Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-03-2024 08:12

General

  • Target

    002f6f310a1ea664bfe07e5dd7045676.exe

  • Size

    5.6MB

  • MD5

    002f6f310a1ea664bfe07e5dd7045676

  • SHA1

    104e60ea49811a2b33442c5192b0d5f539fd235e

  • SHA256

    c875d48e9242fff77283972803a88ca27a9045381a42c57c94f105cee7e0549c

  • SHA512

    3caad6aaa12f9dc5e5e7ddbbebe166b90e5721233619c8f31ad02754b0060889cb6cc36688b1b725e526e8c5e263b40ebb943c9bcf8938a56ce69c122076cb85

  • SSDEEP

    98304:V2wSiJSTjLc3oYusZhfoFH/Ydc4ajxG/zSDZyqBJEJaO6JrRe7kEcEAL:gw1gT84Y1ha/YdAftyziJrRnE

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe
    "C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMAAwADIAZgA2AGYAMwAxADAAYQAxAGUAYQA2ADYANABiAGYAZQAwADcAZQA1AGQAZAA3ADAANAA1ADYANwA2AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAwADAAMgBmADYAZgAzADEAMABhADEAZQBhADYANgA0AGIAZgBlADAANwBlADUAZABkADcAMAA0ADUANgA3ADYALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEkAbABhAHMAeAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAASQBsAGEAcwB4AC4AZQB4AGUA
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd751346f8,0x7ffd75134708,0x7ffd75134718
          4⤵
            PID:3692
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
            4⤵
              PID:1692
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4304
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:8
              4⤵
                PID:1952
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                4⤵
                  PID:4128
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                  4⤵
                    PID:3696
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                    4⤵
                      PID:876
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
                      4⤵
                        PID:1772
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                        4⤵
                          PID:1488
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                          4⤵
                            PID:1704
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                            4⤵
                              PID:2548
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                              4⤵
                                PID:2444
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6386311458035022159,13321274013276472914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4312
                          • C:\Users\Admin\AppData\Local\Temp\Geynnlzh.exe
                            "C:\Users\Admin\AppData\Local\Temp\Geynnlzh.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2368
                          • C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe
                            C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe
                            2⤵
                              PID:2028
                            • C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe
                              C:\Users\Admin\AppData\Local\Temp\002f6f310a1ea664bfe07e5dd7045676.exe
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:856
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1428
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:5000

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\002f6f310a1ea664bfe07e5dd7045676.exe.log

                                Filesize

                                1KB

                                MD5

                                f7047b64aa01f9d80c7a5e177ce2485c

                                SHA1

                                bab6005f4a30f12ee36b9abf6bfdfaa5411bbff8

                                SHA256

                                807356d2424d2d04f51ebd56f926d4d5a8318bc947c76569a3b5ca2c2f279915

                                SHA512

                                a9af5ace72eb66a6156a5d8764031cdc46feefffabb6898651f91a5af7f3bcef645e63e8d01ed35f1105e824d6830f6fa97e70adda2d5b148ffaff5f54ca248f

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                1eb86108cb8f5a956fdf48efbd5d06fe

                                SHA1

                                7b2b299f753798e4891df2d9cbf30f94b39ef924

                                SHA256

                                1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

                                SHA512

                                e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                f35bb0615bb9816f562b83304e456294

                                SHA1

                                1049e2bd3e1bbb4cea572467d7c4a96648659cb4

                                SHA256

                                05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

                                SHA512

                                db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                Filesize

                                198KB

                                MD5

                                06d38d9bf028710762491328778f9db6

                                SHA1

                                83e1b6cbaad5ca5f6dc63453da324f8df28de193

                                SHA256

                                91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

                                SHA512

                                b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                120B

                                MD5

                                308d111cd3307529d6bb79264ceabbfd

                                SHA1

                                12573c266275a91f51fd00f13e19500cadae7dfa

                                SHA256

                                0673a80fd6827764c98854ba57d802d2703385d399b7f5376ca57af3e733e60a

                                SHA512

                                cb8f3f86c91cc9babd7a1b7b35e5a2e8328efbbcde79d88799d31797e1f2c2c8a019e2e027254d511e35a439357fd3b4dd3b447583da5969d2f8159e7143ca04

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                fc919e28853afa7624f1a3fda5b07d3e

