Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-01-2024 03:55

General

  • Target

    01a908923cbc76874658c47d432424a0.exe

  • Size

    86KB

  • MD5

    01a908923cbc76874658c47d432424a0

  • SHA1

    5397fdeeb8e9365b3d9a6b8f599e658e050de1d7

  • SHA256

    6ba75d8e032bf1a23d50f4426c9f00444bec1b5396f29042a72b652a515b4247

  • SHA512

    77b789fd17f8ea650ecb68a04238b195d1cfea9885f7fce637c83bfada95974326831b610509e18b5886fe48bb5ec0f70b57a835bc565af655a7ab0253614140

  • SSDEEP

    1536:Em65rG4SzbXVzjvf1nRmyr20DmjyleT0FfWU4f23F0Wbub7B4B/:E6HXVzhvI0FfWU4O10kuPKF

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
    "C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
      C:\Users\Admin\AppData\Local\Temp\01a908923cbc76874658c47d432424a0.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Users\Admin\AppData\Local\Temp\KORID0R.exe
        "C:\Users\Admin\AppData\Local\Temp\KORID0R.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
          "C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
          4⤵
          • Executes dropped EXE
          PID:2980
      • C:\Users\Admin\AppData\Local\Temp\build.exe
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2092
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
              PID:2460
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              5⤵
                PID:2784
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                5⤵
                  PID:1696
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3876
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  5⤵
                    PID:4524
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show networks mode=bssid
                    5⤵
                      PID:3816
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1616

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\Browsers\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\Directories\OneDrive.txt

              Filesize

              25B

              MD5

              966247eb3ee749e21597d73c4176bd52

              SHA1

              1e9e63c2872cef8f015d4b888eb9f81b00a35c79

              SHA256

              8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

              SHA512

              bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\Directories\Videos.txt

              Filesize

              23B

              MD5

              1fddbf1169b6c75898b86e7e24bc7c1f

              SHA1

              d2091060cb5191ff70eb99c0088c182e80c20f8c

              SHA256

              a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

              SHA512

              20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\System\Apps.txt

              Filesize

              5KB

              MD5

              109200e0ebbbb8555161615ac6f7b282

              SHA1

              4a128739efbf0eaed157f68eda5d505690dc643b

              SHA256

              464943501c3413d695b38a23e9c9469dcbfd5f6c6b707e5f24ff4cbd804e7e0b

              SHA512

              dd70f3a0be9746169a0c8b2b6a9769bdadd9cb2d4f6fc63daf4fddc289bd872874dc3f969d1b69cb1d33b22c74afbea622ec59041ef8cc767f329b990eefacae

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\System\Debug.txt

              Filesize

              320B

              MD5

              7c59f9fe840414789bd0d694721dc931

              SHA1

              3bd2bfa77d7d751f021aa39c519d7d71468281a2

              SHA256

              9cb2c43b23a986c6771a9e96c3ca89bb0b891dc71389e0338de5e8d32c14b6e2

              SHA512

              7c475ba54da940844170f1b71b2b1a518a173ccb0b7827d8e9347946040db8346cba28da0b263f3bd800e74983b6d5a9c269c71288e8a63ef3af46b550db023b

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\System\Process.txt

              Filesize

              4KB

              MD5

              e3b62f1517346f39fd7cf7984cf2827a

              SHA1

              48db581459a4f578d20daa0d89746d23d6789efd

              SHA256

              ccf5c5185e2df7e968b2f1e553421ffbe0628dab3aac6acf3cc57bc82c2976cd

              SHA512

              1390b940da4e404acef3e0485facfce688e5c9c888d33f1d85f4d6ceb234ee49fb4ffe534165896160165b4b9eb9432b0d8a3ab9c013d7658188a27bfddb8d91

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\Admin@NUPNSVML_en-US\System\ProductKey.txt

              Filesize

              29B

              MD5

              71eb5479298c7afc6d126fa04d2a9bde

              SHA1

              a9b3d5505cf9f84bb6c2be2acece53cb40075113

              SHA256

              f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

              SHA512

              7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

            • C:\Users\Admin\AppData\Local\290089e560d04ab6c39a980cb50156c3\msgid.dat

              Filesize

              19B

              MD5

              47301cf2c3d9432fee54ceffb6e1794c

              SHA1

              cbd71f5a6c6c406f30e2d298dbab923c511a6981

              SHA256

              195832702d8fcb054e0466f4b857aca48bf7dd06c09ff1e8d8d9fa0934685582

              SHA512

              a73c47ba98b515c2d277aaaf366528527664fe3b795092d5e4ba8b1e58893aaf0e5d1b1ec57251bdb5561e2f0c8888264d12fe1f78374bdc27628ab11311a5c7

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\01a908923cbc76874658c47d432424a0.exe.log

