Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2023 23:40

General

  • Target

    5303b4aea2db43e76bad4f1e0a4dfed6a1d7e1b0698d6b20366deee89253a180.exe

  • Size

    290KB

  • MD5

    4864e1921b46bc11d2358c1985d35cf3

  • SHA1

    a4733168416deba2249b5f8625479858f27b7fe6

  • SHA256

    5303b4aea2db43e76bad4f1e0a4dfed6a1d7e1b0698d6b20366deee89253a180

  • SHA512

    c659ee82077c32e3fa442888371b3ad51faf8c2426955787a5c4be391b06c476b7a03dc02d80c62c9cd29998a4c7b60d9ad19a0bf679825ead964be9019fee70

  • SSDEEP

    6144:AzrjLerWERoJs+I/lx59cHMjfqt55W1SEiZ65jQUx:YjiKERo++mjJT1liZ657

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 25 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3260
      • C:\Users\Admin\AppData\Local\Temp\5303b4aea2db43e76bad4f1e0a4dfed6a1d7e1b0698d6b20366deee89253a180.exe
        "C:\Users\Admin\AppData\Local\Temp\5303b4aea2db43e76bad4f1e0a4dfed6a1d7e1b0698d6b20366deee89253a180.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:4104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2656
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:2188
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2192
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:4484
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:4636
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3248
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1940
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5076
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2232
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4016
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:4568
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:3756
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:4200
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:2660
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:4232
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:2656
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:2088
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:4492
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:2588
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:664
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:4972
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5000
                • C:\Program Files\Google\Chrome\updater.exe
                  "C:\Program Files\Google\Chrome\updater.exe"
                  1⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2792

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  8592ba100a78835a6b94d5949e13dfc1

                  SHA1

                  63e901200ab9a57c7dd4c078d7f75dcd3b357020

                  SHA256

                  fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                  SHA512

                  87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  aced43cf55054d924b787b696079357c

                  SHA1

                  07e7eb1516ad8a95d773995a62353b419f92b776

                  SHA256

                  a41c1aec4f0f26866d3adb50dbe37a2be5e2294ac5dde60dfc7ce7a624cf646b

                  SHA512

                  d45be51d0aba76a771f8e653c4e71a0758382fbc70a8c000372d308c5e876fa0cdd78485df1298c159d332024acba53e3384e688929362e22226236eb25bc67e

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mt0nrvdb.fhl.ps1

                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                • C:\Users\Admin\AppData\Local\Temp\mi.exe

                  Filesize

                  9.9MB

                  MD5

                  80b0b41decb53a01e8c87def18400267

                  SHA1

                  885f327c4e91065486137ca96105190f7a29d0f9

                  SHA256

                  10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                  SHA512

                  19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                • C:\Users\Admin\AppData\Local\Temp\mi.exe

                  Filesize

                  9.9MB

                  MD5

                  80b0b41decb53a01e8c87def18400267

                  SHA1

                  885f327c4e91065486137ca96105190f7a29d0f9

                  SHA256

                  10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                  SHA512

                  19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                • C:\Windows\System32\drivers\etc\hosts

                  Filesize

                  3KB

                  MD5

                  2d29fd3ae57f422e2b2121141dc82253

                  SHA1

                  c2464c857779c0ab4f5e766f5028fcc651a6c6b7

                  SHA256

                  80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

                  SHA512

                  077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

                • C:\Windows\Temp\setup.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Windows\Temp\setup.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  811d351aabd7b708fef7683cf5e29e15

                  SHA1

                  06fd89e5a575f45d411cf4b3a2d277e642e73dbb

                  SHA256

                  0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

                  SHA512

                  702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  302a7c179ef577c237c5418fb770fd27

                  SHA1

                  343ef00d1357a8d2ff6e1143541a8a29435ed30c

                  SHA256

                  9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

                  SHA512

                  f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

                • memory/664-448-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/664-567-0x00000202843F0000-0x0000020284400000-memory.dmp

