Analysis

  • max time kernel
    82s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 00:01

General

  • Target

    cc4d8fc3c02d1706c374f38b4f8074e0.exe

  • Size

    313KB

  • MD5

    cc4d8fc3c02d1706c374f38b4f8074e0

  • SHA1

    17a49f94f7da6242d7917ce07c5546f76d2a8847

  • SHA256

    829c8a42d65b1587d2067127d22ed243d75c50e3b0830344dd5d64ac6ce390de

  • SHA512

    489c4a767a9460bd11d63f38df0c150e4dc15bf738eddae708f6d6eb054fa9832cae31dd3d9794714b599beef465f9b4c36f1cf2ba25e9998551f0241a7cbede

  • SSDEEP

    6144:fyILtw3FlTZU4UYiPBSyVXmRDr8sLJ2OywWnm+UaR:tK3FlThUbBSy2DrLdyI+t

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 25 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3208
      • C:\Users\Admin\AppData\Local\Temp\cc4d8fc3c02d1706c374f38b4f8074e0.exe
        "C:\Users\Admin\AppData\Local\Temp\cc4d8fc3c02d1706c374f38b4f8074e0.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1772
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1452
          3⤵
          • Program crash
          PID:4588
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2952
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:4640
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:4600
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1700
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:5028
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:4596
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:60
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:376
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2000
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4676
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2836
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:4448
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3228
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:2816
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1020
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2852
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:832
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
              PID:4816
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4476 -ip 4476
            1⤵
              PID:1300
            • C:\Program Files\Google\Chrome\updater.exe
              "C:\Program Files\Google\Chrome\updater.exe"
              1⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:3940
            • C:\Windows\System32\sc.exe
              sc stop UsoSvc
              1⤵
              • Launches sc.exe
              PID:4952
            • C:\Windows\System32\sc.exe
              sc stop bits
              1⤵
              • Launches sc.exe
              PID:3800
            • C:\Windows\System32\sc.exe
              sc stop dosvc
              1⤵
              • Launches sc.exe
              PID:1188
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              1⤵
                PID:764
              • C:\Windows\System32\powercfg.exe
                powercfg /x -hibernate-timeout-dc 0
                1⤵
                  PID:4692
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  1⤵
                    PID:4960
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -standby-timeout-ac 0
                    1⤵
                      PID:3460
                    • C:\Windows\System32\sc.exe
                      sc stop wuauserv
                      1⤵
                      • Launches sc.exe
                      PID:908
                    • C:\Windows\System32\sc.exe
                      sc stop WaaSMedicSvc
                      1⤵
                      • Launches sc.exe
                      PID:3848

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files\Google\Chrome\updater.exe

                      Filesize

                      9.7MB

                      MD5

                      84741bc02d2e9226a943aa03b6a4568d

                      SHA1

                      617d01316011faf77fba30d49ae1e86ff988380a

                      SHA256

                      fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                      SHA512

                      1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                    • C:\Program Files\Google\Chrome\updater.exe

                      Filesize

                      9.7MB

                      MD5

                      84741bc02d2e9226a943aa03b6a4568d

                      SHA1

                      617d01316011faf77fba30d49ae1e86ff988380a

                      SHA256

                      fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                      SHA512

                      1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      d28a889fd956d5cb3accfbaf1143eb6f

                      SHA1

                      157ba54b365341f8ff06707d996b3635da8446f7

                      SHA256

                      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                      SHA512

                      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4fj3mg0.2fu.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\mi.exe

                      Filesize

                      9.9MB

                      MD5

                      80b0b41decb53a01e8c87def18400267

                      SHA1

                      885f327c4e91065486137ca96105190f7a29d0f9

                      SHA256

                      10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                      SHA512

                      19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                    • C:\Users\Admin\AppData\Local\Temp\mi.exe

                      Filesize

                      9.9MB

                      MD5

                      80b0b41decb53a01e8c87def18400267

                      SHA1

                      885f327c4e91065486137ca96105190f7a29d0f9

                      SHA256

                      10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                      SHA512