              Filesize

              1KB

              MD5

              c3941d9fa38f1717d5cecd7a2ca71667

              SHA1

              33b5362675383b58b4166ed9f9a61e5aa6768d2e

              SHA256

              f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

              SHA512

              98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

            • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe

              Filesize

              94KB

              MD5

              550628b16ef8c4e27c4081950cf8fd66

              SHA1

              ab11427c02cb53b70816b06d5a950b5f52c935eb

              SHA256

              09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa

              SHA512

              e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01

            • C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt

              Filesize

              234B

              MD5

              6be6fdca0cfa94635b8689b2b0bf2bee

              SHA1

              379c61029b5443c3d3df7c770423e40618b36d15

              SHA256

              5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb

              SHA512

              7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8

            • C:\Users\Admin\AppData\Local\Temp\Data\CreditCards.txt

              Filesize

              238B

              MD5

              0f5f7a38759e578c92bcf62c45d80b8a

              SHA1

              211e70ede55cce5bf67f685d85cbd030a8517d2b

              SHA256

              39059fc9bf3844dacbe329b623ca7a06f72656216dd4e52dc9b938b3d95289dc

              SHA512

              8130466f8ee346c0b931a34e63e2e9dc6f4070b85faaa58efdddd4d165fa605457d3137472c5fd09da87b0135a4beb660ee39cb390d78be6f0786950036b205d

            • C:\Users\Admin\AppData\Local\Temp\Data\Downloads.txt

              Filesize

              234B

              MD5

              ae0f7fab163139c661e576fe0af08651

              SHA1

              7545ab94360fd93f2209021b4cecabb92592be27

              SHA256

              832ff6318e2c78ac1907c74f3911f8815b545c16449cbce6753e21fb723cb657

              SHA512

              a3e342a3c72c079db96a8d6bb108830c3a772b926be0cf4e5d09ebb09e1babbc7602959bf1f82c8df8764f45479f318c3205114f23c96fd663efa792cff86b8b

            • C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt

              Filesize

              234B

              MD5

              412ec159e4b14be1ca93db473e80acc2

              SHA1

              8909b6f7fc8715a749270b6ceb8f05f823f59fd3

              SHA256

              eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe

              SHA512

              a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4

            • C:\Users\Admin\AppData\Local\Temp\KORID0R.exe

              Filesize

              1.4MB

              MD5

              222b8cba0f63d84500e3743f6532dfc4

              SHA1

              7fd3d70518259831c933236e9516b8aba7910821

              SHA256

              93796d923cb11c16352528f9c1e80df197df567d1d03819d7d21899fd64e424f

              SHA512

              4c728ea58bc42f29f585f2b1e4704418aa27f6464176967f4d7a3d46a10e24508d12cdc3035d4dfb32fc26f9714b13b05b4d81c4c7129246076b6f4e786a7162

            • C:\Users\Admin\AppData\Local\Temp\KORID0R.exe

              Filesize

              768KB

              MD5

              090381835958e49a158d95b1a8307cc8

              SHA1

              18d7714b9718791754b581450f77e1116127d6d7

              SHA256

              732664f5b564f40e11481bc0f7931313039566c4e18f83bb023f761ab04b61ae

              SHA512

              8326c67776277d9f50f7668dd979951c1880a1e2c8bf39c7d5e2540289d78b317208365f7295dcede855452554e7d3691dc44f0a916df559d67a2bd8384aa7f3

            • C:\Users\Admin\AppData\Local\Temp\KORID0R.exe

              Filesize

              320KB

              MD5

              d97b2e37808d7144a9ee47b9a915dbd0

              SHA1

              521e8f32704d3fee037d3b5e5d6a73a775cc9602

              SHA256

              cc0c927e43aa0ccef58e7bddba004b68266bd6132e72640fe0950ed4322a1f96

              SHA512

              f6561078b5192956b96a1ff173253143c116c1950b5757e1e7841b9716af1d834efa8f60e9bde60c64cec689634b99bdb36372ea7df5e85e38a075a8674a5b79

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              64KB

              MD5

              51b0bca51ca74d831ee1714d72f4f82a

              SHA1

              c45951f29491c64ad3847b9fc23741806c7db66d

              SHA256

              3a1cb2eb8e1f6195a3c17220efef67dd84c746ea5617c103eae6d21f188f9d44

              SHA512

              cfa62537b800a95ce79c04ffd7be8ab3997688527b9e3ffa5f80171d0c91b97ddc463181f8749ea40f3a4b3e0ad1b288b1808f5f46c219b93ae0c49056c66c47

            • C:\Users\Admin\AppData\Local\Temp\build.exe

              Filesize

              1.6MB

              MD5

              23c3a4f4136d15ceaca2a2a6af88ab59

              SHA1

              0f67a288d3d943282f0f28274dd6c8c29c40ea24

              SHA256

              7bde84ef1142b6460f2818f5a3137c1cdc508148c875caf7a91ac69ae026f942

              SHA512

              5741470ef32f6fca036220d0b57b9ec8ec4997dba23eb35a3cfa60631c30419c306925c22ed7247df26ef3d044130514c81470fce62d605e7f78184acd032fc9

