Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-03-2024 15:48

General

  • Target

    c0facaa9561e361afe9d92d38e2793a0.exe

  • Size

    1.1MB

  • MD5

    c0facaa9561e361afe9d92d38e2793a0

  • SHA1

    135c63fbf3659951888c74dde12df75575664eca

  • SHA256

    d8eb6d3fe02a890173827c242182acd22aa699e4bbd918fd22b95c00aa3a6445

  • SHA512

    50f1dcda7ad25017241ba8f46494653e4f64e35a6af57a64ec149802f4e25124ff5d3adbdf81a4137bedb122e688987fa6f36ebfa45a9e0638803f9388965abb

  • SSDEEP

    24576:nqqPzCBX6k4NCC0pOVXPbhH4DZ0XscH93EyLvWvfwi4Zm3:nqqGkRkCNFhH4DZ08cH93EyzwolZi

Malware Config

Signatures

  • Detect ZGRat V1 31 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2660
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3224
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4464
    • C:\Users\Admin\AppData\Local\Temp\c0facaa9561e361afe9d92d38e2793a0.exe
      "C:\Users\Admin\AppData\Local\Temp\c0facaa9561e361afe9d92d38e2793a0.exe"
      1⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Users\Admin\AppData\Local\Temp\vctuacx.exe
        "C:\Users\Admin\AppData\Local\Temp\vctuacx.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Users\Admin\AppData\Local\Temp\vctuacx.exe
          "C:\Users\Admin\AppData\Local\Temp\vctuacx.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3964
          • C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe
            "C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe" 0
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
              "C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2024
              • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                6⤵
                • Executes dropped EXE
                PID:2236
              • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                6⤵
                • Executes dropped EXE
                PID:4068
              • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4008
            • C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe
              C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe
              5⤵
              • Executes dropped EXE
              PID:4548
            • C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe
              C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1784
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 448
                6⤵
                • Program crash
                PID:4332
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 480
                6⤵
                • Program crash
                PID:4452
          • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
            "C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe" 0
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1288
            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              5⤵
              • Executes dropped EXE
              PID:1552
            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              5⤵
              • Executes dropped EXE
              PID:1776
            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              5⤵
              • Executes dropped EXE
              PID:424
            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1452
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 420
                6⤵
                • Program crash
                PID:1616
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 452
                6⤵
                • Program crash
                PID:2688
      • C:\Users\Admin\AppData\Local\Temp\c0facaa9561e361afe9d92d38e2793a0.exe
        "C:\Users\Admin\AppData\Local\Temp\c0facaa9561e361afe9d92d38e2793a0.exe"
        2⤵
        • Loads dropped DLL
        PID:4424
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x514 0x518
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1784 -ip 1784
      1⤵
        PID:1556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1784 -ip 1784
        1⤵
          PID:5072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsA
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3624
        • C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
          C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
            C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
            2⤵
            • Executes dropped EXE
            PID:5040
          • C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
            C:\Users\Admin\AppData\Local\TypeId\dylawcqb\AttributeString.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1368
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:4828
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1452 -ip 1452
          1⤵
            PID:2244
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1452 -ip 1452
            1⤵
              PID:2380
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABBAHQAdAByAGkAYgB1AHQAZQBTAHQAcgBpAG4AZwAuAGUAeABlADsA
              1⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4176

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BBLb.exe.log

              Filesize

              927B

              MD5

              4a911455784f74e368a4c2c7876d76f4

              SHA1

              a1700a0849ffb4f26671eb76da2489946b821c34

              SHA256

              264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

              SHA512

              4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              6d3e9c29fe44e90aae6ed30ccf799ca8

              SHA1

              c7974ef72264bbdf13a2793ccf1aed11bc565dce

              SHA256

              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

              SHA512

              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

            • C:\Users\Admin\AppData\Local\Temp\BBLb.exe

              Filesize

              1.2MB

              MD5

              71eb1bc6e6da380c1cb552d78b391b2a

              SHA1

              df3278e6e26d8c0bc878fe0a8c8a91b28c5a652d

              SHA256

              cefa92ee6cc2fad86c49dd37d57ff8afcb9b9abef0a110689e6d771394256bd6

              SHA512

              d6fab2c469924b8202f7964e864f66d6b6151937c8d134fb40e1f1d3787cf22328892c3f7209786e0b42e1abd5ca71a61f40538ef1e93534d2a98bf6d4448e90

            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe

              Filesize

              704KB

              MD5

              20d8bc77b286c2c0de4347d356f8bc0f

              SHA1

              10f4664c0361b0dc1f37c6b393f451b9ff836f11

              SHA256

              a10a6603774bfd2623aa256882b47fa5480ea216ba3f99a23d8c96bb77e96247

              SHA512

              96d64b2c24e36c1245d4986aa129a78bb13417efa95e712b590f4332853f2f04d1d731dec82d062b39f7b5043da81ccc91de91141dc0ffe0dbd0c4f68a698819