                      19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                    • C:\Users\Admin\AppData\Local\Temp\mi.exe

                      Filesize

                      9.9MB

                      MD5

                      80b0b41decb53a01e8c87def18400267

                      SHA1

                      885f327c4e91065486137ca96105190f7a29d0f9

                      SHA256

                      10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                      SHA512

                      19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                    • C:\Windows\System32\drivers\etc\hosts

                      Filesize

                      3KB

                      MD5

                      2d29fd3ae57f422e2b2121141dc82253

                      SHA1

                      c2464c857779c0ab4f5e766f5028fcc651a6c6b7

                      SHA256

                      80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

                      SHA512

                      077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

                    • C:\Windows\Temp\setup.exe

                      Filesize

                      9.7MB

                      MD5

                      84741bc02d2e9226a943aa03b6a4568d

                      SHA1

                      617d01316011faf77fba30d49ae1e86ff988380a

                      SHA256

                      fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                      SHA512

                      1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                    • C:\Windows\Temp\setup.exe

                      Filesize

                      9.7MB

                      MD5

                      84741bc02d2e9226a943aa03b6a4568d

                      SHA1

                      617d01316011faf77fba30d49ae1e86ff988380a

                      SHA256

                      fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                      SHA512

                      1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                    • C:\Windows\Temp\setup.exe

                      Filesize

                      9.7MB

                      MD5

                      84741bc02d2e9226a943aa03b6a4568d

                      SHA1

                      617d01316011faf77fba30d49ae1e86ff988380a

                      SHA256

                      fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                      SHA512

                      1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                    • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      4KB

                      MD5

                      bdb25c22d14ec917e30faf353826c5de

                      SHA1

                      6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                      SHA256

                      e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                      SHA512

                      b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                    • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      1KB

                      MD5

                      b42c70c1dbf0d1d477ec86902db9e986

                      SHA1

                      1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                      SHA256

                      8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                      SHA512

                      57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                    • memory/60-213-0x000001ADB0300000-0x000001ADB0310000-memory.dmp

                      Filesize

                      64KB

                    • memory/60-227-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/60-211-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/60-212-0x000001ADB0300000-0x000001ADB0310000-memory.dmp

                      Filesize

                      64KB

                    • memory/60-225-0x000001ADB0300000-0x000001ADB0310000-memory.dmp

                      Filesize

                      64KB

                    • memory/832-315-0x00007FF7C43F0000-0x00007FF7C441A000-memory.dmp

                      Filesize

                      168KB

                    • memory/832-311-0x00007FF7C43F0000-0x00007FF7C441A000-memory.dmp

                      Filesize

                      168KB

                    • memory/1772-229-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-230-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1772-184-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-193-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1772-187-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-224-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-186-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-188-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-191-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-185-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-181-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/1772-182-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/1772-183-0x00007FF694210000-0x00007FF695436000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/2816-280-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2816-281-0x000001F782E40000-0x000001F782E50000-memory.dmp

                      Filesize

                      64KB

                    • memory/2816-301-0x000001F782E40000-0x000001F782E50000-memory.dmp

                      Filesize

                      64KB

                    • memory/2816-303-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2952-205-0x000001CA9A3E0000-0x000001CA9A3F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2952-208-0x00007FF842A30000-0x00007FF8434F1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2952-204-0x00007FF842A30000-0x00007FF8434F1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2952-199-0x000001CA9A370000-0x000001CA9A392000-memory.dmp

                      Filesize

                      136KB

                    • memory/3228-270-0x000001B8FB270000-0x000001B8FB278000-memory.dmp

                      Filesize

                      32KB

                    • memory/3228-264-0x000001B8FB030000-0x000001B8FB04C000-memory.dmp

                      Filesize

                      112KB

                    • memory/3228-253-0x000001B8F8C10000-0x000001B8F8C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/3228-249-0x000001B8F8C10000-0x000001B8F8C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/3228-276-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3228-273-0x000001B8F8C10000-0x000001B8F8C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/3228-272-0x000001B8FB2B0000-0x000001B8FB2BA000-memory.dmp