            • memory/2092-1050-0x0000000007100000-0x0000000007108000-memory.dmp

              Filesize

              32KB

            • memory/2092-1048-0x00000000062D0000-0x00000000062D8000-memory.dmp

              Filesize

              32KB

            • memory/2092-1047-0x00000000062A0000-0x00000000062C6000-memory.dmp

              Filesize

              152KB

            • memory/2092-1046-0x0000000006210000-0x00000000062A2000-memory.dmp

              Filesize

              584KB

            • memory/2092-1049-0x00000000070F0000-0x00000000070FA000-memory.dmp

              Filesize

              40KB

            • memory/2092-1051-0x0000000007120000-0x000000000713E000-memory.dmp

              Filesize

              120KB

            • memory/2092-1117-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/2092-1191-0x00000000059E0000-0x00000000059F0000-memory.dmp

              Filesize

              64KB

            • memory/2092-999-0x00000000059E0000-0x00000000059F0000-memory.dmp

              Filesize

              64KB

            • memory/2092-1204-0x00000000059E0000-0x00000000059F0000-memory.dmp

              Filesize

              64KB

            • memory/2092-1239-0x0000000007440000-0x00000000074BA000-memory.dmp

              Filesize

              488KB

            • memory/2092-981-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/2092-979-0x00000000059F0000-0x0000000005A56000-memory.dmp

              Filesize

              408KB

            • memory/2092-978-0x0000000000FA0000-0x0000000001132000-memory.dmp

              Filesize

              1.6MB

            • memory/2092-1311-0x0000000007590000-0x0000000007642000-memory.dmp

              Filesize

              712KB

            • memory/2092-1313-0x00000000073E0000-0x0000000007402000-memory.dmp

              Filesize

              136KB

            • memory/2092-1314-0x000000000A040000-0x000000000A394000-memory.dmp

              Filesize

              3.3MB

            • memory/2092-1326-0x00000000059E0000-0x00000000059F0000-memory.dmp

              Filesize

              64KB

            • memory/2536-41-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-23-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-938-0x0000000008ED0000-0x00000000093D0000-memory.dmp

              Filesize

              5.0MB

            • memory/2536-939-0x0000000007090000-0x00000000070DC000-memory.dmp

              Filesize

              304KB

            • memory/2536-940-0x0000000009980000-0x0000000009F24000-memory.dmp

              Filesize

              5.6MB

            • memory/2536-1-0x0000000000CF0000-0x0000000000D0C000-memory.dmp

              Filesize

              112KB

            • memory/2536-944-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/2536-2-0x0000000005780000-0x0000000005790000-memory.dmp

              Filesize

              64KB

            • memory/2536-3-0x00000000084D0000-0x0000000008A3A000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-5-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-4-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-936-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/2536-67-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-65-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-63-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-61-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-7-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-59-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-57-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-9-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-55-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-53-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-11-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-13-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-51-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-15-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-17-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-49-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-19-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-21-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-47-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-45-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-43-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-0-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/2536-937-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

              Filesize

              4KB

            • memory/2536-39-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-37-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-35-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-33-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-31-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-29-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-27-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2536-25-0x00000000084D0000-0x0000000008A34000-memory.dmp

              Filesize

              5.4MB

            • memory/2980-1000-0x00007FFE31E20000-0x00007FFE328E1000-memory.dmp

              Filesize

              10.8MB

            • memory/2980-998-0x00007FFE31E20000-0x00007FFE328E1000-memory.dmp

              Filesize

              10.8MB

            • memory/2980-997-0x000001891DC20000-0x000001891DC3E000-memory.dmp

              Filesize

              120KB

            • memory/3280-977-0x0000023E6DF10000-0x0000023E6E088000-memory.dmp

              Filesize

              1.5MB

            • memory/3280-1004-0x0000023E72910000-0x0000023E72960000-memory.dmp

              Filesize

              320KB

            • memory/3280-984-0x0000023E70590000-0x0000023E705A0000-memory.dmp

              Filesize

              64KB

            • memory/3280-1045-0x00007FFE31E20000-0x00007FFE328E1000-memory.dmp

              Filesize

              10.8MB

            • memory/3280-980-0x00007FFE31E20000-0x00007FFE328E1000-memory.dmp

              Filesize

              10.8MB

            • memory/3912-983-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB

            • memory/3912-948-0x0000000005890000-0x000000000589A000-memory.dmp

              Filesize

              40KB

            • memory/3912-947-0x0000000005640000-0x0000000005650000-memory.dmp

              Filesize

              64KB

            • memory/3912-946-0x00000000056B0000-0x0000000005742000-memory.dmp

              Filesize

              584KB

            • memory/3912-945-0x0000000000400000-0x0000000000C0A000-memory.dmp

              Filesize

              8.0MB

            • memory/3912-943-0x00000000744C0000-0x0000000074C70000-memory.dmp

              Filesize

              7.7MB