Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 04:58

General

  • Target

    520acfcdeb4efcd8526c6d08bca7113a9f75c4a67be81b66486b2f2e57fec233.exe

  • Size

    1.8MB

  • MD5

    bc56577e2d52df71394b539564bfabc9

  • SHA1

    57fd99a67b8e88de86318ec6fe4d56653dd31e69

  • SHA256

    520acfcdeb4efcd8526c6d08bca7113a9f75c4a67be81b66486b2f2e57fec233

  • SHA512

    333a2e72dc5270b6c8ec5eeeba71839f6d439d4f5b6d954afd3dde81a7311638e29f82ee83597258b93605c070bf76519b716acd2b7f6335304f9b6a3e766db1

  • SSDEEP

    49152:Kx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAGgDUYmvFur31yAipQCtXxc0H:KvbjVkjjCAzJQU7dG1yfpVBlH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\520acfcdeb4efcd8526c6d08bca7113a9f75c4a67be81b66486b2f2e57fec233.exe
    "C:\Users\Admin\AppData\Local\Temp\520acfcdeb4efcd8526c6d08bca7113a9f75c4a67be81b66486b2f2e57fec233.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1308
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2948
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2896
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2724
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:596
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 258 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 248 -NGENProcess 25c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 260 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 248 -NGENProcess 1d0 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 278 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 258 -NGENProcess 280 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2888
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:820
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:3056
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:1472
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1724
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3048
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2564
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1480
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2148
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1748
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1632

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          706KB

          MD5

          265dc44f0d794400e5f67c9ca17c9360

          SHA1

          3785eaad7fb95c3c5897daae86f84024ef30896b

          SHA256

          38223a7141e5dcde3081c8d6df5d0ffa69553519373c370ea4a1550a5b39b4c2

          SHA512

          00b045d7eec1a8556eb2fe3039bdb247c9c6fea00320e3d50e05c23c5af41301a37d6fa63eaec1fb5aff9225145a559baf430e00ec04a96db61b002be6f47921

        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

          Filesize

          30.1MB

          MD5

          27c95818648fb0cdcd6f32c0a8877716

          SHA1

          e6728a45c156e7ae47390713e8fa75bf45e3fcea

          SHA256

          8c56270919b2f7949c2cdeecb1f1068d79159e7ea77d5908396141582e1dead8

          SHA512

          91baf4d4a17a0c13489404a54f5d10fd16f60ec99fe80cce6448dd94ecdc9698b1a9e1ebfb88cef1416ebfa52d5efd6c1f785faccd9df2872dbd8420491f217b

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

          Filesize

          781KB

          MD5

          319f7e43a9ae3b3735204065dcbd79f9

          SHA1

          9f63cf2c99ba51ac2cf09d3ab4d9d319c0c8184a

          SHA256

          1fbedeb538c9129707b83fb006d1b1752ec32f3e1b9cea2da5ddde0e9c22e9a9

          SHA512

          b2df7d79fa5d2d84905a919190c3b77cd108ce30e4fe8ca341e000d335f98dd941ee21050e1c09cef44f30b0cf5199ce88d5a54d0820bce674d06f8d20472098

        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

          Filesize

          5.2MB

          MD5

          6abc21e2915ce98788f18bb74f0291fc

          SHA1

          3290650e08d516c6e16425defed28938979deefe

          SHA256

          0c9aa17d8847e8c5a9a118aa09c3f3eb6fcd89586d7d76e5e8f7558873308c5b

          SHA512

          74c3bf1b8791be443ced3cd56f691224a65d5f5816022ac037005099381b0029f81284d1aa88131a21927d919e7174ba5ed712178b8bb8333614c344c6d78921

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          2.1MB

          MD5

          282fe11fa77fe76e635a12cdf4790d0f

          SHA1

          1042b8b672afce073d7e3e0f7c2761ec44e0033a

          SHA256

          e093620acb26b5c89ae2e28482274ce08856f57d0cf21d22f9286c5c6292908b

          SHA512

          b05d1e53c21bb6f763dacc6313e66c3a59a6dd507c0c08507c80250d2ffe50fc72d9b16db8ecf842cc067b385b28eec862f15e11aa4d4020e6c5b8eacb7f7ac7

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          648KB

          MD5

          978dbf6f14458e0811de59593aa18a5e

          SHA1

          7d43f38bd2bb28076e61fc91c7712ed5fe9c2a79

          SHA256

          5c42f7658069f48ea754c6fe49054f64a240f31485aebb0e78e3e99c1aa58c44

          SHA512

          9d659f7198154b4464736cc0b2c6ea508b7b2697b9b5f8543e0f5ca98c5b7e1f1982ca75556bab17f3099ab0d9b1a4450d67eff631a6277716e856a1dca27d27

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

          Filesize

          872KB

          MD5

          a30873eaff0fd7ed9d7bcc24c2f0f856

          SHA1

          3427e19fb2bb620b1ae3b44b09d27f9fa5474e63

          SHA256

          c6df266f197b34b3df7adfde12848f1dff188ece106099e1e2d1bfad29f42c78

          SHA512

          e4c735f2ad7591c8c71601c9377191c39b4452d30c8734538dae4d242407b4a92f579a33306e52efc1e8482a13d76c079b77c121c1d218a65827142bcaecacfe

