Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 05:00

General

  • Target

    fca902b91106c95378c0ef09d68b2f455e2df179eb68026da650454a2758f0c3.exe

  • Size

    1.4MB

  • MD5

    a0b3478ba7d88729a009bfcf718bdc32

  • SHA1

    a1dff40decc50ec571936748dea4276637071f13

  • SHA256

    fca902b91106c95378c0ef09d68b2f455e2df179eb68026da650454a2758f0c3

  • SHA512

    36ff76038676e4243fbed563eb02f5d656592326ddbdf2ff030a7f0ecd3ac75d6f8a9be2e263206148e0b61cf063209b2949023a7f406f51191b6190f0b7cc7e

  • SSDEEP

    12288:Y2zoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:lI2JOt934J7Z6bQaj1BvUm9J

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca902b91106c95378c0ef09d68b2f455e2df179eb68026da650454a2758f0c3.exe
    "C:\Users\Admin\AppData\Local\Temp\fca902b91106c95378c0ef09d68b2f455e2df179eb68026da650454a2758f0c3.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1512
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2904
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2328
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2264
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2156
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 184 -NGENProcess 1ac -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1d4 -NGENProcess 244 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 254 -NGENProcess 260 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 264 -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 250 -NGENProcess 1e8 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 26c -NGENProcess 168 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 260 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1292
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 1ac -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 27c -NGENProcess 274 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 288 -NGENProcess 1ac -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2964
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2848
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:3056
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:1744
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2520
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1352
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1964
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:576
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2188

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          1.5MB

          MD5

          5316f7352a798a98b8edb310530e90bb

          SHA1

          50ae0a494ed4665fdee7c2e36784efc86d0a7560

          SHA256

          a0b6968bc151f8a0ee88dbe896def785323741a20b68a1d43496336f33b50515

          SHA512

          09fb223cf8a514e33d6c27d9a2c694b18b5a6ff9a162df2d933ccad0289d745ca5c01a2db0e6224b0b0301731fd6255f5c2c4828d0dcfc7d62a17db6b41eb832

        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

          Filesize

          30.1MB

          MD5

          853928770926e96ebac017575c43a613

          SHA1

          09bee156119f2975fb1bc5db1e2c3adc0bb1d7fa

          SHA256

          412bde204ab558ea483c858b2f8e0a65481c41be134b54692099ddccff24273c

          SHA512

          e97c8f0c08ca9b3d90511080ad373baaebd65021fc58b1c1fefc07329db8425cf5181658ac4301e59e1b0fe2a2f57859a3d5a804c4129b252c59d337cf8f61dc

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

          Filesize

          1.6MB

          MD5

          eef7d6294fffcf46d0c7196d624cc33d

          SHA1

          d85c8d3b0cb5a24274fcbd66ce7b7f654a12bfc6

          SHA256

          64aa889358b3633d64fca7d532ffe99de7031d4a4f3b26188303adb95ba41f78

          SHA512

          86bdca824d143909b00c05146d5045944fbf0f31ffceb7add98a2bd2f8663a4c59be8c1535e4d4c9bd26f12c9b916174d6985227c93b77638844ee141394aa30

        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

          Filesize

          5.2MB

          MD5

          c82c866e31f170629d91c95e1526a0c9

          SHA1

          f282de47399a908c427253b7afdb6c2ac229e66d

          SHA256

          d1c6027480a6f8efced77573f7c49afc86525d869bce1adfd292c9a3107bf34b

          SHA512

          32b2ee69fcd869c24b80313263fbbef340d4b1ec840e7ecfb6ea380cfed0d9ad3cca4ff8750979468a24c7da4938bdb1b23e33317a8494c78df958972068446e

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          2.1MB

          MD5

          fcd99b6bdbfc826b2e57a7c8717fab6d

          SHA1

          ef46829347d8c75d37c1cace1bf64dd8bfb3c362

          SHA256

          316e6d8e49b1d101fd9af2fd06c434acecabf41148584734df9ea8770e9e264f

          SHA512

          edc22ec8ac5ad5ee2ecc4066ed3820e7a9d400407555cbff62e0694024b0567daf5e9789343fd1a64f7e805fd5fcd0b620449e59fed69c42c3a6b3b0333c3729

