Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-01-2024 03:58

General

  • Target

    ac15ae1e49f4272e8d38b5fd5573ce35.exe

  • Size

    81KB

  • MD5

    ac15ae1e49f4272e8d38b5fd5573ce35

  • SHA1

    93a70b449926995d458b9513b8b36e988f73dc8a

  • SHA256

    c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149

  • SHA512

    23d7977aeac5a2f1856861519b34dbbd4aa52ed003d4001b73435024266d258d765613a3be8a1e2ae67548f9eb69f662925d663f8321f1610f200af6258025f8

  • SSDEEP

    1536:D7Vs/tSdQLcSjAA0C0rEr2ofgNTX0g/+PmN/10BmglZqiqazVkP5tJCFPzRUR2lX:D5MmQLcxAarEDINTD/+Pmn0BmgnpzmcP

Malware Config

Extracted

Family

stealerium

C2

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

  • Detect ZGRat V1 34 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
    "C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
      C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
        "C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
          "C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
          4⤵
          • Executes dropped EXE
          PID:4172
      • C:\Users\Admin\AppData\Local\Temp\build.exe
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1080
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
              PID:1340
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              5⤵
                PID:4392
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                5⤵
                  PID:116
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3508
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  5⤵
                    PID:2788
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    5⤵
                      PID:3004
              • C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
                2⤵
                  PID:4696
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1568

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\Browsers\Firefox\Bookmarks.txt

                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\Directories\OneDrive.txt

                Filesize

                25B

                MD5

                966247eb3ee749e21597d73c4176bd52

                SHA1

                1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                SHA256

                8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                SHA512

                bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\Directories\Videos.txt

                Filesize

                23B

                MD5

                1fddbf1169b6c75898b86e7e24bc7c1f

                SHA1

                d2091060cb5191ff70eb99c0088c182e80c20f8c

                SHA256

                a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                SHA512

                20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\Apps.txt

                Filesize

                2KB

                MD5

                763a12574ed1e1d9b09c6c442d989861

                SHA1

                e9eb814c5c2f7624cafffcea0f58257cec5ac055

                SHA256

                def4af4d5c0731ec94e1d91037d25a801c2ed5c3b4f5ee45fdc132ca4aca7fa2

                SHA512

                ac70d263be7dfa6cbb1a2c1cbc1f081c510ec8df207fb6564860038bb801a6bb2e6f93870ae41fe79b75e2367c21d20d6e8ddea01a9b498704d0892ea102e621

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\Apps.txt

                Filesize

                4KB

                MD5

                0af56b2246b9927a3910062121d1b3d8

                SHA1

                e4dd70a199a838f178fe434583a6de5ef0aaad38

                SHA256

                1e7de68a00062bb4b2d3626f48d7d40d87b11077e7ac45dd5b41a01cbc520129

                SHA512

                eaa77dec4ce04b63aa76fec44b932ab5d646542e2988566af121256201a2be1423144494fcc42eec36353573c75371f99d5d16243c56cf3db8191a81dfabf3c6

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\Apps.txt

                Filesize

                5KB

                MD5

                109200e0ebbbb8555161615ac6f7b282

                SHA1

                4a128739efbf0eaed157f68eda5d505690dc643b

                SHA256

                464943501c3413d695b38a23e9c9469dcbfd5f6c6b707e5f24ff4cbd804e7e0b

                SHA512

                dd70f3a0be9746169a0c8b2b6a9769bdadd9cb2d4f6fc63daf4fddc289bd872874dc3f969d1b69cb1d33b22c74afbea622ec59041ef8cc767f329b990eefacae

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\Debug.txt

                Filesize

                1KB

                MD5

                601a1e30864778b9226a55dc3bc58d12

                SHA1

                2b83fd559adfa7a30dc50419d0b5abea7d3fddb3

                SHA256

                be164dd16b0e17fd0a4bbdc2e05c759ee332893542ccf6e2688fab52263bc131

                SHA512

                49604504ae3b70ad0c6efc6d20bc67ea3483ee4148ba695ee7c91a0f0c2e180a0965e3d8d36eb01c2811ac356a699ad284ad96fa1008ae97a9993f712b130830

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\Process.txt

                Filesize

                4KB

                MD5

                5aef8be9f6de9a0dec3bf77029fe7eb1

                SHA1

                d56cee7e3115ee5560deac679def32409969ec27

                SHA256

                5d8d6369f0361650f874a9f6bd56bcf831c0643490f2e31a2028989ebb876e1e

                SHA512

                fcb6f8277b9421dae5891f07cb5365d52677d2bc2056110ae1b315f92516c5e903acedffb6bfcbe4b7adcbf18b55349affe7133a180254acead4ec2d41714eba

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\Admin@EYHRDPTG_en-US\System\ProductKey.txt

