Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-08-2023 20:00

General

  • Target

    e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6.exe

  • Size

    385KB

  • MD5

    f235938a2a7b1712ec278123f70f7529

  • SHA1

    28760a8523738bcfaf4e95b0de756d324ccc389d

  • SHA256

    e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6

  • SHA512

    c8ccaa244b7bd43fe9cfc68c3af17063d033726bf93a55311084d3ffd263606c2c0737b4e510073a7b4912de329cb51dbc9fe5d88c9238e57f7ec7240576c317

  • SSDEEP

    6144:FnIvVNP8yPuW/UbnW9Pl997LEZKxmEq1Admg5b5FIXc5iDd:Fn8BuW/UTWrQOsoxkJDd

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 26 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3188
      • C:\Users\Admin\AppData\Local\Temp\e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6.exe
        "C:\Users\Admin\AppData\Local\Temp\e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4996
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:3180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4488
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3956
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:1344
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2940
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:3992
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:4492
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1904
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:324
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3844
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1848
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:3276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4340
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3924
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:5000
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:312
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:4896
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1764
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:4472
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:5100
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:3052
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:3948
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:3844
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#syxapd#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1824
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:3656
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4672
                • C:\Program Files\Google\Chrome\updater.exe
                  "C:\Program Files\Google\Chrome\updater.exe"
                  1⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3196

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Program Files\Google\Chrome\updater.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  ad5cd538ca58cb28ede39c108acb5785

                  SHA1

                  1ae910026f3dbe90ed025e9e96ead2b5399be877

                  SHA256

                  c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                  SHA512

                  c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  57764768a0cf2739b907776569457fa9

                  SHA1

                  54f34c72014e2d069c17dcc837adc13aa6fb92f6

                  SHA256

                  4791d7ec16b52bd26efd9645018d2bbfbc1aece13768177d3b8f515bc7016769

                  SHA512

                  6536f3b38bc3475763addb279fe50ad1cf9ecf8fdd7a94ff49f4ef8a977c6d6b050d4508b4bbb8df8ab68acb78cf4e25f840e64bea7b0956aefd126916f98c8f

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwue4rvk.nok.ps1

                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                • C:\Users\Admin\AppData\Local\Temp\mi.exe

                  Filesize

                  9.9MB

                  MD5

                  80b0b41decb53a01e8c87def18400267

                  SHA1

                  885f327c4e91065486137ca96105190f7a29d0f9

                  SHA256

                  10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                  SHA512

                  19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                • C:\Users\Admin\AppData\Local\Temp\mi.exe

                  Filesize

                  9.9MB

                  MD5

                  80b0b41decb53a01e8c87def18400267

                  SHA1

                  885f327c4e91065486137ca96105190f7a29d0f9

                  SHA256

                  10d8e7a04d05a2690a7e0cc30c10028eda0af680a8787f24cb9668ccbe46e1e1

                  SHA512

                  19bd6c9ab0cfbba34e722f508fcb4a99ae78a0d71ef664b186034c78eda09a61ae63455f7958dd5a50ec6432c822b23582ca7c87309a37fcbbb28e5facf56c8e

                • C:\Windows\System32\drivers\etc\hosts

                  Filesize

                  3KB

                  MD5

                  2d29fd3ae57f422e2b2121141dc82253

                  SHA1

                  c2464c857779c0ab4f5e766f5028fcc651a6c6b7

                  SHA256

                  80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

                  SHA512

                  077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

                • C:\Windows\Temp\setup.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Windows\Temp\setup.exe

                  Filesize

                  9.7MB

                  MD5

                  84741bc02d2e9226a943aa03b6a4568d

                  SHA1

                  617d01316011faf77fba30d49ae1e86ff988380a

                  SHA256

                  fa1f99fdd5beab9a996ff3cb58886dc1811fd6e1ba444aee2d80d0d9b9d5ec93

                  SHA512

                  1c95842c88f7d17a07fa2480281cbdff27136525c80a00387536a0843e040adcac37fd13166ab7f48398d28fd297c92d5c0d0ef4066e68297ea9f30179754379