            • C:\Users\Admin\AppData\Local\Temp\DropaDkxa.exe

              Filesize

              512KB

              MD5

              7d4777ed6d9818a912c0cefc9f12dcfc

              SHA1

              48001b580d7a36f39823fd391411b3a32e39faba

              SHA256

              6862447b716d9ebac197fad0eda503fc81576fd86de9871dbfb82586b60751f6

              SHA512

              b898461eb44a0dd1958581a0e0cbb18b7d5ba88dcfc652bea73d84361936c1a90c40aacb4c3bf4dbfe424ddf441460c5342a5b5acb5f6605d355cefc62890414

            • C:\Users\Admin\AppData\Local\Temp\Dropakxa.exe

              Filesize

              2.1MB

              MD5

              1a917a85dcbb1d3df5f4dd02e3a62873

              SHA1

              567f528fec8e7a4787f8c253446d8f1b620dc9d6

              SHA256

              217fbf967c95d1359314fcd53ae8d04489eb3c7bdc1f22110d5a8a476d1fc92e

              SHA512

              341acbd43efac1718c7f3e3795549acf29237a2675bdadcb7e52ce18aac6dcc6ae628e1b6edfa2338ed6d9923c148cb4322c75fad86d5c0e6f2327c2270563ec

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvgevfn0.ps1.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

              Filesize

              35KB

              MD5

              e3a6587ba5a4ee4514ecaa4265dd9b2c

              SHA1

              b44bb9b5fc3478fa6ea5140603857ee0c2d4c4fd

              SHA256

              566934a049ae41fe36e2e122825875e5c02d4db083e744a7a3c94f456cec2f94

              SHA512

              90f4e5ceac00a0815452ef951feb3aa29e6ef408d8d4cda023c3fdd49ba0238e06589cee9cc0be842eddd1b02bd1d448d9ab8bdaed70651b38d6074c9f99d22f

            • C:\Users\Admin\AppData\Local\Temp\vctuacx.exe

              Filesize

              140KB

              MD5

              d6bfa5d4d5d67dd73013e5b400cac2e7

              SHA1

              725f7fec0fd1f245c44ab1c228cd349a5e12bd71

              SHA256

              fa40dc2c8055f953099d7d354ba97fbf3a5f3aa501ce95cb8cefa810b80ea5d4

              SHA512

              e5d58b64de4d398290d0cd79d44a516ca2528bd183566926ea1f3b9211b20fa5c2244bcc8bd3cc1f3b1d470dc257b72b8d3530d682fff00b7b52227c6c3c7808

            • memory/896-17-0x00000000005F0000-0x00000000005F1000-memory.dmp

              Filesize

              4KB

            • memory/1172-995-0x0000000005B60000-0x0000000005B70000-memory.dmp

              Filesize

              64KB

            • memory/1172-85-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-1011-0x0000000008280000-0x0000000008824000-memory.dmp

              Filesize

              5.6MB

            • memory/1172-61-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-997-0x0000000005E80000-0x0000000006020000-memory.dmp

              Filesize

              1.6MB

            • memory/1172-998-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

              Filesize

              304KB

            • memory/1172-55-0x0000000000FB0000-0x00000000011D8000-memory.dmp

              Filesize

              2.2MB

            • memory/1172-56-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1172-57-0x0000000005B70000-0x0000000005D78000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-58-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-59-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-1021-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1172-65-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-69-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-67-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-71-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-73-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-75-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-79-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-81-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-83-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-996-0x0000000005A00000-0x0000000005A01000-memory.dmp

              Filesize

              4KB

            • memory/1172-87-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-89-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-91-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-95-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-97-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-93-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-99-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-77-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-101-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-103-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-63-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-105-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-107-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-111-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1172-109-0x0000000005B70000-0x0000000005D73000-memory.dmp

              Filesize

              2.0MB

            • memory/1288-7352-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1288-7305-0x0000000002B30000-0x0000000002B31000-memory.dmp

              Filesize

              4KB

            • memory/1288-7304-0x0000000005090000-0x00000000050A0000-memory.dmp

              Filesize

              64KB

            • memory/1288-6326-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1368-5169-0x00000000059F0000-0x0000000005A00000-memory.dmp

              Filesize

              64KB

            • memory/1368-7780-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1368-5168-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/1452-7767-0x0000000003F90000-0x0000000004390000-memory.dmp