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          678KB

          MD5

          1f2353793a4150c18662250c93356952

          SHA1

          0ba133351a031d5a7c239ba3260471c92d4341c7

          SHA256

          023839ef116a5b957d0c1838be26aff5ea39ab893edfc6af7e27a12abd71c4fc

          SHA512

          9be68940c15b9e731f46f388c01cb176b3b2506d0015eb5d7bb496b6a0b7325b01706527d7458e3e9e3112410774d70383f17290ed042d538506f355eb050f2f

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

          Filesize

          625KB

          MD5

          6b483882d3efaaed6197639f1fc0d5fd

          SHA1

          5a12a294297c4468d3e7fcbcaf4b2046c70ce511

          SHA256

          537c34a4476f7554b9dbce90ea769382cbdd346d7a1bc725f8b301855cc30db6

          SHA512

          529aafb521a72146ee5406205454360bc6705c9960142f9ad2769491279036a683050e52426f5d597f97bc1b0407262a46c0822535ce04c46e41635480b3915b

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

          Filesize

          1003KB

          MD5

          8a8143fa57125e9700d009165dbc8337

          SHA1

          87148248cf27767f7d9a2cc208e130c840a6e22f

          SHA256

          7c22945dbf12ddd63eadee8cf5bf6cc310411754b014419cd5bc8c17167ec407

          SHA512

          3b8f93773b79aba21b8a9fa15e4f296102ffa490f494abd52b6e1c94d5d0e0777233021af9b1d48b96bab4bf142496dc772f117417f699b5a3895a77d4aa7dce

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          656KB

          MD5

          1896464795dc0ff77ab5e801afbf6e68

          SHA1

          cc165c79038cca8144b65aedb2b23abc14582724

          SHA256

          005a1a88d39684c44e4029cdc047f6284d103bee2badcf9ef39fe94d491d7ddc

          SHA512

          1b1371a67d4673bf5c0a9feb81c5d69302f4717b8b56baac6ab67d87a15d344b92fe78347016149497193925d3527d67aeb126f363130cffb26a19b0999fbd70

        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

          Filesize

          603KB

          MD5

          4a2ecdf6f04540820add878b23b14f9f

          SHA1

          f4a2e5b8b89193c20997da47fa46b0c2863055af

          SHA256

          76f7182915fbfdb185988523cafb33099e13b1d08a36c346beed128f52ab7c97

          SHA512

          e35eb09d1296472b7642370c67090efdefc3957e8fbbd5c6f098cbf98dec358ef7fdf420f3c00a43a9b1f17e30ed5d46d776150dc745975785247b09a3a59c86

        • \Windows\System32\alg.exe

          Filesize

          644KB

          MD5

          fe9a827770762229edb3cd42f9b78d72

          SHA1

          8c66a49fbce6a3be013f8f4b02eddacf13ec1a77

          SHA256

          36b785d31a133a33da6803235d79090eb5943f8f52807e1d4bae4dc9f90f5740

          SHA512

          d07674e8d2914d4910fbff029e160c4cb3da6503ad43fc983a0f2466d5a8f81a88969acd2e76fc7049ca41900a36ed61a03f5a7aab6696e5647e43b6f37303bb

        • \Windows\ehome\ehrecvr.exe

          Filesize

          1.2MB

          MD5

          2ab88eae2c80df542a7d86587ffd902b

          SHA1

          d2222ede2781dcade86946ba4c757c16ae32b39a

          SHA256

          45be59e3423c89d58ff10b5500c6769faee4053d92e0b8467d5e61a9f3958f12

          SHA512

          e1e95d6972ea7bb36ede3d7877de6f73357b0774a23c65fe84a3662f9c6bed45180bf0206d66b6e1ca1cf59f0a72564450ccabd27d5c8863b2a34e7701f8063c

        • \Windows\ehome\ehsched.exe

          Filesize

          691KB

          MD5

          cdccc0c01076277aa45a302ebdfd4a83

          SHA1

          f669cb064aac2615567ab7ea73aa079123c51432

          SHA256

          4accf740555536b10f2f8425e2fdbb241d09bb833323ef3d4d4cad7b590a88cc

          SHA512

          d9e631b6f35147b1eeb068c2ad7d9b5e950354ca7102afaaba657de4a04a9a308df6a4e97650e1dca377d0ea1b430a13ecafbff58cf7fb2d032d1f4db2228009

        • memory/596-161-0x0000000010000000-0x00000000100A7000-memory.dmp

          Filesize

          668KB

        • memory/596-122-0x0000000010000000-0x00000000100A7000-memory.dmp

          Filesize

          668KB

        • memory/596-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

          Filesize

          384KB

        • memory/596-130-0x0000000000C00000-0x0000000000C60000-memory.dmp

          Filesize

          384KB

        • memory/736-338-0x0000000000520000-0x0000000000587000-memory.dmp

          Filesize

          412KB

        • memory/736-343-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/736-367-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/736-384-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/820-163-0x0000000000440000-0x00000000004A0000-memory.dmp