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  3KB

                  MD5

                  573d77d4e77a445f5db769812a0be865

                  SHA1

                  7473d15ef2d3c6894edefd472f411c8e3209a99c

                  SHA256

                  5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

                  SHA512

                  af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  1KB

                  MD5

                  631f4b3792b263fdda6b265e93be4747

                  SHA1

                  1d6916097d419198bfdf78530d59d0d9f3e12d45

                  SHA256

                  4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

                  SHA512

                  e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

                • memory/1824-448-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1824-451-0x00000135EDC30000-0x00000135EDC40000-memory.dmp

                  Filesize

                  64KB

                • memory/1824-452-0x00000135EDC30000-0x00000135EDC40000-memory.dmp

                  Filesize

                  64KB

                • memory/1824-472-0x00007FF7380F0000-0x00007FF738100000-memory.dmp

                  Filesize

                  64KB

                • memory/1824-567-0x00000135EDC30000-0x00000135EDC40000-memory.dmp

                  Filesize

                  64KB

                • memory/1848-247-0x0000026AEF750000-0x0000026AEF760000-memory.dmp

                  Filesize

                  64KB

                • memory/1848-266-0x0000026AEF750000-0x0000026AEF760000-memory.dmp

                  Filesize

                  64KB

                • memory/1848-268-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1848-230-0x0000026AEF750000-0x0000026AEF760000-memory.dmp

                  Filesize

                  64KB

                • memory/1848-229-0x0000026AEF750000-0x0000026AEF760000-memory.dmp

                  Filesize

                  64KB

                • memory/1848-227-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/3180-271-0x00007FFDCEDB0000-0x00007FFDCEF8B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3180-170-0x00007FFDCEDB0000-0x00007FFDCEF8B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3180-244-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-270-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-169-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-168-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-167-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-166-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-165-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-164-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-161-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3180-163-0x00007FFDCEDB0000-0x00007FFDCEF8B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3180-162-0x00007FF713AF0000-0x00007FF714D16000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-274-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-282-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-278-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-277-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-276-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-273-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-279-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-281-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-280-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-275-0x00007FFDCEDB0000-0x00007FFDCEF8B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3196-283-0x00007FFDCEDB0000-0x00007FFDCEF8B000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3196-698-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3196-733-0x00007FF76F330000-0x00007FF770556000-memory.dmp

                  Filesize

                  18.1MB

                • memory/3656-735-0x00007FF7B46A0000-0x00007FF7B46CA000-memory.dmp

                  Filesize

                  168KB

                • memory/3656-739-0x00007FF7B46A0000-0x00007FF7B46CA000-memory.dmp

                  Filesize

                  168KB

                • memory/4340-291-0x00000254F5390000-0x00000254F53A0000-memory.dmp

                  Filesize

                  64KB

                • memory/4340-442-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4340-290-0x00000254F5390000-0x00000254F53A0000-memory.dmp

                  Filesize

                  64KB

                • memory/4340-310-0x00007FF738510000-0x00007FF738520000-memory.dmp

                  Filesize

                  64KB

                • memory/4340-311-0x00000254F55E0000-0x00000254F55FC000-memory.dmp

                  Filesize

                  112KB

                • memory/4340-317-0x00000254F57A0000-0x00000254F5859000-memory.dmp

                  Filesize

                  740KB

                • memory/4340-288-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4340-351-0x00000254F5600000-0x00000254F560A000-memory.dmp

                  Filesize

                  40KB

                • memory/4340-408-0x00000254F5390000-0x00000254F53A0000-memory.dmp

                  Filesize

                  64KB

                • memory/4340-410-0x00000254F5390000-0x00000254F53A0000-memory.dmp

                  Filesize

                  64KB

                • memory/4488-178-0x000001BD23F40000-0x000001BD23F50000-memory.dmp

                  Filesize

                  64KB

                • memory/4488-221-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4488-176-0x000001BD23F80000-0x000001BD23FA2000-memory.dmp

                  Filesize

                  136KB

                • memory/4488-177-0x00007FFDB2B40000-0x00007FFDB352C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4488-181-0x000001BD24130000-0x000001BD241A6000-memory.dmp

