Malware Analysis Report

2025-05-05 21:09

Sample ID 241027-3feq6ssnfs
Target source_prepared.exe
SHA256 f30d2d875c5ec1fc8e8eab07ad99e64b4e12ef21eb83efe5a241dce97cd94f00
Tags
pyinstaller pysilon upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f30d2d875c5ec1fc8e8eab07ad99e64b4e12ef21eb83efe5a241dce97cd94f00

Threat Level: Known bad

The file source_prepared.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller pysilon upx

Detect Pysilon

Pysilon family

Loads dropped DLL

UPX packed file

Detects Pyinstaller

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 23:27

Signatures

Detect Pysilon

Description Indicator Process Target
N/A N/A N/A N/A

Pysilon family

pysilon

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:27

Platform

win11-20241007-en

Max time kernel

7s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:27

Platform

win11-20241007-en

Max time kernel

7s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:27

Platform

win11-20241007-en

Max time kernel

7s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:27

Platform

win11-20241007-en

Max time kernel

7s

Max time network

5s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:27

Platform

win11-20241007-en

Max time kernel

7s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 23:27

Reported

2024-10-27 23:28

Platform

win11-20241007-en

Max time kernel

7s

Command Line

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI17722\python313.dll

MD5 d8064129e98609f661abbed76e1a3a90
SHA1 10c8e18616bd3012045e9a0f349add4e4e8e8db4
SHA256 dea683826da43766b4902881d5e5924c181d69d35238df654e230070695d5ca4
SHA512 06e51dac672a4897026c65920eb4e3f119b4b2935ee525b07f1f1de0e2975e9d101ea913d75e479f29f09bb1b510f89b46d879abbc14035e877a3f5b4b69abd3

C:\Users\Admin\AppData\Local\Temp\_MEI17722\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

memory/4604-49-0x00007FFE82B50000-0x00007FFE831B3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17722\base_library.zip

MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_ctypes.pyd

MD5 5015c9692bf98286d7303f33df586396
SHA1 9e1808d45c9fffdc031226fa9829e907eb255c9f
SHA256 2e36b9df7c744a1be53cabc0ed4f262c9ad28079c63ccf0b5a3893222d4b46a2
SHA512 7116b7bfc10295aa0d97b54f84432fd33dd500c9ced465b79cececf0d404c29107c1d6c87c6ea22c608df0c96751a8977ba19e6dccf69028556acd3255765de0

C:\Users\Admin\AppData\Local\Temp\_MEI17722\libffi-8.dll

MD5 013a0b2653aa0eb6075419217a1ed6bd
SHA1 1b58ff8e160b29a43397499801cf8ab0344371e7
SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
SHA512 0bd13fa1d55133ee2a96387e0756f48133987bacd99d1f58bab3be7bffdf868092060c17ab792dcfbb4680f984f40d3f7cc24abdd657b756496aa8884b8f6099

memory/4604-56-0x00007FFE99C80000-0x00007FFE99C8F000-memory.dmp

memory/4604-55-0x00007FFE987F0000-0x00007FFE98817000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_bz2.pyd

MD5 310344b6511057ace1aa47ff2a261320
SHA1 70182479b8548d4a2c94659d40343e811a43f788
SHA256 fab5bbcd382280493d3d8af48f8d5c4abab46f10f1df07938daa4539b78093f7
SHA512 0c5032f6cc7eba8eb0a624d6535c4da8fd47c06efd3989a5962d981c8a8211e59f8ef4902ba9a03385dd3f69450e3e5cb4a1bf493937cabdd9dbb7ae9fe170b7

memory/4604-60-0x00007FFE98870000-0x00007FFE98889000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_lzma.pyd

MD5 129743145c5bcf1924c08df63c9dc04c
SHA1 8ec43426ff2d00cc2eb7a08913e957bdcb126c31
SHA256 0f48205ece5ecd65ce297a2a8af647066388764eda84c8117ec380f8637ab702
SHA512 551d5904ccbca32094a4e469b8ac2bb339f21e1346b88fba2c5f0d9462c75ed4aab40b9a9204b81f9d722eb1235aa8aa7a8408c46e1a901148b0691218689be2

C:\Users\Admin\AppData\Local\Temp\_MEI17722\libcrypto-3.dll

MD5 ecf92d1e849c1a4b89ed9dac0c2d732d
SHA1 bd2dbf194e9c891f27ef5b4521318d3804f76425
SHA256 afc166f8f1906cd75b4de9f7c72e92e36e4282437a02fedadb5ec3145c33c3a1
SHA512 44e3d6b37a11b715efb77c28c1c4fca4c25ba7f663183bcef4ba52e9c5271715f43f7b22b6307c6d8788c1ea4e8b709060b0a711aeae249164ba7bfd1d571f89

memory/4604-83-0x00007FFE978B0000-0x00007FFE978C4000-memory.dmp

memory/4604-85-0x00007FFE8FC90000-0x00007FFE901C3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_hashlib.pyd