                  Filesize

                  64KB

                • memory/664-566-0x00000202843F0000-0x0000020284400000-memory.dmp

                  Filesize

                  64KB

                • memory/664-472-0x00007FF635D30000-0x00007FF635D40000-memory.dmp

                  Filesize

                  64KB

                • memory/664-452-0x00000202843F0000-0x0000020284400000-memory.dmp

                  Filesize

                  64KB

                • memory/664-450-0x00000202843F0000-0x0000020284400000-memory.dmp

                  Filesize

                  64KB

                • memory/2792-732-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-283-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-276-0x00007FFF81090000-0x00007FFF8126B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/2792-275-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-286-0x00007FFF81090000-0x00007FFF8126B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/2792-442-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-280-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-281-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-278-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-277-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-279-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/2792-282-0x00007FF6934A0000-0x00007FF6946C6000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3240-220-0x0000017DAE430000-0x0000017DAE440000-memory.dmp

                  Filesize

                  64KB

                • memory/3240-181-0x0000017DAE430000-0x0000017DAE440000-memory.dmp

                  Filesize

                  64KB

                • memory/3240-197-0x0000017DAE430000-0x0000017DAE440000-memory.dmp

                  Filesize

                  64KB

                • memory/3240-179-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/3240-184-0x0000017DAE5F0000-0x0000017DAE666000-memory.dmp

                  Filesize

                  472KB

                • memory/3240-224-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/3240-180-0x0000017DAE430000-0x0000017DAE440000-memory.dmp

                  Filesize

                  64KB

                • memory/3240-178-0x0000017DAE440000-0x0000017DAE462000-memory.dmp

                  Filesize

                  136KB

                • memory/4016-311-0x000002D31F5C0000-0x000002D31F5DC000-memory.dmp

                  Filesize

                  112KB

                • memory/4016-288-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4016-290-0x000002D31F470000-0x000002D31F480000-memory.dmp

                  Filesize

                  64KB

                • memory/4016-291-0x000002D31F470000-0x000002D31F480000-memory.dmp

                  Filesize

                  64KB

                • memory/4016-310-0x00007FF635D50000-0x00007FF635D60000-memory.dmp

                  Filesize

                  64KB

                • memory/4016-317-0x000002D31F780000-0x000002D31F839000-memory.dmp

                  Filesize

                  740KB

                • memory/4016-350-0x000002D31F5B0000-0x000002D31F5BA000-memory.dmp

                  Filesize

                  40KB

                • memory/4016-407-0x000002D31F470000-0x000002D31F480000-memory.dmp

                  Filesize

                  64KB

                • memory/4016-408-0x000002D31F470000-0x000002D31F480000-memory.dmp

                  Filesize

                  64KB

                • memory/4016-441-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4104-272-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-166-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-170-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-171-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-172-0x00007FFF81090000-0x00007FFF8126B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/4104-168-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-167-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-162-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-165-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-163-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-273-0x00007FFF81090000-0x00007FFF8126B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/4104-169-0x00007FF66CA40000-0x00007FF66DC66000-memory.dmp

                  Filesize

                  18.1MB

                • memory/4104-164-0x00007FFF81090000-0x00007FFF8126B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/4972-735-0x00007FF6DFB70000-0x00007FF6DFB9A000-memory.dmp

                  Filesize

                  168KB

                • memory/4972-739-0x00007FF6DFB70000-0x00007FF6DFB9A000-memory.dmp

                  Filesize

                  168KB

                • memory/5000-733-0x0000000001660000-0x0000000001680000-memory.dmp

                  Filesize

                  128KB

                • memory/5000-736-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5000-738-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5000-740-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5000-742-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5000-744-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5000-746-0x00007FF7AEBF0000-0x00007FF7AF3DF000-memory.dmp

