Analysis

  • max time kernel
    85s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2024 10:02

General

  • Target

    48ad5d8112df0d5b74f71fd25ccd4e18.exe

  • Size

    3.9MB

  • MD5

    48ad5d8112df0d5b74f71fd25ccd4e18

  • SHA1

    ca1d0832be94feac8d1441efcaa333886e8ce835

  • SHA256

    82e531dd4163ca5716a8b2f3feb188fc7fdbf8cac0270aa76664925fdd5124e2

  • SHA512

    37c55236155ea93f94129f9211f392329302b764c93ae722acbaec452464019dab8635e2e9a0d8c6e4d6b5add0f902c58bdfa691d45c62b42eb05f8056bbe3c4

  • SSDEEP

    49152:xcB7EwJ84vLRaBtIl9mVhKi/98J/94r0VwTsrZM3bDHIxbQSdXL5F6q7Q6i4cgKT:x1CvLUBsgcM4/94rGY3PHa3/rKgKg2T

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\48ad5d8112df0d5b74f71fd25ccd4e18.exe
    "C:\Users\Admin\AppData\Local\Temp\48ad5d8112df0d5b74f71fd25ccd4e18.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4618E977\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 0035b9e6fdaf9.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\0035b9e6fdaf9.exe
          0035b9e6fdaf9.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3876
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
            5⤵
            • Executes dropped EXE
            PID:4688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 576
        3⤵
        • Program crash
        PID:4480
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 81edfb0db828.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3712
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cb3f07883441a5d6.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4592
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 731da7284717.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 0b0f89497d35095.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1576
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 27e380c23ad33.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3068
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 7da174d16d4.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1192
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 53d58f3832.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 95714f41791.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2360
  • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\53d58f3832.exe
    53d58f3832.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4140
  • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\731da7284717.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4618E977\731da7284717.exe" -a
    1⤵
    • Executes dropped EXE
    PID:4968
  • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
    "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
    1⤵
    • Executes dropped EXE
    PID:4972
  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:3660
    • C:\Windows\winnetdriv.exe
      "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1704621818 0
      2⤵
      • Executes dropped EXE
      PID:1448
  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
    1⤵
    • Executes dropped EXE
    PID:756
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2024 -ip 2024
    1⤵
      PID:468
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\27e380c23ad33.exe
      27e380c23ad33.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1068
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\cb3f07883441a5d6.exe
      cb3f07883441a5d6.exe
      1⤵
      • Executes dropped EXE
      PID:2296
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\7da174d16d4.exe
      7da174d16d4.exe
      1⤵
      • Executes dropped EXE
      PID:2516
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\81edfb0db828.exe
      81edfb0db828.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4820
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\731da7284717.exe
      731da7284717.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2472
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\0b0f89497d35095.exe
      0b0f89497d35095.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1288
    • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\95714f41791.exe
      95714f41791.exe
      1⤵
      • Executes dropped EXE
      PID:5096
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2516 -ip 2516
      1⤵
        PID:396
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
        • Modifies data under HKEY_USERS
        PID:452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7zS396A.tmp\Install.cmd

        Filesize

        51B

        MD5

        a3c236c7c80bbcad8a4efe06a5253731

        SHA1

        f48877ba24a1c5c5e070ca5ecb4f1fb4db363c07

        SHA256

        9a9e87561a30b24ad4ad95c763ec931a7cfcc0f4a5c23d12336807a61b089d7d

        SHA512

        dc73af4694b0d8390bcae0e9fd673b982d2c39f20ca4382fddc6475a70891ce9d8e86c2501d149e308c18cd4d3a335cc3411157de23acf6557ed21578c5f49cc

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\0b0f89497d35095.exe

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\0b0f89497d35095.exe

        Filesize

        83KB

        MD5

        7983e14af3ba9fe1981d33b1a1fbfebb

        SHA1

        c78e705114c3e8f31402e1048c74626fe68f3321

        SHA256

        a1da52dabeaff4e9712949548cce00c8786b59fb1187d9823b94d2e7ca75e75f

        SHA512

        473544e7492300ff70d3d64d7b3610f0ca9edccf6768722b832eac4df5d63d09f05fed070cb53477f8939be776a0b7661c263fe17ab68693d9e1a70e39935ce9

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\731da7284717.exe

        Filesize

        56KB

        MD5

        c0d18a829910babf695b4fdaea21a047

        SHA1

        236a19746fe1a1063ebe077c8a0553566f92ef0f

        SHA256

        78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

        SHA512

        cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\95714f41791.exe

        Filesize

        131KB

        MD5

        3fffde8679f15a688d99b5206957271a

        SHA1

        1668e52fdbc2822f0b032859ba225d0b05012538

        SHA256

        bad9ea3883bad46c6b1be8094cd9cfe28db41a981eb0ce5f4aa1c76193e6a1bf

        SHA512

        9d9c9e86821d8ee95f4ae46892e66500f221df983391b07148203d335c96a297b49339cc8515f8b862a333ae3eb7286641039f3461e8c4af915de58b6af0c3c7