MD5 f353a54fe006a35fb092ae68b7fa3bd2
SHA1 8a7746051a56159205a77d03c1b1490b6172f4db
SHA256 67e7858a3bf395de8a37b5444a980965f206fc92b9e813b63f8b562be6ff0b26
SHA512 3d26ef6611211333802d8290b0164a540c6a62ef332239bafe5586b661197c82857a1fc17fa97116533af730a9fe96e2e9f7dc37fc3d5f11351b522bad667b0c

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_wmi.pyd

MD5 c2d3d0c01b9c5a5ee82f65c205a89b8b
SHA1 ef5a48363b8be3c3841488b4bd24f0b9aabdb3dd
SHA256 85eef72c1d89481785e7b92d9c865b02bf1fa61d00d1004b2a55ca51cffc18a4
SHA512 31528161e9823da588eea14031bfb3558bd9512c5f72fd0a820b44a666a77d588ff50e1710d2d1a0e6eded52f94a6a42e4dafdf241c9cecc34fe1d825660e0ce

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_ssl.pyd

MD5 a00400b26e9cb0361842127ed92d07e7
SHA1 389531753b83d78c57e17b9e05ff6238ecedf313
SHA256 f13c678bc68614f3a03c2b1ff52596b2d57e0691a6d65b165c58968edc87a876
SHA512 b5d4e60daafebb742a55ec736383eb86e335a5508fc853211a612c73c3143b3b4bc3047ccd40df5d9449ea789cd124b52c9b58b1943c0627ac3664d0bbf18650

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_sqlite3.pyd

MD5 eb09b533888fff0006bb6f9ede852ea9
SHA1 05a3117b35e1aa6896fc124fc4256982f60cd8b8
SHA256 f915d90190cf991c0c1638961fda7acc520dfa5d699b0b0742666e6f9d52110c
SHA512 940775e51b218b8924d38b04864a69da4f5dd38c460865f64e15a8cc165493166986a64a7d7bd62c55c61a8947a3db4fbd4ce8c44c7d28f879d5cada9d41c2cd

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_socket.pyd

MD5 de97e67002cbb61ffcf7fe311553a956
SHA1 62924f91f316db56856dca9bfec4e3c37728e374
SHA256 19ae80a512f3bac6b9db3b3fba0f57e94a148d77de8fa15a208db3bda293f9d0
SHA512 7823553c69cf53d0e394b6c481e3f689a934656e28163ee17f9a7765a15b8f6c71bba82e2d79a33c5851805149603673f8f095d0192b1b3ba7ca26dc0383cd3d

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_queue.pyd

MD5 0f6334751c1a8c58cbd3ecd073209da7
SHA1 ff18d5c197ccc1535e6418f7250cfd2230998d1e
SHA256 a2de5b574465ba4456436ea1fd1a5850e91c96c66333db1f4f126dadd624c3fc
SHA512 4c898a49f74403dd840108733fd03165fd459589fb3c23853ba9b6ce6d8e280b80c5a5c32563df7df8ddeec66c7c663572b080d1a00e7fceb31d3f20f21b327b

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_overlapped.pyd

MD5 c39258d952e25dc98cfd186d7f5eb2fa
SHA1 6d974755318a7b29cd96f300bb4ad584f7c87f1b
SHA256 46dbdb80001aa7007da773d3700a9c22db2fb6aaf3bf9823368d0bae2fb281c3
SHA512 ff0b411d7b7ad1c81b8cae54128bd9a0bdd3d8acf862ad28bd3b5274f2b7e70f0e777e5524d06ab86fb1e87481451ec425f34c33e25e3169bcba52ab5e6110f0

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_multiprocessing.pyd

MD5 7b31b10b42186dd4f9f47c3564751a90
SHA1 a6022fa60cdf6106935c4125fa3f0951ab169cd3
SHA256 ce9d2645620e50443cfdfb43acaf677ba6fcf449b41567302575c2c1a88625f9
SHA512 60b2ee50f459664f15389fe453d0efe93b4899ad9410b7711a605db36fc931d86277b93e5f352f5203a1c5fc25e434810e0331b123632b6e0065dd15806309be

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_elementtree.pyd

MD5 2d9392a05b1ad13530faa597231182bb
SHA1 4ebd80e6637156a7df1b1dcc9d45d184e84b9624
SHA256 226d98f627b65ea5a926571ca1eb42eeaa412abe3e93a7dc99ec68fd0c4dd506
SHA512 bcd2fb1fc6977e939270fbeb939be46d93cc59c120cd9a188eaca3f7f64dfccbeaab090b5fe9578f8e394904652f4737bd23adc5dab1acacd8cc8598bcd0e133

