Analysis

  • max time kernel
    38s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 01:43

General

  • Target

    0a7b9a3a120d129f53edd0c6fa2564b2.exe

  • Size

    5.7MB

  • MD5

    0a7b9a3a120d129f53edd0c6fa2564b2

  • SHA1

    062f9ab3533df764cebb4df4e09c15b0a154a977

  • SHA256

    c767c0c438dd1a2bfb6d14e35c30b24971b9a2db90748177ee23959b7b6b22ed

  • SHA512

    fbe42dc44812899e32a09012dd5c590f8fc298aac84ae0e140ab2b53e398707c708267aae6210dc3bad6559859ad0b0ef05dc74064a73586c2fb66903038d7eb

  • SSDEEP

    98304:xRCvLUBsg5qofeZPTS8u5u3hnN0sdnB4cY/TUwHOAU68+ociP88W5BzXq7lB:x6LUCg5qoZsRN0q0xLc+APE5BLq7P

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • Detect ZGRat V1 1 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 7 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a7b9a3a120d129f53edd0c6fa2564b2.exe
    "C:\Users\Admin\AppData\Local\Temp\0a7b9a3a120d129f53edd0c6fa2564b2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 0c1a94348.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\0c1a94348.exe
          0c1a94348.exe
          4⤵
            PID:1324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ae53a1dbd6.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\ae53a1dbd6.exe
            ae53a1dbd6.exe
            4⤵
            • Executes dropped EXE
            PID:2628
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 72a3df5b6765f57.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\72a3df5b6765f57.exe
            72a3df5b6765f57.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\72a3df5b6765f57.exe
              "C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\72a3df5b6765f57.exe" -a
              5⤵
              • Executes dropped EXE
              PID:4024
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c d8209827f876d25.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\d8209827f876d25.exe
            d8209827f876d25.exe
            4⤵
            • Executes dropped EXE
            PID:3648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c b7816bfa03.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\b7816bfa03.exe
            b7816bfa03.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4792
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c dc56b88fa7bd64.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\dc56b88fa7bd64.exe
            dc56b88fa7bd64.exe
            4⤵
            • Executes dropped EXE
            PID:3164
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 2e80f89eab2.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\2e80f89eab2.exe
            2e80f89eab2.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3588
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 38a72d1941.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\38a72d1941.exe
            38a72d1941.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:3012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 548
          3⤵
          • Program crash
          PID:3332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3884 -ip 3884
      1⤵
        PID:4468
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:1324
      • C:\Users\Admin\AppData\Roaming\ehsigcj
        C:\Users\Admin\AppData\Roaming\ehsigcj
        1⤵
          PID:888

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\0c1a94348.exe

          Filesize

          361KB

          MD5

          a508b5d5aa6d99b8c3d838e8ddfa2094

          SHA1

          9dd372c7b65f4b95a7f5fe1bc8a86417eaa5223a

          SHA256

          6978e86b3708438492944ecfa2fb06001c0372905fa1f820d145437546a2dc70

          SHA512

          2383cb732a895b34b0a36259ec550b2a62c4cda138127845744935fca74228525024d6153b3d244fb60443663d08276c8e63fde0bd6f237340828e27b2478068

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\2e80f89eab2.exe

          Filesize

          165KB

          MD5

          181f1849ccb484af2eebb90894706150

          SHA1

          45dee946a7abc9c1c05d158a05e768e06a0d2cdc

          SHA256

          aeb2d203b415b00e0a23aa026862cec8e11962fdb99c6dce38fb0b018b7d8409

          SHA512

          a87485005ca80e145a7b734735184fa2d374a7f02e591eec9e51b77dc2a51be7f8198ce5abfceb9546c48bf235a555f19d6c57469975d0b4c786b0db16df930c

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\2e80f89eab2.exe

          Filesize

          1KB

          MD5

          249f4b4a357ca5315c51a6365976490a

          SHA1

          61e01fc35dbcf5818904072f2622806959c14dd1

          SHA256

          b45ef323a3878ae53aaed179e40c321b3dfe81cd88129f1168911ded606e345b

          SHA512

          cdd2c0a2597be7b6be42d7ba6813af7a046b5fb486620016b74e08146d65c25cb50565913c888b0ac456479f2c3ba513d26e2004ed25cd4519c9a0993daf376f

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\38a72d1941.exe

          Filesize

          1KB

          MD5

          bbb4bf1874c6aa848fed02937d6fdfed

          SHA1

          0c2448d8ee34cabadb2cda9645ff1f357f0cbc6b

          SHA256

          995fadfd5fda48492e08b3377e91578fc2d52127d530aacda18c463a20c6373f

          SHA512

          5c607d29eb241a181fb76c4ebe38d8bd8a328f02f39d2e1e68615d2d7a238a4ea19d4b34643042343c0448facf1180a5053bd424a3a61f74f17aecbe0450744a