                  Filesize

                  7.9MB

                • memory/5024-128-0x0000000003A50000-0x0000000003A84000-memory.dmp

                  Filesize

                  208KB

                • memory/5024-144-0x0000000009B90000-0x0000000009D52000-memory.dmp

                  Filesize

                  1.8MB

                • memory/5024-133-0x0000000006E20000-0x0000000006E5E000-memory.dmp

                  Filesize

                  248KB

                • memory/5024-135-0x00000000034C0000-0x00000000034E9000-memory.dmp

                  Filesize

                  164KB

                • memory/5024-136-0x0000000000400000-0x00000000018C7000-memory.dmp

                  Filesize

                  20.8MB

                • memory/5024-137-0x00000000034F0000-0x000000000352F000-memory.dmp

                  Filesize

                  252KB

                • memory/5024-138-0x0000000073AF0000-0x00000000741DE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/5024-120-0x00000000034C0000-0x00000000034E9000-memory.dmp

                  Filesize

                  164KB

                • memory/5024-139-0x00000000035E0000-0x00000000035F0000-memory.dmp

                  Filesize

                  64KB

                • memory/5024-140-0x0000000007000000-0x0000000007076000-memory.dmp

                  Filesize

                  472KB

                • memory/5024-141-0x0000000007080000-0x0000000007112000-memory.dmp

                  Filesize

                  584KB

                • memory/5024-142-0x0000000007120000-0x0000000007186000-memory.dmp

                  Filesize

                  408KB

                • memory/5024-143-0x0000000009B20000-0x0000000009B70000-memory.dmp

                  Filesize

                  320KB

                • memory/5024-132-0x0000000006E00000-0x0000000006E12000-memory.dmp

                  Filesize

                  72KB

                • memory/5024-131-0x0000000006CC0000-0x0000000006DCA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/5024-130-0x00000000066A0000-0x0000000006CA6000-memory.dmp

                  Filesize

                  6.0MB

                • memory/5024-129-0x00000000037A0000-0x00000000037A6000-memory.dmp

                  Filesize

                  24KB

                • memory/5024-134-0x0000000006EC0000-0x0000000006F0B000-memory.dmp

                  Filesize

                  300KB

                • memory/5024-127-0x0000000005F30000-0x000000000642E000-memory.dmp

                  Filesize

                  5.0MB

                • memory/5024-126-0x00000000035E0000-0x00000000035F0000-memory.dmp

                  Filesize

                  64KB

                • memory/5024-125-0x0000000073AF0000-0x00000000741DE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/5024-124-0x00000000035E0000-0x00000000035F0000-memory.dmp

                  Filesize

                  64KB

                • memory/5024-123-0x00000000038C0000-0x00000000038F8000-memory.dmp

                  Filesize

                  224KB

                • memory/5024-122-0x0000000000400000-0x00000000018C7000-memory.dmp

                  Filesize

                  20.8MB

                • memory/5024-157-0x0000000073AF0000-0x00000000741DE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/5024-121-0x00000000034F0000-0x000000000352F000-memory.dmp

                  Filesize

                  252KB

                • memory/5024-153-0x0000000000400000-0x00000000018C7000-memory.dmp

                  Filesize

                  20.8MB

                • memory/5024-145-0x0000000009D60000-0x000000000A28C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/5024-146-0x00000000035E0000-0x00000000035F0000-memory.dmp

                  Filesize

                  64KB

                • memory/5076-233-0x0000014EF92B0000-0x0000014EF92C0000-memory.dmp

                  Filesize

                  64KB

                • memory/5076-230-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/5076-232-0x0000014EF92B0000-0x0000014EF92C0000-memory.dmp

                  Filesize

                  64KB

                • memory/5076-249-0x0000014EF92B0000-0x0000014EF92C0000-memory.dmp

                  Filesize

                  64KB

                • memory/5076-270-0x00007FFF74110000-0x00007FFF74AFC000-memory.dmp

                  Filesize

                  9.9MB