Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-03-2024 03:56

General

  • Target

    d7d26e52666b2a4633daf1255b15f967.exe

  • Size

    505KB

  • MD5

    d7d26e52666b2a4633daf1255b15f967

  • SHA1

    07e603c3ae9f2e876acb2e35791f810b22621aff

  • SHA256

    b5783b1d56cb32dfd50a16fd41c70c72cef40ff6c3389242ff4e5bb4a2905413

  • SHA512

    2dc43bc611da3bed3404f8a91b76f4570f45992bda58798231c7aeaae4f8f87038556f0431d5a5de2724aeaaad48dae696637a7ff9ae8f37ce2d4d6e8f46c90d

  • SSDEEP

    12288:cppem0FZJWq+s4Kp6MssRN1j0PNeQXOEleiSMd2ZliWqmn:AYFZJWqCK0gRfj0PshQj22sn

Malware Config

Signatures

  • Detect ZGRat V1 35 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Nirsoft 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7d26e52666b2a4633daf1255b15f967.exe
    "C:\Users\Admin\AppData\Local\Temp\d7d26e52666b2a4633daf1255b15f967.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2952
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1420
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2328
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1468
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2388
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1344
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 672
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2244
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 2196
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2440
    • C:\Users\Admin\AppData\Local\Temp\d7d26e52666b2a4633daf1255b15f967.exe
      C:\Users\Admin\AppData\Local\Temp\d7d26e52666b2a4633daf1255b15f967.exe
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2376
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
          PID:2000
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:712
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              4⤵
                PID:1816
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                4⤵
                  PID:336
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                3⤵
                  PID:1984
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    4⤵
                      PID:540
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh wlan show networks mode=bssid
                      4⤵
                        PID:1788
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\d7d26e52666b2a4633daf1255b15f967.exe"
                      3⤵
                      • Creates scheduled task(s)
                      PID:3040

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                  Filesize

                  67KB

                  MD5

                  753df6889fd7410a2e9fe333da83a429

                  SHA1

                  3c425f16e8267186061dd48ac1c77c122962456e

                  SHA256

                  b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                  SHA512

                  9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  a720437bb7c6811d7102713ed50a4fc3

                  SHA1

                  74d4fe110b75df7c2f913088b783a6bad24fab9f

                  SHA256

                  b32e8a0c340acce4df648555c9a080f73ab0088a5e968d53e5521f34d73e35dc

                  SHA512

                  0b7964e5f7ebe92632e2df9f5eebc2b4b20635b2d7f008342bdb42f6d3738f04df564b2e4ff207ef29a9ba23e99a48d882af965ce837beede7461366effe3671

                • C:\Users\Admin\AppData\Local\84af7c45178a2c3f8a76aef1b1036565\msgid.dat

                  Filesize

                  1B

                  MD5

                  cfcd208495d565ef66e7dff9f98764da

                  SHA1

                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                  SHA256

                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                  SHA512

                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                • C:\Users\Admin\AppData\Local\Temp\CabCEAE.tmp

                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                • C:\Users\Admin\AppData\Local\Temp\TarCFED.tmp

                  Filesize

                  175KB

                  MD5

                  dd73cead4b93366cf3465c8cd32e2796

                  SHA1

                  74546226dfe9ceb8184651e920d1dbfb432b314e

                  SHA256

                  a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                  SHA512

                  ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  1a9d77294b1c58e9335205f7dead8147

                  SHA1

                  620954efbebc1a3b828ab50679ce87efa46be977

                  SHA256

                  007b02864686c5ebb03b1bfd7554e5497fc87b637a04cf2fd74c3245481359c3

                  SHA512

                  73c7e1b3de300744ce7d32b8a5dbfdaaa7222639f5201c10eca6d4b80e1f1d3196fb23b1efc275aa139172d8ec8c732b07e9c971ce4ea32a8a8a82f3c33a7f13

                • \Users\Admin\AppData\Local\Temp\AdvancedRun.exe

                  Filesize

                  88KB

                  MD5

                  17fc12902f4769af3a9271eb4e2dacce

                  SHA1

                  9a4a1581cc3971579574f837e110f3bd6d529dab

                  SHA256

                  29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                  SHA512

                  036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                • memory/1160-7-0x0000000001D30000-0x0000000001D70000-memory.dmp