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\38a72d1941.exe

          Filesize

          375KB

          MD5

          6269626f2a26c49e1ddc4cc4266ad3c2

          SHA1

          e9c4590dcc81c47066b830b03dbfb3b296e02a85

          SHA256

          2aa8d4e4862b3aaa1b418b0457fd9d96aa5b28f7792962ece5a010f357e51839

          SHA512

          d2be3f80345dbfc02696edb3c9b5213c1e2201100a3c2f013eedb1aa74c272d0cdde00518523f9071b58efadfe34ee474f1d8015805b26ce97511e318a22843d

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\72a3df5b6765f57.exe

          Filesize

          56KB

          MD5

          c0d18a829910babf695b4fdaea21a047

          SHA1

          236a19746fe1a1063ebe077c8a0553566f92ef0f

          SHA256

          78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

          SHA512

          cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\ae53a1dbd6.exe

          Filesize

          65KB

          MD5

          0c42958395907fb667234e10bdeb3b13

          SHA1

          1af2dbdb57669e979effb1779db88c76ada28692

          SHA256

          66c668f22e3a7a6e3a33f234a8964385989b5fbb4730e0e5bed56fd65cccb813

          SHA512

          da403190df53f757ca16ec6e3e5f5ee682053abf66a76f52ffc62476876b25f9ffe4ca9535c6b7cf7fc6f32d9913ed12cc7ee72dc99749e1fcdfa755e2ee6fce

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\ae53a1dbd6.exe

          Filesize

          441KB

          MD5

          22059847d8fa60fe8eabba11d3bac0f8

          SHA1

          151a609099722f3d78b9769a604a882aa9b44f37

          SHA256

          5974ae44f8a95fc4c81775aa6c6ae31eaff5be20ee9a06c3e322d9393898c329

          SHA512

          3f1f27fbeb7f42f4acce5f71964925591d72d8135abd2077e8623f3e53b598633b4d9612ba3e65207623d260da918d009a90e46f6da3daad33511490e8ba9e34

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\b7816bfa03.exe

          Filesize

          8KB

          MD5

          83cc20c8d4dd098313434b405648ebfd

          SHA1

          59b99c73776d555a985b2f2dcc38b826933766b3

          SHA256

          908b275d6fc2f20e9d04e8609a9d994f7e88a429c3eb0a55d99ca1c681e17ec8

          SHA512

          e00009e1f322a1fe6e24f88a1cc722acf3094569174e7c58ebf06f75f50a7735dcebf3e493886bbdc87593345adc8bb7b6f2daca2e64618f276075a0bb46bb8c

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\d8209827f876d25.exe

          Filesize

          241KB

          MD5

          5866ab1fae31526ed81bfbdf95220190

          SHA1

          75a5e08b3b9ad2dff35dfbbb3ffe8d983c2be25f

          SHA256

          9e1a149370efe9814bf2cbd87acfcfa410d1769efd86a9722da4373d6716d22e

          SHA512

          8d99ab09e84e4ef309da34be94946cbfcffeb1c0ca49e2452deb738d801e551062ebb134f1b99a9baf03003a8e720d525521ce09aeac341d3cba3fcfbc618fb5

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\dc56b88fa7bd64.exe

          Filesize

          697KB

          MD5

          fcce864840d6700d71a8d68668d7a538

          SHA1

          fef82b13a6565e5da4eaf24ce6566c513c6a58fd

          SHA256

          0d017311cfc1554b76481b6b0d40d1c150c1a0aedcda302f513c01de0b1f4e4c

          SHA512

          3f01d5cd486b3394c46896f0d2c9eed1e6e1825c15e729ab357105d562fc0b73e7a7ab69f56107ae3e6941acff5dec43c3bbdda023909723c47547ea2d51d740

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\dc56b88fa7bd64.exe

          Filesize

          50KB

          MD5

          ea851f7d3444c4ff1039e6bbe8d74c11

          SHA1

          953d9c05d4dc8a91dd47328d8ddd5a9cb5b8c2f0

          SHA256

          4de84c3c90d688e3a9f69d49e5cad4167a40aa4c98f29d35b36da770c43b8e3e

          SHA512

          e407accc4dd032bf354a309f6e860b921083c222c8304bab0057230cfeaa3ed959c45b8bf663109c7cb9f485644121fb35d66da00f0a0ccd2aea0806c66a1db0