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          1.4MB

          MD5

          d702a3f4daa8f3067c56be45c0b58350

          SHA1

          f1989da282426b123ce222756d4912ea81402722

          SHA256

          7365f98bbe1a84293dc9ef21881a1769cbdb14ec0dd316df54872efc61cc3262

          SHA512

          69a5f0041036cb220db81bd8ccf08e3446e6374460de310c590cdb19d1535bbdf2a0b4f359ce19278ccadf360fb6730b00a5fdfb9b5b4e7d8f0a0eac4a233e39

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

          Filesize

          872KB

          MD5

          57a02430c02d0de605e4084be47d6e67

          SHA1

          83b4222b0a68ff3cca92634cee1bf31477f07f1c

          SHA256

          7f54c87556c2b3d72e7e12ca4822d95bac9e9f7aafb5fc09ccf0b0183efe0b59

          SHA512

          405b9128b77bc1cdf1a72350c512da6ccc0c45ab1b6fc4450cae275e0b2f9edea394f0cca4e1cd2e31960ac634483ee063b1d55ca4c0507b2e5447c6f46c0229

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.5MB

          MD5

          ae3d8b79a0d60efde07616c76b0b5591

          SHA1

          e251acd8c053b94b3ba123922a16d22456cb4cd0

          SHA256

          41aa5042f21d0acdc800951add6e5cc28cd4de1a553e47bbaf333051d1358782

          SHA512

          b620be2d14ba5ca5538e63d7eb700a0d01736777b679a1c9541bfad28fa1a0a6bfdec32431ae32014c575c0e1ccdef89e508ea7909560b8e9398f7a39927aaf1

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

          Filesize

          1.4MB

          MD5

          85af0cde15c7ed17e1f23df5cb082861

          SHA1

          bf6c1ca0215d0c564b0c1e48120b75e353276604

          SHA256

          0bc1ef9f47700ce7b209ef7483a259e4ec254427e6046753b1adad731d2917e7

          SHA512

          b5ab471d07ea6c7af8180629b056cedbf381245ea4dd4039270efd8dd3b83b8cea85163218556e9c6c7028b73a60648465eb814b1466861d96dc7d22f7dfa139

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

          Filesize

          1003KB

          MD5

          98d20b6abf3b45fbe2f39ddc68148731

          SHA1

          e3c6c6b80b6238038586ddcd21700a8187393372

          SHA256

          5e629cc966dd4c71039c686e62446f4e0447400d6f3d2039539f47609bc91af1

          SHA512

          624ad3ca000219f449225405212ee42f7f92cc794581ec7c72c80caa1e314f46a3c3fac6790770cec2a0a8e921c72065d45700f29dc40bce7fbdc4af4963d863

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.5MB

          MD5

          efad8b55fa20c21ecc68ff0c0660e2bb

          SHA1

          20524a32e213192cbe6b3e38f4b3461d70c279bc

          SHA256

          485fab5b574d70edd741818d747bc1f0f325e3166c65873b9ae8c68db9eee130

          SHA512

          21505d89f7a603e5b56097c4aaa5b0aa2bb42131df5222a076b7f45359ddec2a6fab943e573089a471065e580039012599b036086f8fe20aaeb8cebd0566e390

        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

          Filesize

          1.4MB

          MD5

          7d27db19c2745ef7ee139f6570022ebc

          SHA1

          2a89788889f3b7ab24ea3802a306328c4c66cb9e

          SHA256

          89c724fde6e5e22d5be0c3aa6853fb13977d637cfa235ebf1637df2f82279426

          SHA512

          64c7ca5cd3bf0fa6d5dfca126f454f585b7611540f1cef02940ffd5c4310ed1dd50739df43272c0a3b4243962206a488a0b1aaf0d3f71d37619a993f31557e63

        • \Windows\System32\alg.exe

          Filesize

          1.4MB

          MD5

          2b813085a52b96dc9d9193a1485475e5

          SHA1

          0d6f69ec33cfd0f025ef6ab921e5501448d6a21a

          SHA256

          3fe171deab290cb4b05febddfc8cbb87d0a379341fdb89d276d8e22a229b4431

          SHA512

          640e98db4147153f0b85276fa69d0764a11ef5fd9340df440e7fc5d22644cb0e66c22bd7992656b75c8f894fc4a20a66d8641bd0e4a953afbd1c220b956d87fd