                Filesize

                29B

                MD5

                71eb5479298c7afc6d126fa04d2a9bde

                SHA1

                a9b3d5505cf9f84bb6c2be2acece53cb40075113

                SHA256

                f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                SHA512

                7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

              • C:\Users\Admin\AppData\Local\43eb28f2e8b3bfdaa1e708693f286457\msgid.dat

                Filesize

                19B

                MD5

                14234619d78d1d13122dc25a30dc94ab

                SHA1

                553bb39f46c45a06afdaf610dda0805c4cf26f3f

                SHA256

                7ca83b1254b854d41741e7c923fa389dc7dda149f070603b653b9fb5e7787aa1

                SHA512

                f0d35d71c4b74fa4787f742fb072135030d9aa24e40e38bbd73108c1a54c8b7f06e607af404633e34522b466d11ef04889cfca094592ade3be26a6fee65925e4

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac15ae1e49f4272e8d38b5fd5573ce35.exe.log

                Filesize

                1KB

                MD5

                c3941d9fa38f1717d5cecd7a2ca71667

                SHA1

                33b5362675383b58b4166ed9f9a61e5aa6768d2e

                SHA256

                f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

                SHA512

                98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

              • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]

                Filesize

                323KB

                MD5

                835746629f9f6238a66f6507d224c22c

                SHA1

                ee363c7eea9474ddee4d5e8324172a058f4915ce

                SHA256

                073ba4f196478d20e734dc7faf7ff05ff3084dca07cde208bc8cdaee37be8b79

                SHA512

                49ce4d4eb71e7fb14c2ceec797cf31b6d1e49d664b47e8908e6f5a96c4d856459db2a958d7342b7f9546552400e8a3281af9b5fc1d8f6c8825c1a9f456fbccd8

              • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]

                Filesize

                323KB

                MD5

                50aa33d254e099b513f28351c145146c

                SHA1

                c29cf960262284f05bbdfcd51250176b0add3a69

                SHA256

                99b568e6c3a7a3e3d4b3e5a4c25cbb30017c3098fb1b74a73f797411cb5bd926

                SHA512

                ae211e456b9ebe1677b9f68f3274319e972ea8387713024732adaa483feb00ac0ef2abd6ac8087da2e9862f1c48933d19dee9dbfea977205ebef0282b8cdeeae

              • C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]

                Filesize

                179KB

                MD5

                35547de351aa8742b7ed30cc384b56a6

                SHA1

                3e2279ec8ecb44d22ea6a382a2919710c38aefa7

                SHA256

                16526b52c0cbe5d1d332730de3180069270444c2a7944ba1a54d8652434cb7f8

                SHA512

                d383d134ce0ad323d45f03d8454cf48c4d1d641152cf6922f30b6f63c106e709e495d19953b618706d3dc38296bad1c5d51fd5c1dd6ccfc454304d8c9bde669a

              • C:\Users\Admin\AppData\Local\Temp\CamSnap.exe

                Filesize

                94KB

                MD5

                550628b16ef8c4e27c4081950cf8fd66

                SHA1

                ab11427c02cb53b70816b06d5a950b5f52c935eb

                SHA256

                09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa

                SHA512

                e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01

              • C:\Users\Admin\AppData\Local\Temp\build.exe

                Filesize

                202KB

                MD5

                62df32b363188a54c8ebe9c0309cdbdd

                SHA1

                e0ca65cea1d87b2e833ada6c66ea80419cd073e4

                SHA256

                41a261d6fc3ed8d39cded15cfceb4e6cdcf418cf41fda6607676b92f25fecd8d

                SHA512

                22a5189380017270f3e824b7bdadf6c3779b8b2bf73471634b5f0f91dbbad3c05305db0fefedb79802625ac79f088a874fef46f396cc2093e58b9b878e5371a7

              • C:\Users\Admin\AppData\Local\Temp\build.exe

                Filesize

                842KB

                MD5

                0a0264a55fe9d32837d1e0bab813c7b6

                SHA1

                6ab6aad1da38a0257cb75ea6126fe4963431a51d

                SHA256

                d6ba5a179fc788ffb5fb39e1baa195baf79d4dfa2216d62b21638c79dbd186ad

                SHA512

                e963ad3d0382f582c9b178062f4712e5f01809cbfd4698c3895e7c72b422b3ace247094d53a21aba1a7ee205da23b0519179f44e6a40017c3cee221f3dd3b487

              • C:\Users\Admin\AppData\Local\Temp\build.exe

                Filesize

                971KB

                MD5

                a456bcb56e906e99266926e2ef766dd8

                SHA1

                a3a02328b2d17820802f421710b7f2ab90ee92d1

                SHA256

                5645ca43a80c0573c68cc617cfea74f515c59aadcaf52ca9aee07000258583f0

                SHA512

                1642c3199fa43e7238898f78c5b3482d727dc11502c380a20f961f2eaecec3a7eefaa6fc9af82c988be060a4b8f460a2e28b81da0a7a59028fb2ebf8fa987123

              • memory/1080-1234-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/1080-1049-0x0000000005970000-0x0000000005978000-memory.dmp