                                SHA1

                                98e2cc5d08e526861b8af7ec10f095f888baa289

                                SHA256

                                02c2b233ea43b57ed31c3335d8def330c6549f28f65dea4a15f2165fb2eea9b0

                                SHA512

                                dc51ed78c4efcdcdd08eb4a51b8b8852b7cecd937b21039e797666d17bdfb02477cd0ffd8320436e9c069c3ad08739cf95d135e5342ebb46f9e8fcde69162381

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                40f3ce3c27287ae0bc9726a38bc6b58a

                                SHA1

                                2d4de179f72134c2292cb0a5feefc6d0fd797dde

                                SHA256

                                44179ed167a85f668b3de15b9337356f874440356f8cda84c1ba6fefb552d7c1

                                SHA512

                                a25bb481fedbd02b6a1015ad8172ad3e8d22bfb6f51e5f028fc24efa22bd9d3fa0e533deb83e8ec676dacc41652f0c3aedfc7adef2b809cd483135a34a53c288

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                33bd2790a105e1b535a873c9de08632b

                                SHA1

                                1e24cd8460455a32c4e9188877dd17407646e4ec

                                SHA256

                                5dcb9c6f517d6ba6ac0478b67937beebcfec8c81d33a32b16c8e13688beafca5

                                SHA512

                                1f815334d0af5ece1a8f9f0cd3b037b0e4b4385f8b4e4435c9bef76f29c84ccbc1e4518de22e26c421ceefb77642b55f77e611ff07afe5d3a387af8810b5f000

                              • C:\Users\Admin\AppData\Local\Temp\Geynnlzh.exe

                                Filesize

                                2.5MB

                                MD5

                                36e180f151e6f4d9b75595667f229f2e

                                SHA1

                                0300078e0ad46fbfe7cb687bc6f78e2bb801391e

                                SHA256

                                83d931bc3227b46e3a53db00c567c10f961fb05de48b53ab56e5140e7dd143ae

                                SHA512

                                72bb78e8dea38de8b9f20691027e9b047015db69cce4a342a613a7e555777cd9bf9eeb82807ee666e0b519378b574eff388d09ac8215afafea8d56ea4f03fea9

                              • C:\Users\Admin\AppData\Local\Temp\Geynnlzh.exe

                                Filesize

                                1.2MB

                                MD5

                                c85866b00056959d1191ac66cc66ace8

                                SHA1

                                d47942cfce4a0d178703a826ec6e08d01445c953

                                SHA256

                                4046605b7e8dd2fe38bccf93ef6d23f13c73b9864ab9946de24f97f51291e00e

                                SHA512

                                beb07ebdedfcdfd8442c676f69f5163785c666d5b9013bfd30c95291e7d315dd567a848cf45503d00d5f5703e37c318be84f769418bdc62bf96641dcf1d98848

                              • C:\Users\Admin\AppData\Local\Temp\Geynnlzh.exe

                                Filesize

                                1.7MB

                                MD5

                                f0fc2322dcb573538783dba91367abf3

                                SHA1

                                7540010722cbe8ae6e101add342bafa105081718

                                SHA256

                                e7defc5cadfebf025d0e08228ed92f86dc944da2f65a14c89791fde702ef04a6

                                SHA512

                                c4e80e11656234c9fdd45c3f70466a1ced3022b12b5016f4355396e1669357f954f8e61ec6e6f8193e1c7f628dabe85ef4fc1c97a83bd157d6a73eeb542ddc9c

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eheknzou.t1j.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • \??\pipe\LOCAL\crashpad_652_UXXAEVGGGWGZQGTJ

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • memory/856-4820-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/856-4819-0x00000000054E0000-0x00000000055F6000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/856-4814-0x0000000000400000-0x00000000004D8000-memory.dmp

                                Filesize

                                864KB

                              • memory/2204-4996-0x00000000069E0000-0x00000000069FA000-memory.dmp

                                Filesize

                                104KB

                              • memory/2204-4982-0x0000000007490000-0x0000000007526000-memory.dmp

                                Filesize

                                600KB

                              • memory/2204-4807-0x0000000005110000-0x0000000005120000-memory.dmp

                                Filesize

                                64KB

                              • memory/2204-5000-0x00000000073F0000-0x0000000007412000-memory.dmp

                                Filesize

                                136KB

                              • memory/2204-4803-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2204-4808-0x0000000005110000-0x0000000005120000-memory.dmp

                                Filesize

                                64KB

                              • memory/2204-5104-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2368-4818-0x0000000005B30000-0x0000000005B40000-memory.dmp

