Resubmissions

11/02/2024, 00:53

240211-a8wk6scf89 10

Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2024, 00:53

General

  • Target

    GitMultiLoader.exe

  • Size

    42.7MB

  • MD5

    5ec24905f80bb16b8844d440fd4ca921

  • SHA1

    079f6782c79d633f3ac1288523d39fd5c6132df9

  • SHA256

    eec6302b15fdbf92d7c6204f195246278aa2d7c54ed2eaf51f8298554ac75024

  • SHA512

    10e3b37422b3d540f9435712ee94955df759ed1c404e35e708f0b6863ff2f8c4b1ff0fc084df10ffd805a9a9e633bb6110dc82d0d8d8d474439cd8a5b6fbfc55

  • SSDEEP

    98304:YfCv+rScGQYPDofAKB1RYQpHd5nKRQGEaTmR3vNUkqh76n7EnVFG8TzIhX724Lks:Y7EsfAeHY0x7nbT9UsMaN6maSl

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2472
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3884
    • C:\Users\Admin\AppData\Local\Temp\GitMultiLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\GitMultiLoader.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
      • C:\Users\Admin\AppData\Roaming\driver1.exe
        C:\Users\Admin\AppData\Roaming\driver1.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:4592
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious behavior: EnumeratesProcesses
          PID:4732
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 608
            4⤵
            • Program crash
            PID:1556
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 632
            4⤵
            • Program crash
            PID:4560
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff94ea646f8,0x7ff94ea64708,0x7ff94ea64718
        2⤵
          PID:1308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
          2⤵
            PID:2664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
            2⤵
              PID:4572
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
              2⤵
                PID:4232
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                2⤵
                  PID:3132
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
                  2⤵
                    PID:1960
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
                    2⤵
                      PID:5104
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                      2⤵
                        PID:3740
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                        2⤵
                          PID:2436
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                          2⤵
                            PID:4456
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                            2⤵
                              PID:2176
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                              2⤵
                                PID:4916
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1841089815802343921,16065482770718893683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                                2⤵
                                  PID:4420
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:656
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1044
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4732 -ip 4732
                                    1⤵
                                      PID:3524
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4732 -ip 4732
                                      1⤵
                                        PID:1880

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              d5564ccbd62bac229941d2812fc4bfba

                                              SHA1

                                              0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

                                              SHA256

                                              d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

                                              SHA512

                                              300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              432B

                                              MD5

                                              4af1423644aae6d86493a5e5eb54f3d2

                                              SHA1

                                              659efd9c137f884021dc9a048d8902383e97aacf

                                              SHA256

                                              4c1803c1cb36c4aae10be3c172764c93c95f766a539ede6b881577de4c7c5b7b

                                              SHA512

                                              9faa31178b6a94069cb8e9d4d85f819ce4a6a62795d61457949cc94901b854243ec38af38f4730404a2bb457b0389ad385efa3105ec7903c07138c15edb9fe93

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              285252a2f6327d41eab203dc2f402c67

                                              SHA1

                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                              SHA256

                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                              SHA512

                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              248B

                                              MD5

                                              aa5c9ef101e0cca61678dcaed524270e

                                              SHA1

                                              94f9882349038ee458e04301b6ec123b0952860f

                                              SHA256

                                              cf77a8227d134ac5fec1aff2b71ab2d8ff3f89b588639ee06904b6578eabf404

                                              SHA512

                                              81717f814dbccb17f1dab5c07b48c63a43ab326bd764e7ffef704567a99356bdf66bc47e3a06b3cf9ae9c0d09e872d5d7415fff1282d7ef759278832a8fdfe1f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              8fd1c3354bfe8c01add2fda3c1b068bd

                                              SHA1

                                              18fbdff70abc4dd41340e9605868fb91efbbe6bd

                                              SHA256

                                              2bb9c967735d9d40ecdaab4194e402ff3ee4639007017ccdd7a78dcbc4b4fdbf

                                              SHA512

                                              0fbbc2701892b53a1154df5649d14b3dd989ed777e3de39d8ba45695a466d897c688de9eacde6536dc630ed7a19f922e5098bacc0f483afc0a9da3287abf70c9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              f2297a2bd2f5566ec99b00217212003c

                                              SHA1

                                              cc119bb88836703fd04081a36983c9d813ac097e

                                              SHA256

                                              0f5ea0c7ca8bf819d981fcafda9b4ea9871f94329a85259e947c550c15c11002

                                              SHA512

                                              2611d35e0fa735bc0fb262110e39c098135a33933e96c30e8da78a16f5de15ffdbf347667db0a6f742e19aa78827496024ff4cb4ffa086ffc50664261ed85969

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              da872d4ac072e40223cf6367ee3a8c8f

                                              SHA1

                                              8e074b04cb4d1efb521d3c721c8358589d44aa9a

                                              SHA256

                                              316a5c4d4426ae96a757b56c3793595a5ba62778fa0184c9780368815e3b41c2

                                              SHA512

                                              b40d0a3a71b4cd422cb819e850e18d2ddb7e7e32d7912471bbe81b5a7f812df0b29041f30f59906814546e65b8b7306a938e9f50b1d1116240fba658f4c40f7a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                              Filesize

