Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-01-2024 03:55

General

  • Target

    ac15ae1e49f4272e8d38b5fd5573ce35.exe

  • Size

    81KB

  • MD5

    ac15ae1e49f4272e8d38b5fd5573ce35

  • SHA1

    93a70b449926995d458b9513b8b36e988f73dc8a

  • SHA256

    c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149

  • SHA512

    23d7977aeac5a2f1856861519b34dbbd4aa52ed003d4001b73435024266d258d765613a3be8a1e2ae67548f9eb69f662925d663f8321f1610f200af6258025f8

  • SSDEEP

    1536:D7Vs/tSdQLcSjAA0C0rEr2ofgNTX0g/+PmN/10BmglZqiqazVkP5tJCFPzRUR2lX:D5MmQLcxAarEDINTD/+Pmn0BmgnpzmcP

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
    "C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
      C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
      2⤵
        PID:4384
      • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
        C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Users\Admin\AppData\Local\Temp\build.exe
          "C:\Users\Admin\AppData\Local\Temp\build.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4832
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1040
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              5⤵
                PID:1624
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show profile
                5⤵
                  PID:3524
                • C:\Windows\SysWOW64\findstr.exe
                  findstr All
                  5⤵
                    PID:4100
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 2924
                  4⤵
                  • Program crash
                  PID:3488
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4884
              • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
                "C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]"
                3⤵
                • Checks computer location settings
                • Drops startup file
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2936
                • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
                  "C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4624
            • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
              C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
              2⤵
                PID:4756
              • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                2⤵
                  PID:3928
                • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                  2⤵
                    PID:4744
                  • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                    C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                    2⤵
                      PID:4060
                    • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                      C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                      2⤵
                        PID:1552
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
                      1⤵
                        PID:3144
                      • C:\Windows\system32\msiexec.exe
                        C:\Windows\system32\msiexec.exe /V
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2180
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 65001
                        1⤵
                          PID:3256
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh wlan show networks mode=bssid
                          1⤵
                            PID:3216

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac15ae1e49f4272e8d38b5fd5573ce35.exe.log

                            Filesize

                            1KB

                            MD5

                            c3941d9fa38f1717d5cecd7a2ca71667

                            SHA1

                            33b5362675383b58b4166ed9f9a61e5aa6768d2e

                            SHA256

                            f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

                            SHA512

                            98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

                          • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]

                            Filesize

                            92KB

                            MD5

                            db1db944d15a0e73b92e0110276a32bc

                            SHA1

                            52316cb8d918733518dc684bf8a308454d753a2d

                            SHA256

                            0729cb927eb057acf0cfb1392a7d6ea3904efca670e2b15fc0358dc604b296a9

                            SHA512

                            186d31c263602015cc91ee3b78f2bdd1d285d02a8dc2bf17e9e4fe132f3b96be14a2c2acd873054539e1dd3316b8d7c82c522a9ad51b5beb56dfca4672fbf85d

                          • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]

                            Filesize

                            47KB

                            MD5

                            7d94b62e7228aa24d9d615ce543414d1

                            SHA1

                            2b30facea676f15c07fa9b9b5b6ca7839d3eb75a

                            SHA256

                            9b6213486ab54b419a2bba93b40fb081c481cd0a5aba53f3517338958a4a22d9

                            SHA512

                            b3c79aad0f96ccfc661f7da670c3cb1371271ea488fe07fa22f3cd75adc5696e6fd9e75078a737962d35e578e447c2b01d69b06daad38d75bd458e0292b9b6bd

                          • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe

                            Filesize

                            78KB

                            MD5

                            ccb34b0822f97823271f54f8f3317aef

                            SHA1

                            63208b33284d3577aa08ea5cc2acdc6e2c2eba35

                            SHA256

                            4c8a524e7fa23252edaadca238b377a438a6240a45540b664662f5e58f539c6e

                            SHA512

                            e19a228bf4d8cf61276b2f2872255269c894a9299970c44d5827feed6606821dbd863d71a00d294444a44f98800a71713bd998a5ac050622f793771a859efd9f

