
512KB

Download
memory/1520-71-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1520-66-0x0000000001CD0000-0x0000000001D50000-memory.dmp

Filesize
512KB

Download
memory/1520-55-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1520-57-0x0000000001CD0000-0x0000000001D50000-memory.dmp

Filesize
512KB

Download
memory/1520-62-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1628-127-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1628-128-0x0000000002AA0000-0x0000000002B20000-memory.dmp

Filesize
512KB

Download
memory/1628-129-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/1628-130-0x0000000002AA0000-0x0000000002B20000-memory.dmp

Filesize
512KB

Download
memory/1912-102-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/1912-96-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/1912-33-0x0000000000110000-0x0000000000136000-memory.dmp

Filesize
152KB

Download
memory/1912-34-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2176-90-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-100-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-97-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/2176-95-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/2176-99-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/2176-94-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/2176-85-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2176-92-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-91-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/2428-115-0x000000001B210000-0x000000001B290000-memory.dmp

Filesize
512KB

Download
memory/2428-32-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2428-86-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2428-29-0x0000000001260000-0x00000000012AE000-memory.dmp

Filesize
312KB

Download
memory/2548-11-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2548-9-0x0000000000CF0000-0x0000000000D32000-memory.dmp

Filesize
264KB

Download
memory/2548-12-0x000000001BC40000-0x000000001BCC0000-memory.dmp

Filesize
512KB

Download
memory/2548-35-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-67-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/2660-63-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/2660-72-0x0000000002490000-0x0000000002510000-memory.dmp

Filesize
512KB

Download
memory/2660-68-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-70-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2660-64-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-47-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2816-54-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-48-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2816-46-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2816-45-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-44-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2816-43-0x000007FEEEA80000-0x000007FEEF41D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-42-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/2816-41-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2948-0-0x0000000000170000-0x00000000001AC000-memory.dmp

Filesize
240KB

Download
memory/2948-10-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2948-2-0x000000001BA70000-0x000000001BAF0000-memory.dmp

Filesize
512KB

Download
memory/2948-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download