        • \Windows\ehome\ehrecvr.exe

          Filesize

          1.2MB

          MD5

          d25b55897f8f1f1fc187647616839850

          SHA1

          0fcb604885146b656a765fbde1cf65521af548e1

          SHA256

          32c9c3d68e4390785fa8ff36399770cc36c707fc0872e878567203029c5a9e3e

          SHA512

          0033ab5133ad4a5418e05a537643c6a614270ff90fc309f4c8a4c15e785bf3a251fdca14ce87cd1924706c622473662e2866878bb8e98346a15b99af386e0323

        • \Windows\ehome\ehsched.exe

          Filesize

          1.5MB

          MD5

          7ac612461f69049830867ad29ae92f6a

          SHA1

          507f05c58441168668eb1f631a041b966f16a6a8

          SHA256

          e893acbc438fc31ff3c18ce68e4e887c8ef16d38186bd48a3db3b6654741114d

          SHA512

          1ca662b5e3d8621e3f2c85ad99b56e50cd1f6d386ee2d18a9bf2a3cfb6b6068bf366db985089a52099a72ed7e18bbd288c1ea893c660ddd2db97e76cc4e8172c

        • memory/576-301-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/576-191-0x000000002E000000-0x000000002E254000-memory.dmp

          Filesize

          2.3MB

        • memory/576-392-0x000000002E000000-0x000000002E254000-memory.dmp

          Filesize

          2.3MB

        • memory/924-296-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/924-299-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/924-140-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/924-145-0x00000000007F0000-0x0000000000857000-memory.dmp

          Filesize

          412KB

        • memory/924-385-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/924-388-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/1352-375-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

        • memory/1352-169-0x00000000004D0000-0x0000000000537000-memory.dmp

          Filesize

          412KB

        • memory/1352-166-0x000000002E000000-0x000000002FE1E000-memory.dmp

          Filesize

          30.1MB

        • memory/1512-75-0x0000000010000000-0x000000001023E000-memory.dmp

          Filesize

          2.2MB

        • memory/1512-7-0x00000000004A0000-0x0000000000507000-memory.dmp

          Filesize

          412KB

        • memory/1512-1-0x0000000010000000-0x000000001023E000-memory.dmp

          Filesize

          2.2MB

        • memory/1512-391-0x0000000010000000-0x000000001023E000-memory.dmp

          Filesize

          2.2MB

        • memory/1512-6-0x00000000004A0000-0x0000000000507000-memory.dmp

          Filesize

          412KB

        • memory/1512-0-0x00000000004A0000-0x0000000000507000-memory.dmp

          Filesize

          412KB

        • memory/1744-188-0x0000000140000000-0x0000000140251000-memory.dmp

          Filesize

          2.3MB

        • memory/1744-125-0x0000000140000000-0x0000000140251000-memory.dmp

          Filesize

          2.3MB

        • memory/1964-201-0x0000000000FA0000-0x0000000001000000-memory.dmp

          Filesize

          384KB

        • memory/1964-177-0x0000000140000000-0x0000000140269000-memory.dmp

          Filesize

          2.4MB

        • memory/1964-182-0x0000000000FA0000-0x0000000001000000-memory.dmp

          Filesize

          384KB

        • memory/1964-200-0x0000000140000000-0x0000000140269000-memory.dmp

          Filesize

          2.4MB

        • memory/2156-62-0x0000000000420000-0x0000000000480000-memory.dmp

          Filesize

          384KB

        • memory/2156-54-0x0000000010000000-0x0000000010246000-memory.dmp

          Filesize

          2.3MB

        • memory/2156-55-0x0000000000420000-0x0000000000480000-memory.dmp

          Filesize

          384KB

        • memory/2156-138-0x0000000010000000-0x0000000010246000-memory.dmp

          Filesize

          2.3MB

        • memory/2188-300-0x0000000000830000-0x0000000000890000-memory.dmp

          Filesize

          384KB

        • memory/2188-298-0x00000000743D8000-0x00000000743ED000-memory.dmp

          Filesize

          84KB

        • memory/2188-297-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

        • memory/2188-409-0x0000000100000000-0x0000000100542000-memory.dmp

          Filesize

          5.3MB

        • memory/2188-410-0x00000000743D8000-0x00000000743ED000-memory.dmp

          Filesize

          84KB

        • memory/2208-423-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/2208-404-0x0000000000360000-0x00000000003C7000-memory.dmp