                                Filesize

                                64KB

                              • memory/2368-4821-0x00000000071D0000-0x00000000073F6000-memory.dmp

                                Filesize

                                2.1MB

                              • memory/2368-4811-0x0000000005C40000-0x0000000005E6A000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2368-4815-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2368-4816-0x0000000006FA0000-0x00000000071C8000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2368-4805-0x0000000000FF0000-0x000000000127C000-memory.dmp

                                Filesize

                                2.5MB

                              • memory/3808-4978-0x0000000007AB0000-0x0000000007AE2000-memory.dmp

                                Filesize

                                200KB

                              • memory/3808-5001-0x0000000007B00000-0x0000000007BA3000-memory.dmp

                                Filesize

                                652KB

                              • memory/3808-6650-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3808-5153-0x0000000007F80000-0x0000000007F88000-memory.dmp

                                Filesize

                                32KB

                              • memory/3808-5144-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

                                Filesize

                                104KB

                              • memory/3808-5126-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

                                Filesize

                                80KB

                              • memory/3808-5110-0x0000000007E90000-0x0000000007E9E000-memory.dmp

                                Filesize

                                56KB

                              • memory/3808-5061-0x0000000007E60000-0x0000000007E71000-memory.dmp

                                Filesize

                                68KB

                              • memory/3808-5029-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

                                Filesize

                                40KB

                              • memory/3808-5015-0x00000000082A0000-0x000000000891A000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/3808-4999-0x0000000003340000-0x0000000003350000-memory.dmp

                                Filesize

                                64KB

                              • memory/3808-4995-0x0000000007A90000-0x0000000007AAE000-memory.dmp

                                Filesize

                                120KB

                              • memory/3808-4980-0x000000007F760000-0x000000007F770000-memory.dmp

                                Filesize

                                64KB

                              • memory/3808-4983-0x00000000710E0000-0x000000007112C000-memory.dmp

                                Filesize

                                304KB

                              • memory/3808-4913-0x00000000069C0000-0x0000000006A0C000-memory.dmp

                                Filesize

                                304KB

                              • memory/3808-4908-0x0000000006930000-0x000000000694E000-memory.dmp

                                Filesize

                                120KB

                              • memory/3808-4790-0x00000000053C0000-0x00000000053F6000-memory.dmp

                                Filesize

                                216KB

                              • memory/3808-4798-0x0000000005A30000-0x0000000006058000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/3808-4841-0x00000000064D0000-0x0000000006824000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/3808-4799-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3808-4822-0x0000000005970000-0x0000000005992000-memory.dmp

                                Filesize

                                136KB

                              • memory/3808-4800-0x0000000003340000-0x0000000003350000-memory.dmp

                                Filesize

                                64KB

                              • memory/3808-4830-0x0000000006060000-0x00000000060C6000-memory.dmp

                                Filesize

                                408KB

                              • memory/3808-4810-0x0000000003340000-0x0000000003350000-memory.dmp

                                Filesize

                                64KB

                              • memory/5000-4786-0x0000000007B70000-0x0000000007C02000-memory.dmp

                                Filesize

                                584KB

                              • memory/5000-5-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-44-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-4817-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/5000-42-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-40-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-38-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-36-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-34-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-32-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-30-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-28-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-26-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-50-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-24-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-52-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-22-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-54-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-4788-0x0000000008500000-0x0000000008AA4000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/5000-4787-0x0000000007770000-0x00000000077D6000-memory.dmp

                                Filesize

                                408KB

                              • memory/5000-0-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/5000-20-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-1-0x0000000000A60000-0x0000000000FFC000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/5000-46-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-4783-0x0000000001620000-0x0000000001621000-memory.dmp

                                Filesize

                                4KB

                              • memory/5000-18-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-16-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-4784-0x0000000007820000-0x0000000007B72000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/5000-56-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-1822-0x0000000005820000-0x0000000005830000-memory.dmp

                                Filesize

                                64KB

                              • memory/5000-1621-0x00000000752C0000-0x0000000075A70000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/5000-68-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-14-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-66-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-12-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-64-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-62-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-60-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-10-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-8-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-6-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-4785-0x00000000016C0000-0x000000000170C000-memory.dmp

                                Filesize

                                304KB

                              • memory/5000-4-0x0000000006FE0000-0x00000000074EA000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-3-0x0000000005930000-0x0000000005E3E000-memory.dmp

                                Filesize

                                5.1MB

                              • memory/5000-2-0x0000000005820000-0x0000000005830000-memory.dmp

                                Filesize

                                64KB

                              • memory/5000-48-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/5000-58-0x0000000006FE0000-0x00000000074E5000-memory.dmp

                                Filesize

                                5.0MB