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\libcurl.dll

        Filesize

        218KB

        MD5

        d09be1f47fd6b827c81a4812b4f7296f

        SHA1

        028ae3596c0790e6d7f9f2f3c8e9591527d267f7

        SHA256

        0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

        SHA512

        857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\libcurlpp.dll

        Filesize

        54KB

        MD5

        e6e578373c2e416289a8da55f1dc5e8e

        SHA1

        b601a229b66ec3d19c2369b36216c6f6eb1c063e

        SHA256

        43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

        SHA512

        9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\libgcc_s_dw2-1.dll

        Filesize

        113KB

        MD5

        9aec524b616618b0d3d00b27b6f51da1

        SHA1

        64264300801a353db324d11738ffed876550e1d3

        SHA256

        59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

        SHA512

        0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\libstdc++-6.dll

        Filesize

        647KB

        MD5

        5e279950775baae5fea04d2cc4526bcc

        SHA1

        8aef1e10031c3629512c43dd8b0b5d9060878453

        SHA256

        97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

        SHA512

        666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\libwinpthread-1.dll

        Filesize

        69KB

        MD5

        1e0d62c34ff2e649ebc5c372065732ee

        SHA1

        fcfaa36ba456159b26140a43e80fbd7e9d9af2de

        SHA256

        509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

        SHA512

        3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\setup_install.exe

        Filesize

        124KB

        MD5

        a79f8609262355ef1539aed4d5471a63

        SHA1

        86658bba60a1e3d4972da614087e8825c2646d2e

        SHA256

        8d87a4093c7c0e39ba64bd47acd82719307037e086fa907ed530d505ea8b3540

        SHA512

        bd7bf9f7a215a09d063e9ec8514a46614d4f3f39013390ca665244644d78d7812c7e99c75c21076d7bea3cdebcbaa4cbd231733cc0a78da6f9d6cd4896546c0d

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\setup_install.exe

        Filesize

        79KB

        MD5

        fec53691cc3e034b6967a3340a0c15c8

        SHA1

        092651002570c17d9b493bc5d4ad194c91e16136

        SHA256

        ad665a1dd391bfaae019bb51ba72b0791c17e892acc3efd69aa7e14849ba9a16

        SHA512

        695f79e12b1465c07916a40db9086c0548d280ab8b615b6469a6157ed7ce669a8193474a782453b397d56929f32031b0cef445af66c62ed148e8ef99d9b3d48b

      • C:\Users\Admin\AppData\Local\Temp\7zS4618E977\setup_install.exe

        Filesize

        1.4MB

        MD5

        3b68307657ddbfa9e4c8944872a14836

        SHA1

        e4e2bfc2f5519af5e633a8e1b8120aecabde517f

        SHA256

        6684153e0baae31eddfc744ca7a28a6897df073e467ebf138f2df5604c726c0d

        SHA512

        c60a8b4e74b12d006a790388f9f44e180cd3849842dee7fd4e4bff330640eb262714070eb11f8ac66904f0a63d11b5bd152e76be2aa0dbef813f6d42428f48ab

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE

        Filesize

        117KB

        MD5

        a628baa97881fa5528009c9470cadee0

        SHA1

        583aa730e302fe0015cdb0dee4e279f193d66d87

        SHA256

        e2bb9ee3616cd827cc3ee297cbe24cfbd2ded4d9efe894e68453f6cfbf18e4c5

        SHA512

        c84e496e13d30c24efd020f25f4cd55b6157feb529f7285d97445c386fd50a50e943b0f67745a861a97c5bf0c4ff7dee7b5240d52c59b66421a9bdc26de58faf

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE

        Filesize

        73KB

        MD5

        74bb44fc17b7b248a53c01eeb2d5b12a

        SHA1

        bd87175dbaf456e68e119c3c914d0f2686688c02

        SHA256

        305dd91a561dfe917bd077f43d9290567cf0c58291bca6e503d3d7ad39d02197

        SHA512

        33db4bfa67a6bbadf7296d38eace01023d7aa742ac36cea90835097df829b6cc74f3d0e496e965415fe4eacda2aca9b10538f3223317db06d215dd55b3a55f85