              Filesize

              4.0MB

            • memory/1784-1289-0x0000000003E80000-0x0000000004280000-memory.dmp

              Filesize

              4.0MB

            • memory/1784-1027-0x0000000000400000-0x0000000000488000-memory.dmp

              Filesize

              544KB

            • memory/1784-1338-0x0000000003E80000-0x0000000004280000-memory.dmp

              Filesize

              4.0MB

            • memory/1784-1295-0x0000000003E80000-0x0000000004280000-memory.dmp

              Filesize

              4.0MB

            • memory/2024-1010-0x0000000000A50000-0x0000000000B90000-memory.dmp

              Filesize

              1.2MB

            • memory/2024-1025-0x00000000054A0000-0x00000000054B0000-memory.dmp

              Filesize

              64KB

            • memory/2024-1013-0x0000000005350000-0x0000000005478000-memory.dmp

              Filesize

              1.2MB

            • memory/2024-1020-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/2024-1019-0x0000000005520000-0x000000000564A000-memory.dmp

              Filesize

              1.2MB

            • memory/2024-1984-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/2024-1976-0x00000000058B0000-0x0000000005970000-memory.dmp

              Filesize

              768KB

            • memory/2024-1975-0x0000000005490000-0x0000000005491000-memory.dmp

              Filesize

              4KB

            • memory/3224-1317-0x0000000002B90000-0x0000000002F90000-memory.dmp

              Filesize

              4.0MB

            • memory/3224-1341-0x0000000002B90000-0x0000000002F90000-memory.dmp

              Filesize

              4.0MB

            • memory/3224-1313-0x0000000002B90000-0x0000000002F90000-memory.dmp

              Filesize

              4.0MB

            • memory/3244-4224-0x00000000052E0000-0x00000000052F0000-memory.dmp

              Filesize

              64KB

            • memory/3244-5161-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

              Filesize

              4KB

            • memory/3244-4223-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/3244-5167-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/3624-4199-0x00007FFF6BFE0000-0x00007FFF6CAA1000-memory.dmp

              Filesize

              10.8MB

            • memory/3624-4214-0x00007FFF6BFE0000-0x00007FFF6CAA1000-memory.dmp

              Filesize

              10.8MB

            • memory/3624-4207-0x0000021D02510000-0x0000021D02532000-memory.dmp

              Filesize

              136KB

            • memory/3624-4201-0x0000021D1AB10000-0x0000021D1AB20000-memory.dmp

              Filesize

              64KB

            • memory/3624-4200-0x0000021D1AB10000-0x0000021D1AB20000-memory.dmp

              Filesize

              64KB

            • memory/3964-27-0x0000000000400000-0x0000000000409000-memory.dmp

              Filesize

              36KB

            • memory/3964-33-0x0000000000580000-0x0000000000581000-memory.dmp

              Filesize

              4KB

            • memory/3964-20-0x0000000000400000-0x0000000000409000-memory.dmp

              Filesize

              36KB

            • memory/3964-31-0x00000000770E2000-0x00000000770E3000-memory.dmp

              Filesize

              4KB

            • memory/3964-1012-0x0000000000400000-0x0000000000409000-memory.dmp

              Filesize

              36KB

            • memory/4008-4193-0x0000000005D60000-0x0000000005DB4000-memory.dmp

              Filesize

              336KB

            • memory/4008-4195-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/4008-1990-0x0000000005640000-0x0000000005650000-memory.dmp

              Filesize

              64KB

            • memory/4008-4192-0x0000000005940000-0x00000000059A6000-memory.dmp

              Filesize

              408KB

            • memory/4008-4191-0x00000000056C0000-0x0000000005716000-memory.dmp

              Filesize

              344KB

            • memory/4008-1989-0x0000000071F10000-0x00000000726C0000-memory.dmp

              Filesize

              7.7MB

            • memory/4008-1983-0x0000000000400000-0x000000000049C000-memory.dmp

              Filesize

              624KB

            • memory/4008-1988-0x0000000005480000-0x0000000005568000-memory.dmp

              Filesize

              928KB

            • memory/4424-37-0x0000000010000000-0x000000001002F000-memory.dmp

              Filesize

              188KB

            • memory/4424-22-0x0000000000400000-0x0000000000667000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-23-0x0000000000400000-0x0000000000663000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-1022-0x0000000010000000-0x000000001002F000-memory.dmp

              Filesize

              188KB

            • memory/4424-29-0x0000000000400000-0x0000000000667000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-39-0x0000000000F30000-0x0000000000F31000-memory.dmp

              Filesize

              4KB

            • memory/4424-21-0x0000000000400000-0x0000000000667000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-933-0x0000000000400000-0x0000000000663000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-994-0x0000000000400000-0x0000000000667000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-36-0x0000000000030000-0x0000000000031000-memory.dmp

              Filesize

              4KB

            • memory/4424-19-0x0000000000400000-0x0000000000667000-memory.dmp

              Filesize

              2.4MB

            • memory/4424-28-0x00000000770E2000-0x00000000770E3000-memory.dmp

              Filesize

              4KB

            • memory/4800-2-0x00000000770E2000-0x00000000770E3000-memory.dmp

              Filesize

              4KB

            • memory/4800-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

              Filesize

              4KB

            • memory/4800-18-0x0000000003300000-0x0000000003307000-memory.dmp

              Filesize

              28KB