                          • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe

                            Filesize

                            92KB

                            MD5

                            098a6c62ab4520953a52d8c84053269e

                            SHA1

                            92ba08d9b34114f1d412b33d2d1f0190fe20426d

                            SHA256

                            97a03af43afdff2cb79e15f7de780684ded4bd31f87f5cdac821844ad99dab0d

                            SHA512

                            f55c35ff15f30820cf359d5dbf626a683e7ab2062d103b48d8869f60f0cfe9bb0d4ccd2efab9a835b32c09e0f7066b1071a3408ccea0c58e83c0821b244a106d

                          • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe

                            Filesize

                            94KB

                            MD5

                            550628b16ef8c4e27c4081950cf8fd66

                            SHA1

                            ab11427c02cb53b70816b06d5a950b5f52c935eb

                            SHA256

                            09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa

                            SHA512

                            e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01

                          • C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt

                            Filesize

                            234B

                            MD5

                            6be6fdca0cfa94635b8689b2b0bf2bee

                            SHA1

                            379c61029b5443c3d3df7c770423e40618b36d15

                            SHA256

                            5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb

                            SHA512

                            7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8

                          • C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt

                            Filesize

                            234B

                            MD5

                            412ec159e4b14be1ca93db473e80acc2

                            SHA1

                            8909b6f7fc8715a749270b6ceb8f05f823f59fd3

                            SHA256

                            eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe

                            SHA512

                            a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4

                          • C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt

                            Filesize

                            234B

                            MD5

                            36f6acc2229073f5bb4074cee73d1d5b

                            SHA1

                            b2adbb44350d984dff40c15fcbbeb3379c7ec0e5

                            SHA256

                            8a947e0921f9cfada15c19a72f0ff31b38ad4602106c6ee95685d61c223c9a35

                            SHA512

                            da8b627bd674ceb0da7e30ba543ab82ab694d3f6e0474b48ca343ee74e20147440d2205b6ce66f5caa2a39061dedd2ca4146e263fac9f146a228c5b5cba4aaad

                          • C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

                            Filesize

                            320B

                            MD5

                            7e44134c2971c088e32a25bb7a4cfc27

                            SHA1

                            0ae6c37a546699d871e60449e9225a79ec71ac53

                            SHA256

                            8440b832e76e67a1efa1e9cb714f4f9a44e8085ab91de1e42b584ab54d0ac775

                            SHA512

                            902b8fc80eb3aacd3c05cab653a26e55d04559b631b718412569d02981d3fa434d78d152b826bd70763e560f22f800c9d67deed2edb0f219b47333bb0db0de8a

                          • C:\Users\Admin\AppData\Local\Temp\build.exe

                            Filesize

                            45KB

                            MD5

                            a6635a39646b32c5504c4601765f3872

                            SHA1

                            c1e80bf3a60a0f0c059e96aba88957f1f14c9c1f

                            SHA256

                            363917fd8f2abd3877c6baac7a8572550519258e4bcd219cdd28a36837245eec

                            SHA512

                            0ef9a3fe068b1317ba2e18739aa8c9002d1be4a4fd789d27beceed9e4c9bd4c44e67e9ab91d1c67e429e4843a969434be3a318168b2a710d64c50487849e2831

                          • C:\Users\Admin\AppData\Local\Temp\build.exe

                            Filesize

                            1KB

                            MD5

                            bb851671c57c35af348ee2a2b6126953

                            SHA1

                            c4ba1ac94bc814c748af7db68a844431b90ccb3b

                            SHA256

                            5c0dabbdfabeefebf94162eb4759280feccbe166668a35bf16393f251eb28bde

                            SHA512

                            8de8eabc73305ef306b6a67f41d24baf6833caed2c73a6082f63e898ac3615dc324134dfb4ecae9df600be18ced3c63c87dfd1f0fc4be486c2c487115a3be1ef

                          • C:\Users\Admin\AppData\Local\a656771e61d467c3c5fb7c927bb190f1\Admin@FMAEQIOU_en-US\Browsers\Firefox\Bookmarks.txt