          Filesize

          384KB

        • memory/820-295-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

        • memory/820-172-0x0000000000440000-0x00000000004A0000-memory.dmp

          Filesize

          384KB

        • memory/820-167-0x0000000140000000-0x00000001400AE000-memory.dmp

          Filesize

          696KB

        • memory/1308-0-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/1308-7-0x0000000000240000-0x00000000002A7000-memory.dmp

          Filesize

          412KB

        • memory/1308-6-0x0000000000240000-0x00000000002A7000-memory.dmp

          Filesize

          412KB

        • memory/1308-1-0x0000000000240000-0x00000000002A7000-memory.dmp

          Filesize

          412KB

        • memory/1308-143-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/1308-273-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/1472-371-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1472-310-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1472-370-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

        • memory/1472-279-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

        • memory/1472-195-0x0000000140000000-0x00000001400B2000-memory.dmp

          Filesize

          712KB

        • memory/1480-380-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

        • memory/1480-382-0x0000000000A90000-0x0000000000AF7000-memory.dmp

          Filesize

          412KB

        • memory/1644-283-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/1644-145-0x0000000000310000-0x0000000000377000-memory.dmp

          Filesize

          412KB

        • memory/1644-151-0x0000000000310000-0x0000000000377000-memory.dmp

          Filesize

          412KB

        • memory/1644-144-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/1748-408-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/1748-403-0x000000002E000000-0x000000002E0B5000-memory.dmp

          Filesize

          724KB

        • memory/1984-342-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/1984-341-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/1984-320-0x00000000005E0000-0x0000000000647000-memory.dmp

          Filesize

          412KB

        • memory/1984-329-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/2032-365-0x0000000000A80000-0x0000000000AE7000-memory.dmp

          Filesize

          412KB

        • memory/2148-390-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

        • memory/2148-395-0x0000000000FE0000-0x0000000001040000-memory.dmp

          Filesize

          384KB

        • memory/2148-412-0x0000000140000000-0x00000001400CA000-memory.dmp

          Filesize

          808KB

        • memory/2148-413-0x0000000000FE0000-0x0000000001040000-memory.dmp

          Filesize

          384KB

        • memory/2564-307-0x0000000000D80000-0x0000000000E00000-memory.dmp

          Filesize

          512KB

        • memory/2564-324-0x000007FEF44A0000-0x000007FEF4E3D000-memory.dmp

          Filesize

          9.6MB

        • memory/2564-292-0x000007FEF44A0000-0x000007FEF4E3D000-memory.dmp

          Filesize

          9.6MB

        • memory/2564-291-0x0000000000D80000-0x0000000000E00000-memory.dmp

          Filesize

          512KB

        • memory/2564-290-0x000007FEF44A0000-0x000007FEF4E3D000-memory.dmp

          Filesize

          9.6MB

        • memory/2724-141-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

        • memory/2724-112-0x0000000000450000-0x00000000004B7000-memory.dmp

          Filesize

          412KB

        • memory/2724-106-0x0000000000450000-0x00000000004B7000-memory.dmp

          Filesize

          412KB

        • memory/2724-105-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

        • memory/2896-101-0x0000000000200000-0x0000000000260000-memory.dmp

          Filesize

          384KB

        • memory/2896-181-0x0000000140000000-0x000000014009D000-memory.dmp

          Filesize

          628KB

        • memory/2896-94-0x0000000140000000-0x000000014009D000-memory.dmp

          Filesize

          628KB

        • memory/2896-95-0x0000000000200000-0x0000000000260000-memory.dmp

          Filesize

          384KB

        • memory/2920-302-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/2920-325-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/2920-306-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/2920-297-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/2920-326-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/2920-327-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/2948-13-0x0000000000840000-0x00000000008A0000-memory.dmp

          Filesize

          384KB

        • memory/2948-17-0x0000000100000000-0x00000001000A4000-memory.dmp

          Filesize

          656KB

        • memory/2948-29-0x0000000000840000-0x00000000008A0000-memory.dmp

          Filesize

          384KB

        • memory/2948-164-0x0000000100000000-0x00000001000A4000-memory.dmp

          Filesize

          656KB

        • memory/3048-328-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/3048-286-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/3056-182-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

        • memory/3056-190-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

        • memory/3056-305-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-281-0x0000000001430000-0x0000000001431000-memory.dmp

          Filesize

          4KB

        • memory/3056-183-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-189-0x0000000000820000-0x0000000000880000-memory.dmp

          Filesize

          384KB

        • memory/3056-318-0x0000000001430000-0x0000000001431000-memory.dmp

          Filesize

          4KB

        • memory/3068-388-0x0000000000400000-0x00000000004A8000-memory.dmp

          Filesize

          672KB

        • memory/3068-355-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-401-0x0000000074040000-0x000000007472E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-353-0x00000000002F0000-0x0000000000357000-memory.dmp

          Filesize

          412KB