          Filesize

          412KB

        • memory/2208-403-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/2208-411-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2208-424-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2264-38-0x00000000009B0000-0x0000000000A17000-memory.dmp

          Filesize

          412KB

        • memory/2264-73-0x0000000010000000-0x000000001023E000-memory.dmp

          Filesize

          2.2MB

        • memory/2264-40-0x0000000010000000-0x000000001023E000-memory.dmp

          Filesize

          2.2MB

        • memory/2264-44-0x00000000009B0000-0x0000000000A17000-memory.dmp

          Filesize

          412KB

        • memory/2264-45-0x00000000009B0000-0x0000000000A17000-memory.dmp

          Filesize

          412KB

        • memory/2284-407-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/2284-382-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2284-376-0x0000000000C00000-0x0000000000C67000-memory.dmp

          Filesize

          412KB

        • memory/2284-408-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2328-34-0x0000000000B10000-0x0000000000B70000-memory.dmp

          Filesize

          384KB

        • memory/2328-111-0x0000000140000000-0x000000014023C000-memory.dmp

          Filesize

          2.2MB

        • memory/2328-27-0x0000000140000000-0x000000014023C000-memory.dmp

          Filesize

          2.2MB

        • memory/2328-28-0x0000000000B10000-0x0000000000B70000-memory.dmp

          Filesize

          384KB

        • memory/2520-366-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/2520-157-0x0000000000890000-0x00000000008F0000-memory.dmp

          Filesize

          384KB

        • memory/2520-151-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/2616-433-0x0000000000650000-0x00000000006B7000-memory.dmp

          Filesize

          412KB

        • memory/2656-437-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2656-421-0x0000000000390000-0x00000000003F7000-memory.dmp

          Filesize

          412KB

        • memory/2656-425-0x0000000072FE0000-0x00000000736CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2820-82-0x00000000006D0000-0x0000000000737000-memory.dmp

          Filesize

          412KB

        • memory/2820-77-0x00000000006D0000-0x0000000000737000-memory.dmp

          Filesize

          412KB

        • memory/2820-76-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/2820-149-0x0000000000400000-0x0000000000647000-memory.dmp

          Filesize

          2.3MB

        • memory/2848-93-0x00000000004A0000-0x0000000000500000-memory.dmp

          Filesize

          384KB

        • memory/2848-97-0x0000000140000000-0x000000014024D000-memory.dmp

          Filesize

          2.3MB

        • memory/2848-162-0x0000000140000000-0x000000014024D000-memory.dmp

          Filesize

          2.3MB

        • memory/2848-102-0x00000000004A0000-0x0000000000500000-memory.dmp

          Filesize

          384KB

        • memory/2904-14-0x0000000100000000-0x0000000100243000-memory.dmp

          Filesize

          2.3MB

        • memory/2904-94-0x0000000100000000-0x0000000100243000-memory.dmp

          Filesize

          2.3MB

        • memory/2904-13-0x00000000001A0000-0x0000000000200000-memory.dmp

          Filesize

          384KB

        • memory/2904-21-0x00000000001A0000-0x0000000000200000-memory.dmp

          Filesize

          384KB

        • memory/3056-389-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-193-0x0000000000E10000-0x0000000000E11000-memory.dmp

          Filesize

          4KB

        • memory/3056-133-0x0000000000E10000-0x0000000000E11000-memory.dmp

          Filesize

          4KB

        • memory/3056-393-0x0000000000A60000-0x0000000000AC0000-memory.dmp

          Filesize

          384KB

        • memory/3056-174-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-110-0x0000000000A60000-0x0000000000AC0000-memory.dmp

          Filesize

          384KB

        • memory/3056-113-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/3056-118-0x0000000000A60000-0x0000000000AC0000-memory.dmp

          Filesize

          384KB