                            Filesize

                            105B

                            MD5

                            2e9d094dda5cdc3ce6519f75943a4ff4

                            SHA1

                            5d989b4ac8b699781681fe75ed9ef98191a5096c

                            SHA256

                            c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                            SHA512

                            d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                          • memory/1824-984-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/1824-950-0x0000000005960000-0x000000000596A000-memory.dmp

                            Filesize

                            40KB

                          • memory/1824-949-0x0000000005A40000-0x0000000005A50000-memory.dmp

                            Filesize

                            64KB

                          • memory/1824-948-0x0000000005880000-0x0000000005912000-memory.dmp

                            Filesize

                            584KB

                          • memory/1824-947-0x0000000000400000-0x0000000000C0A000-memory.dmp

                            Filesize

                            8.0MB

                          • memory/1824-946-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2888-940-0x00000000072D0000-0x000000000731C000-memory.dmp

                            Filesize

                            304KB

                          • memory/2888-19-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-35-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-37-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-39-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-41-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-43-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-45-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-47-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-49-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-51-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-53-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-55-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-57-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-59-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-61-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-63-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-65-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-67-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-69-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-938-0x0000000003040000-0x0000000003041000-memory.dmp

                            Filesize

                            4KB

                          • memory/2888-0-0x0000000000D80000-0x0000000000D9A000-memory.dmp

                            Filesize

                            104KB

                          • memory/2888-939-0x0000000009110000-0x0000000009612000-memory.dmp

                            Filesize

                            5.0MB

                          • memory/2888-941-0x0000000009BC0000-0x000000000A164000-memory.dmp

                            Filesize

                            5.6MB

                          • memory/2888-31-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-29-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-25-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-945-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2888-27-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-23-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-21-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-33-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-17-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-1-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2888-15-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-13-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-2-0x0000000005880000-0x0000000005890000-memory.dmp

                            Filesize

                            64KB

                          • memory/2888-11-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-3-0x0000000005710000-0x0000000005716000-memory.dmp

                            Filesize

                            24KB

                          • memory/2888-4-0x0000000005730000-0x0000000005736000-memory.dmp

                            Filesize

                            24KB

                          • memory/2888-5-0x0000000008710000-0x0000000008C7A000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-6-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-9-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2888-7-0x0000000008710000-0x0000000008C74000-memory.dmp

                            Filesize

                            5.4MB

                          • memory/2936-985-0x000001E574430000-0x000001E574440000-memory.dmp

                            Filesize

                            64KB

                          • memory/2936-971-0x000001E571BA0000-0x000001E571D18000-memory.dmp

                            Filesize

                            1.5MB

                          • memory/2936-1002-0x000001E5765E0000-0x000001E576630000-memory.dmp

                            Filesize

                            320KB

                          • memory/2936-981-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/2936-1046-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4624-999-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4624-998-0x000001CB5E550000-0x000001CB5E56E000-memory.dmp

                            Filesize

                            120KB

                          • memory/4624-1001-0x00007FFF430E0000-0x00007FFF43BA1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4832-982-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4832-983-0x0000000005090000-0x00000000050F6000-memory.dmp

                            Filesize

                            408KB

                          • memory/4832-1049-0x00000000057D0000-0x00000000057D8000-memory.dmp

                            Filesize

                            32KB

                          • memory/4832-1048-0x00000000057A0000-0x00000000057C6000-memory.dmp

                            Filesize

                            152KB

                          • memory/4832-1047-0x0000000005710000-0x00000000057A2000-memory.dmp

                            Filesize

                            584KB

                          • memory/4832-1051-0x0000000006600000-0x0000000006608000-memory.dmp

                            Filesize

                            32KB

                          • memory/4832-1052-0x0000000006620000-0x000000000663E000-memory.dmp

                            Filesize

                            120KB

                          • memory/4832-1050-0x00000000065F0000-0x00000000065FA000-memory.dmp

                            Filesize

                            40KB

                          • memory/4832-980-0x00000000006A0000-0x0000000000832000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4832-1000-0x0000000005000000-0x0000000005010000-memory.dmp

                            Filesize

                            64KB

                          • memory/4832-1119-0x0000000075190000-0x0000000075940000-memory.dmp

                            Filesize

                            7.7MB