                  Filesize

                  472KB

                • memory/4488-194-0x000001BD23F40000-0x000001BD23F50000-memory.dmp

                  Filesize

                  64KB

                • memory/4488-217-0x000001BD23F40000-0x000001BD23F50000-memory.dmp

                  Filesize

                  64KB

                • memory/4672-738-0x00007FF699780000-0x00007FF699F6F000-memory.dmp

                  Filesize

                  7.9MB

                • memory/4672-736-0x00007FF699780000-0x00007FF699F6F000-memory.dmp

                  Filesize

                  7.9MB

                • memory/4672-732-0x0000000000E90000-0x0000000000EB0000-memory.dmp

                  Filesize

                  128KB

                • memory/4672-740-0x00007FF699780000-0x00007FF699F6F000-memory.dmp

                  Filesize

                  7.9MB

                • memory/4672-742-0x00007FF699780000-0x00007FF699F6F000-memory.dmp

                  Filesize

                  7.9MB

                • memory/4672-744-0x00007FF699780000-0x00007FF699F6F000-memory.dmp

                  Filesize

                  7.9MB

                • memory/4892-141-0x0000000073DD0000-0x00000000744BE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/4892-127-0x00000000042D0000-0x00000000042D6000-memory.dmp

                  Filesize

                  24KB

                • memory/4892-133-0x000000000CCF0000-0x000000000CD3B000-memory.dmp

                  Filesize

                  300KB

                • memory/4892-118-0x0000000002320000-0x0000000002420000-memory.dmp

                  Filesize

                  1024KB

                • memory/4892-134-0x0000000002320000-0x0000000002420000-memory.dmp

                  Filesize

                  1024KB

                • memory/4892-135-0x0000000000400000-0x0000000002308000-memory.dmp

                  Filesize

                  31.0MB

                • memory/4892-136-0x0000000003EF0000-0x0000000003F2F000-memory.dmp

                  Filesize

                  252KB

                • memory/4892-137-0x00000000042E0000-0x00000000042F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4892-138-0x000000000CF30000-0x000000000CFA6000-memory.dmp

                  Filesize

                  472KB

                • memory/4892-139-0x000000000CFB0000-0x000000000D042000-memory.dmp

                  Filesize

                  584KB

                • memory/4892-140-0x000000000D050000-0x000000000D0B6000-memory.dmp

                  Filesize

                  408KB

                • memory/4892-130-0x000000000CC30000-0x000000000CC42000-memory.dmp

                  Filesize

                  72KB

                • memory/4892-131-0x00000000042E0000-0x00000000042F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4892-129-0x000000000CAF0000-0x000000000CBFA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4892-128-0x000000000C460000-0x000000000CA66000-memory.dmp

                  Filesize

                  6.0MB

                • memory/4892-132-0x000000000CC50000-0x000000000CC8E000-memory.dmp

                  Filesize

                  248KB

                • memory/4892-126-0x0000000073DD0000-0x00000000744BE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/4892-125-0x00000000042F0000-0x0000000004324000-memory.dmp

                  Filesize

                  208KB

                • memory/4892-124-0x0000000006920000-0x0000000006E1E000-memory.dmp

                  Filesize

                  5.0MB

                • memory/4892-123-0x00000000042E0000-0x00000000042F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4892-122-0x00000000042E0000-0x00000000042F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4892-142-0x000000000D980000-0x000000000DB42000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4892-121-0x0000000000400000-0x0000000002308000-memory.dmp

                  Filesize

                  31.0MB

                • memory/4892-120-0x0000000004270000-0x00000000042A8000-memory.dmp

                  Filesize

                  224KB

                • memory/4892-143-0x000000000DB50000-0x000000000E07C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4892-144-0x00000000042E0000-0x00000000042F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4892-119-0x0000000003EF0000-0x0000000003F2F000-memory.dmp

                  Filesize

                  252KB

                • memory/4892-145-0x000000000E7B0000-0x000000000E800000-memory.dmp

                  Filesize

                  320KB

                • memory/4892-153-0x0000000000400000-0x0000000002308000-memory.dmp

                  Filesize

                  31.0MB

                • memory/4892-154-0x0000000073DD0000-0x00000000744BE000-memory.dmp

                  Filesize

                  6.9MB