                      Filesize

                      40KB

                    • memory/3228-271-0x000001B8FB2A0000-0x000001B8FB2A6000-memory.dmp

                      Filesize

                      24KB

                    • memory/3228-269-0x000001B8FB2C0000-0x000001B8FB2DA000-memory.dmp

                      Filesize

                      104KB

                    • memory/3228-254-0x00007FF4EFF20000-0x00007FF4EFF30000-memory.dmp

                      Filesize

                      64KB

                    • memory/3228-268-0x000001B8FB260000-0x000001B8FB26A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3228-266-0x000001B8FB280000-0x000001B8FB29C000-memory.dmp

                      Filesize

                      112KB

                    • memory/3228-265-0x000001B8FB110000-0x000001B8FB11A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3228-242-0x00007FF842B50000-0x00007FF843611000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3940-267-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-308-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-310-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/3940-232-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-234-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/3940-233-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-235-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-236-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-237-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-238-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-239-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-240-0x00007FF638E30000-0x00007FF63A056000-memory.dmp

                      Filesize

                      18.1MB

                    • memory/3940-241-0x00007FF8615D0000-0x00007FF8617C5000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4476-156-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4476-136-0x0000000074F50000-0x0000000075700000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4476-190-0x0000000074F50000-0x0000000075700000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4476-157-0x0000000008D10000-0x0000000008ED2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/4476-158-0x0000000008EE0000-0x000000000940C000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/4476-147-0x0000000003670000-0x00000000036AF000-memory.dmp

                      Filesize

                      252KB

                    • memory/4476-146-0x0000000006150000-0x000000000618C000-memory.dmp

                      Filesize

                      240KB

                    • memory/4476-145-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4476-139-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4476-143-0x0000000001B70000-0x0000000001B99000-memory.dmp

                      Filesize

                      164KB

                    • memory/4476-133-0x0000000001B70000-0x0000000001B99000-memory.dmp

                      Filesize

                      164KB

                    • memory/4476-144-0x0000000006130000-0x0000000006142000-memory.dmp

                      Filesize

                      72KB

                    • memory/4476-148-0x0000000074F50000-0x0000000075700000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4476-140-0x00000000061D0000-0x0000000006774000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4476-137-0x0000000000400000-0x00000000018CD000-memory.dmp

                      Filesize

                      20.8MB

                    • memory/4476-155-0x0000000007BD0000-0x0000000007C20000-memory.dmp

                      Filesize

                      320KB

                    • memory/4476-154-0x0000000007360000-0x00000000073C6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4476-138-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4476-135-0x0000000000400000-0x00000000018CD000-memory.dmp

                      Filesize

                      20.8MB

                    • memory/4476-142-0x0000000006EA0000-0x0000000006FAA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/4476-153-0x00000000071C0000-0x0000000007252000-memory.dmp

                      Filesize

                      584KB

                    • memory/4476-152-0x0000000007140000-0x00000000071B6000-memory.dmp

                      Filesize

                      472KB

                    • memory/4476-134-0x0000000003670000-0x00000000036AF000-memory.dmp

                      Filesize

                      252KB

                    • memory/4476-149-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4476-189-0x0000000000400000-0x00000000018CD000-memory.dmp

                      Filesize

                      20.8MB

                    • memory/4476-141-0x0000000006880000-0x0000000006E98000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/4476-151-0x00000000061C0000-0x00000000061D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4816-312-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/4816-314-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/4816-316-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/4816-309-0x0000000001190000-0x00000000011B0000-memory.dmp

                      Filesize

                      128KB

                    • memory/4816-318-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/4816-320-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB

                    • memory/4816-322-0x00007FF6263C0000-0x00007FF626BAF000-memory.dmp

                      Filesize

                      7.9MB