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\libcurl.dll

          Filesize

          218KB

          MD5

          d09be1f47fd6b827c81a4812b4f7296f

          SHA1

          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

          SHA256

          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

          SHA512

          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\libcurlpp.dll

          Filesize

          54KB

          MD5

          e6e578373c2e416289a8da55f1dc5e8e

          SHA1

          b601a229b66ec3d19c2369b36216c6f6eb1c063e

          SHA256

          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

          SHA512

          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\libgcc_s_dw2-1.dll

          Filesize

          113KB

          MD5

          9aec524b616618b0d3d00b27b6f51da1

          SHA1

          64264300801a353db324d11738ffed876550e1d3

          SHA256

          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

          SHA512

          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\libstdc++-6.dll

          Filesize

          647KB

          MD5

          5e279950775baae5fea04d2cc4526bcc

          SHA1

          8aef1e10031c3629512c43dd8b0b5d9060878453

          SHA256

          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

          SHA512

          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\libwinpthread-1.dll

          Filesize

          69KB

          MD5

          1e0d62c34ff2e649ebc5c372065732ee

          SHA1

          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

          SHA256

          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

          SHA512

          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\setup_install.exe

          Filesize

          3.4MB

          MD5

          30dd6a1c785c32523047663952d1e13d

          SHA1

          ade55eaa7ca9781e5536f776ec104e10f344d7a5

          SHA256

          cf3d67165005cc488a7c5d2c2511ae5aff92ac4388e7fc6bc73060af112ce9d0

          SHA512

          aa6def357ef9d233ed290bafc46036468bb82db0800085798674a2b74e3923f427ff5ab04c8bfa031ac8d15e98f356201400e30636fda453cb0ff2a3e1f1f516

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\setup_install.exe

          Filesize

          1.0MB

          MD5

          69e9a20efc45f47bd0c646c7b79746eb

          SHA1

          a770f4f9d6b0a311852198c8ae873b0cf899b8af

          SHA256

          590cb3af3cdf8128482a550c5e91c2d0adfc7be7f95e2d6e3644de9251460b44

          SHA512

          e0980c11c02ccbcc91f5f876e5b65b3663a0497f312a368a4e68be48784fcf250f1504cffbbccebae66175c8fb603133a21de3b986dcd15654337e1468b2abf0

        • C:\Users\Admin\AppData\Local\Temp\7zS4B76ABB7\setup_install.exe

          Filesize

          2.6MB

          MD5

          2175658e1fcec76a17af6bae6b89d693

          SHA1

          1f2da5edc28b70734dca5a7b563d4251a2b881cd

          SHA256

          407a0d64733bae9130f9530ee3a64df6f9e163efb3472d3b857007f82f71c91d

          SHA512

          82aaa490979193d947f05a786a1853d2eea36a322b83c16fc565bde778aebbd97e9b96be0e5eb652b9e253e5ed47aa8e0586df42344cb9c063daa74ccd99ec13

        • C:\Users\Admin\AppData\Roaming\ehsigcj

          Filesize

          42KB

          MD5

          a1fa37e471a48f7c3f3e2b151f60a650

          SHA1

          7766f3bd7261e3b78fa4a30d5ebce18ff3f8f29a

          SHA256

          ed5985f6d710c502c8614486ae37d3e08fd4897dae51d1d7e090ae1068e3da95

          SHA512

          772370bf44b9ce2f6523917435493b0fdf4b9c08d4a58f68b460897d66f8f386158b3081fd85b8b79b8afb684390ca537fe13c8b2d7cf7c57f2438711293d2f0

        • C:\Users\Admin\AppData\Roaming\ehsigcj

          Filesize

          273KB

          MD5

          d94e351ac62153e4631717e8e9eb8929

          SHA1

          507272debc80dfc4581d23fd6f779466d5f5bafd

          SHA256

          7652007392c2b84ce2c89224ed050ae1d6440f1bc9fecbc17feeb9a90eec59de

          SHA512

          e0ead56165cd10cbefed78cd5cef72d96cb690cb59b66cbf0f701c183c006476ecc17a6f7dc8e5a92b255a83ae2db0137402becc7559e46457698d2691cb998e

        • C:\Users\Admin\AppData\Roaming\ehsigcj

          Filesize

          198KB

          MD5

          9a18ee63c220f10953626fbd990a0c9f

          SHA1

          c9b7929d80ab571f381083252463d29fd8281d8f

          SHA256

          77a380a82f5e19f033940eb213434a0a739fd683289fe41a33d9ed2702b7eb20

          SHA512

          1f5ef80da5a00987a3b687ddab56f2ce2be07c786fd0aff09baf28f7bb5927f8311b67f279b6a94d8f08178a4dffc709129cc423fe4144c9a59093bd0b361557