                  Filesize

                  256KB

                • memory/1160-6-0x0000000070010000-0x00000000705BB000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1160-5-0x0000000070010000-0x00000000705BB000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1160-8-0x0000000070010000-0x00000000705BB000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1344-95-0x0000000002A10000-0x0000000002A50000-memory.dmp

                  Filesize

                  256KB

                • memory/1344-96-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1344-94-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1344-97-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1420-59-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1420-56-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1420-57-0x0000000001EE0000-0x0000000001F20000-memory.dmp

                  Filesize

                  256KB

                • memory/1420-58-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1468-78-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1468-77-0x0000000002AC0000-0x0000000002B00000-memory.dmp

                  Filesize

                  256KB

                • memory/1468-76-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/1468-75-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2328-69-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2328-65-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2328-66-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2328-67-0x0000000002B20000-0x0000000002B60000-memory.dmp

                  Filesize

                  256KB

                • memory/2328-68-0x0000000002B20000-0x0000000002B60000-memory.dmp

                  Filesize

                  256KB

                • memory/2352-145-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-163-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2352-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

                  Filesize

                  256KB

                • memory/2352-2317-0x0000000074DC0000-0x00000000754AE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2352-2286-0x0000000000C50000-0x0000000000C60000-memory.dmp

                  Filesize

                  64KB

                • memory/2352-155-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-157-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-159-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-161-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-153-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-30-0x0000000004CE0000-0x0000000004D20000-memory.dmp

                  Filesize

                  256KB

                • memory/2352-151-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-141-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-143-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-149-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-147-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-0-0x00000000011C0000-0x0000000001244000-memory.dmp

                  Filesize

                  528KB

                • memory/2352-139-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-137-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-135-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-133-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-19-0x0000000074DC0000-0x00000000754AE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2352-131-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-98-0x0000000004FA0000-0x0000000005014000-memory.dmp

                  Filesize

                  464KB

                • memory/2352-99-0x0000000007FB0000-0x000000000801E000-memory.dmp

                  Filesize

                  440KB

                • memory/2352-100-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-101-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-103-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-105-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-107-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-109-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-111-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-113-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-115-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-117-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-119-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-121-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-123-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-125-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-127-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2352-129-0x0000000007FB0000-0x0000000008019000-memory.dmp

                  Filesize

                  420KB

                • memory/2376-2467-0x0000000004C60000-0x0000000004CA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2376-2468-0x0000000004C60000-0x0000000004CA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2376-2322-0x0000000074D40000-0x000000007542E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2376-2321-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/2376-2391-0x0000000004C60000-0x0000000004CA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2376-2323-0x0000000004C60000-0x0000000004CA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2376-2466-0x0000000074D40000-0x000000007542E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2388-88-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2388-87-0x0000000002800000-0x0000000002840000-memory.dmp

                  Filesize

                  256KB

                • memory/2388-86-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2388-85-0x0000000002800000-0x0000000002840000-memory.dmp

                  Filesize

                  256KB

                • memory/2388-84-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2552-29-0x0000000002B60000-0x0000000002BA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2552-31-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2552-28-0x0000000002B60000-0x0000000002BA0000-memory.dmp

                  Filesize

                  256KB

                • memory/2552-27-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2552-26-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2644-50-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2644-49-0x0000000001E10000-0x0000000001E50000-memory.dmp

                  Filesize

                  256KB

                • memory/2644-48-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2644-47-0x000000006FFE0000-0x000000007058B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2756-16-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2756-17-0x0000000002740000-0x0000000002780000-memory.dmp

                  Filesize

                  256KB

                • memory/2756-18-0x0000000002740000-0x0000000002780000-memory.dmp

                  Filesize

                  256KB

                • memory/2756-15-0x0000000002740000-0x0000000002780000-memory.dmp

                  Filesize

                  256KB

                • memory/2756-14-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2756-20-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2952-41-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2952-40-0x0000000002AC0000-0x0000000002B00000-memory.dmp

                  Filesize

                  256KB

                • memory/2952-39-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2952-37-0x000000006FD60000-0x000000007030B000-memory.dmp

                  Filesize

                  5.7MB

                • memory/2952-38-0x0000000002AC0000-0x0000000002B00000-memory.dmp

                  Filesize

                  256KB