      • memory/756-134-0x0000000005690000-0x000000000569A000-memory.dmp

        Filesize

        40KB

      • memory/756-111-0x0000000005C10000-0x00000000061B4000-memory.dmp

        Filesize

        5.6MB

      • memory/756-137-0x00000000059D0000-0x0000000005A6C000-memory.dmp

        Filesize

        624KB

      • memory/756-187-0x0000000005640000-0x0000000005650000-memory.dmp

        Filesize

        64KB

      • memory/756-182-0x0000000002FA0000-0x0000000002FB2000-memory.dmp

        Filesize

        72KB

      • memory/756-106-0x0000000000C70000-0x0000000000DB2000-memory.dmp

        Filesize

        1.3MB

      • memory/756-113-0x0000000005700000-0x0000000005792000-memory.dmp

        Filesize

        584KB

      • memory/756-143-0x00000000734D0000-0x0000000073C80000-memory.dmp

        Filesize

        7.7MB

      • memory/1068-108-0x0000000001780000-0x00000000017A0000-memory.dmp

        Filesize

        128KB

      • memory/1068-112-0x00000000017A0000-0x00000000017A6000-memory.dmp

        Filesize

        24KB

      • memory/1068-96-0x0000000000FA0000-0x0000000000FCC000-memory.dmp

        Filesize

        176KB

      • memory/1068-102-0x0000000001770000-0x0000000001776000-memory.dmp

        Filesize

        24KB

      • memory/1068-142-0x00007FFCBDC40000-0x00007FFCBE701000-memory.dmp

        Filesize

        10.8MB

      • memory/1068-138-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

        Filesize

        64KB

      • memory/1288-103-0x00000000734D0000-0x0000000073C80000-memory.dmp

        Filesize

        7.7MB

      • memory/1288-139-0x00000000734D0000-0x0000000073C80000-memory.dmp

        Filesize

        7.7MB

      • memory/1288-91-0x00000000003F0000-0x00000000004DE000-memory.dmp

        Filesize

        952KB

      • memory/1448-157-0x0000000000B30000-0x0000000000C14000-memory.dmp

        Filesize

        912KB

      • memory/2024-163-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/2024-44-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/2024-32-0x0000000000C60000-0x0000000000CEF000-memory.dmp

        Filesize

        572KB

      • memory/2024-161-0x0000000000400000-0x00000000009DB000-memory.dmp

        Filesize

        5.9MB

      • memory/2024-166-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/2024-167-0x000000006EB40000-0x000000006EB63000-memory.dmp

        Filesize

        140KB

      • memory/2024-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-165-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/2024-41-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-36-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/2024-28-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/2024-34-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/2024-33-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/2024-38-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-43-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/2024-42-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-39-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/2024-37-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/2024-35-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/2296-144-0x0000000002D50000-0x0000000002E50000-memory.dmp

        Filesize

        1024KB

      • memory/2296-140-0x0000000000400000-0x0000000002CCE000-memory.dmp

        Filesize

        40.8MB

      • memory/2296-136-0x0000000004840000-0x00000000048DD000-memory.dmp

        Filesize

        628KB

      • memory/2296-188-0x0000000002D50000-0x0000000002E50000-memory.dmp

        Filesize

        1024KB

      • memory/3328-169-0x0000000000ED0000-0x0000000000EE6000-memory.dmp

        Filesize

        88KB

      • memory/3660-145-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/4140-170-0x0000000000400000-0x0000000002C72000-memory.dmp

        Filesize

        40.4MB

      • memory/4140-107-0x0000000002E90000-0x0000000002F90000-memory.dmp

        Filesize

        1024KB

      • memory/4140-109-0x0000000004780000-0x0000000004789000-memory.dmp

        Filesize

        36KB

      • memory/4140-128-0x0000000000400000-0x0000000002C72000-memory.dmp

        Filesize

        40.4MB

      • memory/4820-97-0x00007FFCBDC40000-0x00007FFCBE701000-memory.dmp

        Filesize

        10.8MB

      • memory/4820-186-0x000000001ACC0000-0x000000001ACD0000-memory.dmp

        Filesize

        64KB

      • memory/4820-105-0x000000001ACC0000-0x000000001ACD0000-memory.dmp

        Filesize

        64KB

      • memory/4820-81-0x00000000000D0000-0x00000000000D8000-memory.dmp

        Filesize

        32KB

      • memory/4972-126-0x0000000000990000-0x00000000009A0000-memory.dmp

        Filesize

        64KB

      • memory/4972-190-0x000000001CD30000-0x000000001CD32000-memory.dmp

        Filesize

        8KB

      • memory/4972-189-0x0000000002F00000-0x0000000002F0E000-memory.dmp

        Filesize

        56KB

      • memory/4972-141-0x00007FFCBDC40000-0x00007FFCBE701000-memory.dmp

        Filesize

        10.8MB