                Filesize

                32KB

              • memory/1080-1000-0x00000000050F0000-0x0000000005100000-memory.dmp

                Filesize

                64KB

              • memory/1080-1313-0x0000000006BA0000-0x0000000006C52000-memory.dmp

                Filesize

                712KB

              • memory/1080-982-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/1080-983-0x0000000005040000-0x00000000050A6000-memory.dmp

                Filesize

                408KB

              • memory/1080-980-0x0000000000640000-0x00000000007D2000-memory.dmp

                Filesize

                1.6MB

              • memory/1080-1237-0x00000000050F0000-0x0000000005100000-memory.dmp

                Filesize

                64KB

              • memory/1080-1244-0x00000000050F0000-0x0000000005100000-memory.dmp

                Filesize

                64KB

              • memory/1080-1240-0x00000000068B0000-0x000000000692A000-memory.dmp

                Filesize

                488KB

              • memory/1080-1048-0x0000000005940000-0x0000000005966000-memory.dmp

                Filesize

                152KB

              • memory/1080-1047-0x00000000058B0000-0x0000000005942000-memory.dmp

                Filesize

                584KB

              • memory/1080-1051-0x00000000067A0000-0x00000000067A8000-memory.dmp

                Filesize

                32KB

              • memory/1080-1050-0x0000000006790000-0x000000000679A000-memory.dmp

                Filesize

                40KB

              • memory/1080-1315-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

                Filesize

                136KB

              • memory/1080-1316-0x0000000007FD0000-0x0000000008324000-memory.dmp

                Filesize

                3.3MB

              • memory/1080-1052-0x00000000067C0000-0x00000000067DE000-memory.dmp

                Filesize

                120KB

              • memory/1080-1328-0x00000000050F0000-0x0000000005100000-memory.dmp

                Filesize

                64KB

              • memory/2124-33-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-39-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-69-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-938-0x00000000028C0000-0x00000000028C1000-memory.dmp

                Filesize

                4KB

              • memory/2124-940-0x0000000006B80000-0x0000000006BCC000-memory.dmp

                Filesize

                304KB

              • memory/2124-939-0x0000000008880000-0x0000000008D82000-memory.dmp

                Filesize

                5.0MB

              • memory/2124-941-0x0000000009330000-0x00000000098D4000-memory.dmp

                Filesize

                5.6MB

              • memory/2124-65-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-945-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/2124-63-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-61-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-59-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-57-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-55-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-53-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-51-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-49-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-47-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-45-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-43-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-41-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-67-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-37-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-35-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-31-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-29-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-27-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-25-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-23-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-21-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-19-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-17-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-0-0x00000000004F0000-0x000000000050A000-memory.dmp

                Filesize

                104KB

              • memory/2124-15-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-13-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-11-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-9-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-7-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-6-0x0000000007E80000-0x00000000083E4000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-5-0x0000000007E80000-0x00000000083EA000-memory.dmp

                Filesize

                5.4MB

              • memory/2124-4-0x0000000004EB0000-0x0000000004EB6000-memory.dmp

                Filesize

                24KB

              • memory/2124-3-0x0000000002980000-0x0000000002986000-memory.dmp

                Filesize

                24KB

              • memory/2124-2-0x0000000001000000-0x0000000001010000-memory.dmp

                Filesize

                64KB

              • memory/2124-1-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/3324-1002-0x000002C0D1C50000-0x000002C0D1CA0000-memory.dmp

                Filesize

                320KB

              • memory/3324-985-0x000002C0CFBC0000-0x000002C0CFBD0000-memory.dmp

                Filesize

                64KB

              • memory/3324-1046-0x00007FFC9E5D0000-0x00007FFC9F091000-memory.dmp

                Filesize

                10.8MB

              • memory/3324-977-0x000002C0B5250000-0x000002C0B53C8000-memory.dmp

                Filesize

                1.5MB

              • memory/3324-981-0x00007FFC9E5D0000-0x00007FFC9F091000-memory.dmp

                Filesize

                10.8MB

              • memory/4112-949-0x00000000055E0000-0x00000000055F0000-memory.dmp

                Filesize

                64KB

              • memory/4112-984-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/4112-950-0x00000000057B0000-0x00000000057BA000-memory.dmp

                Filesize

                40KB

              • memory/4112-948-0x0000000005600000-0x0000000005692000-memory.dmp

                Filesize

                584KB

              • memory/4112-947-0x0000000000400000-0x0000000000C0A000-memory.dmp

                Filesize

                8.0MB

              • memory/4112-946-0x00000000747D0000-0x0000000074F80000-memory.dmp

                Filesize

                7.7MB

              • memory/4172-998-0x00000132EFFC0000-0x00000132EFFDE000-memory.dmp

                Filesize

                120KB

              • memory/4172-999-0x00007FFC9E5D0000-0x00007FFC9F091000-memory.dmp

                Filesize

                10.8MB

              • memory/4172-1001-0x00007FFC9E5D0000-0x00007FFC9F091000-memory.dmp

                Filesize

                10.8MB