                                              24KB

                                              MD5

                                              1d1c7c7f0b54eb8ba4177f9e91af9dce

                                              SHA1

                                              2b0f0ceb9a374fec8258679c2a039fbce4aff396

                                              SHA256

                                              555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

                                              SHA512

                                              4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              497f925ab10a390eeeab1a70157bae58

                                              SHA1

                                              05a6e9a85dc7e1bd63de8972189e3b8232882600

                                              SHA256

                                              5e48626e3c9010e010e9830a597604c7506d5a4a0e1fdc51a05192d3db1d46be

                                              SHA512

                                              cd6b6cf3d643fd76100f9a92529e6952b203d622ac7dd2f827fe39b59e5978a540b4e9fa24ec15c060977b0f68bffed72ba5ac4e974dab17a4f357721f62b4af

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              a1dab46be9830275d95a1cd1c1e87f93

                                              SHA1

                                              713a5b99a32625d72769fa77db36b91f9cd524f4

                                              SHA256

                                              f871eeed410d5b2977f3581c57eefb33926ecf2faee6cc6f673fd6a1d3d4d182

                                              SHA512

                                              cffbaf725899b2fd89a5ec5d68b8c179245f1a3abd79b7488eb4462345eaea9ca912427c580ee2ac6522242e0746d2dbf18ed7af0f0650680d742487ee144045

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oqawqwbj.t2h.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Roaming\driver1.exe

                                              Filesize

                                              609KB

                                              MD5

                                              f662d8d5f09601ea6e120dc51bdd5c9c

                                              SHA1

                                              f3d6177fb988730bcf4c104e8ea7fbf54c6f9f2a

                                              SHA256

                                              750a9987b3e35b06244832abb0140e52212e429e9a23cd180a6c7b7ae33e9981

                                              SHA512

                                              341478195bd5ce7e27bac5989d5de2321842e85e8f4249755e78866ee4b1095097d20541a69c23572720d62e04da08dc8280fa4fecfd9aba3279c3eeb8272849

                                            • memory/3884-290-0x0000000002C80000-0x0000000003080000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/3884-286-0x0000000000F30000-0x0000000000F39000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/3884-293-0x0000000075550000-0x0000000075765000-memory.dmp

                                              Filesize

                                              2.1MB

                                            • memory/3884-288-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/3884-289-0x0000000002C80000-0x0000000003080000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/3884-291-0x00007FF95D410000-0x00007FF95D605000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/3884-294-0x0000000002C80000-0x0000000003080000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/3884-295-0x0000000002C80000-0x0000000003080000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4468-0-0x000001DE6D110000-0x000001DE6D132000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/4468-13-0x000001DE6CD50000-0x000001DE6CD60000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4468-12-0x000001DE6CD50000-0x000001DE6CD60000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4468-11-0x000001DE6CD50000-0x000001DE6CD60000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4468-10-0x00007FF93F3B0000-0x00007FF93FE71000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4468-16-0x00007FF93F3B0000-0x00007FF93FE71000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4592-35-0x0000000004D00000-0x0000000004D10000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4592-47-0x0000000004D00000-0x0000000004D10000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4592-236-0x00000000027D0000-0x00000000047D0000-memory.dmp

                                              Filesize

                                              32.0MB

                                            • memory/4592-297-0x00000000027D0000-0x00000000047D0000-memory.dmp

                                              Filesize

                                              32.0MB

                                            • memory/4592-34-0x0000000074500000-0x0000000074CB0000-memory.dmp

                                              Filesize

                                              7.7MB

                                            • memory/4592-37-0x0000000002600000-0x000000000267E000-memory.dmp

                                              Filesize

                                              504KB

                                            • memory/4592-235-0x0000000074500000-0x0000000074CB0000-memory.dmp

                                              Filesize

                                              7.7MB

                                            • memory/4592-41-0x0000000004D00000-0x0000000004D10000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4592-42-0x0000000004D00000-0x0000000004D10000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/4592-45-0x0000000004D10000-0x00000000052B4000-memory.dmp

                                              Filesize

                                              5.6MB

                                            • memory/4592-46-0x00000000052C0000-0x000000000533C000-memory.dmp

                                              Filesize

                                              496KB

                                            • memory/4732-281-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4732-284-0x0000000075550000-0x0000000075765000-memory.dmp

                                              Filesize

                                              2.1MB

                                            • memory/4732-285-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4732-229-0x0000000000400000-0x0000000000488000-memory.dmp

                                              Filesize

                                              544KB

                                            • memory/4732-282-0x00007FF95D410000-0x00007FF95D605000-memory.dmp

                                              Filesize

                                              2.0MB

                                            • memory/4732-280-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4732-279-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4732-232-0x0000000000400000-0x0000000000488000-memory.dmp

                                              Filesize

                                              544KB

                                            • memory/4732-296-0x0000000003A60000-0x0000000003E60000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/4732-237-0x0000000000400000-0x0000000000488000-memory.dmp

                                              Filesize

                                              544KB