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_decimal.pyd

MD5 0da4bb3f7cb7b2a8e55791b42f8b0a59
SHA1 48918b7faa3a8ec432e878b44b0a792410e38cd6
SHA256 0200ba086548d39ef23dd14405bd4187eaca41077e693b8c2f7a403008e00b25
SHA512 b6a05798e3319e3e117e6298bcb96510761171d040bed85701552f669969d4f33cf0db8a9eb990aec2b4d1e32161723923b40af7298402584827fb12697f81b0

C:\Users\Admin\AppData\Local\Temp\_MEI17722\_asyncio.pyd

MD5 c5bc781fe3c55a6744f10e714c31f021
SHA1 9241ada83969670d375f14aa99faefb6fb985b3d
SHA256 920dd5db4b8d1cb1facb6c819de003c1b39ea07e759ef0fc34168fab4b4b4760
SHA512 09e9fc0aac7f3d666f5b9d2ead06f886cade61e85f777ca6f3da49f5743f762a34d9175de01136a561a025ca4acd29edfa72c574d320df8d3dd6b3488be19bfe

C:\Users\Admin\AppData\Local\Temp\_MEI17722\VCRUNTIME140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\_MEI17722\unicodedata.pyd

MD5 783bb94a8edffaef2f97c298d7f3703c
SHA1 189dc3a17c6597ffda6afb458b4ffa46a71282b0
SHA256 b87714ad22a980b89dcca9f8d79610a6e8cc183f643939c04c6d7257b1ffa353
SHA512 88487302a892cbb2cfba912dafe6fdc456252770d6c83a340660648699f3763fa7d7cebb0cc3a238b80a0d41ebfc9889417c0e7f07cc94582d14151925cb825e

C:\Users\Admin\AppData\Local\Temp\_MEI17722\sqlite3.dll

MD5 805c0e4d0f52966e05d4733eb77289bd
SHA1 61d73eae5f4e089b47abf0514e5259040c717f3f
SHA256 a8f852e99959f3e229b51159762d02cff1ee91a1e21dcd443e66fe6ec22e1a29
SHA512 1f422b417f7f96375aff736ecd84ec0534dc7eae661e3537fc9b371060044186a081299a0e5bde74be4883b77d48e0b133d53dbdc5e7395723b144af5d714a1f

C:\Users\Admin\AppData\Local\Temp\_MEI17722\select.pyd

MD5 f1fcaeda858277acdc1aab2de6875603
SHA1 10b9890dc18852628c68a379ffb0e528583b3db8
SHA256 7f3f336710cd6f961f923c9371ae0b1a63596d95eb99e436e5c646dc2337e4ce
SHA512 68edcc6a27ba6d9935a649a6ef150b56a8f6ce0ef35da784d62ce93f5a2a70f566619702e0150d3fe8585b3e0a0d6144802ca1fbd740a5ce8304d62cffcfffce

C:\Users\Admin\AppData\Local\Temp\_MEI17722\pyexpat.pyd

MD5 c18efd962ed040c5265e6af4d6c9769d
SHA1 cce69d5d9aa257caeac48e1b371889b7526c5d92
SHA256 c613a3560342279a5deb38bbee4f7101431e8bc3d9e00e666c672f61b3655a76
SHA512 2f99425c51b0a0817af83a13db9b654f759e577ff03826097feca72cc112934291e40356f3ebf48e6870dff913bebf9f9130e7ebcef6676cb195e7684e29755d

C:\Users\Admin\AppData\Local\Temp\_MEI17722\libssl-3.dll

MD5 5b63295552454d570281d321e4ca7266
SHA1 d849e5c470d63953ec55f2d732fd6f611cb2c655
SHA256 cff180ce2bcf7daa19d6f3702e416f54a55eebfaff382f4b6d8ee00c0954b861
SHA512 a2286ca195b5a8287e8fbee6d20678e3bbefc7eb20f89e510bc94801239d08c8ea620603254fbfc6c6c0d5306dc38dc1f78a675d62e9bbb8a625ec4f7b894930

C:\Users\Admin\AppData\Local\Temp\_MEI17722\libopus-0.x64.dll

MD5 e56f1b8c782d39fd19b5c9ade735b51b
SHA1 3d1dc7e70a655ba9058958a17efabe76953a00b4
SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
SHA512 b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

memory/4604-62-0x00007FFE978D0000-0x00007FFE978FB000-memory.dmp

memory/4604-86-0x00007FFE82B50000-0x00007FFE831B3000-memory.dmp

memory/4604-94-0x00007FFE99C80000-0x00007FFE99C8F000-memory.dmp

memory/4604-99-0x00007FFE978B0000-0x00007FFE978C4000-memory.dmp

memory/4604-100-0x00007FFE8FC90000-0x00007FFE901C3000-memory.dmp

memory/4604-98-0x00007FFE978D0000-0x00007FFE978FB000-memory.dmp

memory/4604-97-0x00007FFE98870000-0x00007FFE98889000-memory.dmp

memory/4604-96-0x00007FFE82B50000-0x00007FFE831B3000-memory.dmp

memory/4604-95-0x00007FFE987F0000-0x00007FFE98817000-memory.dmp