        • memory/888-157-0x0000000000400000-0x00000000032F7000-memory.dmp

          Filesize

          47.0MB

        • memory/888-156-0x0000000003510000-0x0000000003610000-memory.dmp

          Filesize

          1024KB

        • memory/888-159-0x0000000000400000-0x00000000032F7000-memory.dmp

          Filesize

          47.0MB

        • memory/1324-110-0x00000000001C0000-0x00000000001C9000-memory.dmp

          Filesize

          36KB

        • memory/1324-113-0x0000000003510000-0x0000000003610000-memory.dmp

          Filesize

          1024KB

        • memory/1324-119-0x0000000000400000-0x00000000032F7000-memory.dmp

          Filesize

          47.0MB

        • memory/1324-135-0x00000000001C0000-0x00000000001C9000-memory.dmp

          Filesize

          36KB

        • memory/3012-103-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-120-0x0000000005C50000-0x0000000006268000-memory.dmp

          Filesize

          6.1MB

        • memory/3012-142-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-87-0x0000000000370000-0x0000000000B96000-memory.dmp

          Filesize

          8.1MB

        • memory/3012-143-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-144-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-147-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-146-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-145-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-139-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-140-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-132-0x0000000005910000-0x0000000005A1A000-memory.dmp

          Filesize

          1.0MB

        • memory/3012-129-0x0000000005770000-0x00000000057BC000-memory.dmp

          Filesize

          304KB

        • memory/3012-122-0x0000000005560000-0x000000000559C000-memory.dmp

          Filesize

          240KB

        • memory/3012-121-0x0000000005500000-0x0000000005512000-memory.dmp

          Filesize

          72KB

        • memory/3012-118-0x0000000000370000-0x0000000000B96000-memory.dmp

          Filesize

          8.1MB

        • memory/3012-102-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-101-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-108-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-104-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-106-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-107-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-105-0x0000000076450000-0x0000000076540000-memory.dmp

          Filesize

          960KB

        • memory/3012-109-0x0000000077304000-0x0000000077306000-memory.dmp

          Filesize

          8KB

        • memory/3164-138-0x0000000000400000-0x00000000004A1000-memory.dmp

          Filesize

          644KB

        • memory/3164-111-0x0000000003420000-0x00000000034BD000-memory.dmp

          Filesize

          628KB

        • memory/3164-114-0x00000000034F0000-0x00000000035F0000-memory.dmp

          Filesize

          1024KB

        • memory/3164-137-0x0000000003420000-0x00000000034BD000-memory.dmp

          Filesize

          628KB

        • memory/3164-123-0x0000000000400000-0x000000000334B000-memory.dmp

          Filesize

          47.3MB

        • memory/3376-158-0x00000000010C0000-0x00000000010D6000-memory.dmp

          Filesize

          88KB

        • memory/3376-133-0x0000000002D10000-0x0000000002D26000-memory.dmp

          Filesize

          88KB

        • memory/3588-112-0x00007FFCADD60000-0x00007FFCAE821000-memory.dmp

          Filesize

          10.8MB

        • memory/3588-90-0x00000000009E0000-0x0000000000A0E000-memory.dmp

          Filesize

          184KB

        • memory/3588-115-0x00000000011B0000-0x00000000011D2000-memory.dmp

          Filesize

          136KB

        • memory/3588-117-0x00000000011E0000-0x00000000011E6000-memory.dmp

          Filesize

          24KB

        • memory/3588-95-0x00000000011A0000-0x00000000011A6000-memory.dmp

          Filesize

          24KB

        • memory/3588-124-0x000000001B5F0000-0x000000001B600000-memory.dmp

          Filesize

          64KB

        • memory/3884-92-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/3884-42-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-126-0x0000000064940000-0x0000000064959000-memory.dmp

          Filesize

          100KB

        • memory/3884-127-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/3884-25-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/3884-130-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-131-0x000000006EB40000-0x000000006EB63000-memory.dmp

          Filesize

          140KB

        • memory/3884-128-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-39-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-36-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-38-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-29-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-41-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-43-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/3884-97-0x000000006EB40000-0x000000006EB63000-memory.dmp

          Filesize

          140KB

        • memory/3884-93-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/3884-91-0x0000000064940000-0x0000000064959000-memory.dmp

          Filesize

          100KB

        • memory/3884-89-0x0000000000400000-0x0000000000C7F000-memory.dmp

          Filesize

          8.5MB

        • memory/3884-44-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/3884-30-0x0000000000F10000-0x0000000000F9F000-memory.dmp

          Filesize

          572KB

        • memory/3884-37-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/3884-35-0x0000000064940000-0x0000000064959000-memory.dmp

          Filesize

          100KB

        • memory/3884-34-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4792-141-0x000000001B870000-0x000000001B880000-memory.dmp

          Filesize

          64KB

        • memory/4792-100-0x000000001B870000-0x000000001B880000-memory.dmp

          Filesize

          64KB

        • memory/4792-84-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

          Filesize

          32KB

        • memory/4792-99-0x00007FFCADD60000-0x00007FFCAE821000-memory.dmp

          Filesize

          10.8MB