Analysis

  • max time kernel
    355s
  • max time network
    349s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/08/2024, 18:42

General

  • Target

    Invoice-2238562.pdf.exe

  • Size

    697KB

  • MD5

    ffce60d577ed0b67ba4f4a590fa1aabc

  • SHA1

    b3ed06cb9856f457fd161efee573e3d9695cccb3

  • SHA256

    5827d53c05670c0d0f65d0ce989000b410cfbfb5a9831107d8dfbb13280501cb

  • SHA512

    cb5bd447f3c2d281ff93cb49c82f961e9a9edfa7efc1b6acb5bb6e9ac3fba7d20fe5ebb0b386c0b1582787d0aa40a370700b86629dcdb9638dcfe9e60e2fadb8

  • SSDEEP

    12288:3kVV5pxDntgsVsuhtng2RcAxzCUZk/25J/l4FZGb4jmoMA+d7CvWZMWMPagvk:325rp/zRcKPZk/O/lsZGHoMA6eoMzpvk

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice-2238562.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice-2238562.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Invoice-2238562.pdf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QyszliywyYQPNQ.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QyszliywyYQPNQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD95.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2956
    • C:\Users\Admin\AppData\Local\Temp\Invoice-2238562.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice-2238562.pdf.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:5036
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\NewResolve.xht
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff08f93cb8,0x7fff08f93cc8,0x7fff08f93cd8
      2⤵
        PID:4572
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
        2⤵
          PID:2896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4156
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
          2⤵
            PID:1524
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
            2⤵
              PID:4992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:1592
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3888
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2408
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                2⤵
                  PID:1680
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
                  2⤵
                    PID:3308
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
                    2⤵
                      PID:3704
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                      2⤵
                        PID:1132
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
                        2⤵
                          PID:3624
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,7964220564054318907,13015195727142148913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:1
                          2⤵
                            PID:280
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2256
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3104

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                              Filesize

                              2KB

                              MD5

                              ac4917a885cf6050b1a483e4bc4d2ea5

                              SHA1

                              b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                              SHA256

                              e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                              SHA512

                              092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              2ee16858e751901224340cabb25e5704

                              SHA1

                              24e0d2d301f282fb8e492e9df0b36603b28477b2

                              SHA256

                              e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

                              SHA512

                              bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ea667b2dedf919487c556b97119cf88a

                              SHA1

                              0ee7b1da90be47cc31406f4dba755fd083a29762

                              SHA256

                              9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

                              SHA512

                              832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                              Filesize

                              211KB

                              MD5

                              e7226392c938e4e604d2175eb9f43ca1

                              SHA1

                              2098293f39aa0bcdd62e718f9212d9062fa283ab

                              SHA256

                              d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                              SHA512

                              63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              123e334dbcc05cc83c5db6d6b6499c7f

                              SHA1

                              883b1cbc2cc9651d68cb904f0eb3a9033828d1dd

                              SHA256

                              b3e70ff434c20f60c0da5b8c02c91f93ae84efc565670c8058edc6aa21831c30

                              SHA512

                              347c9cdd5ae0f9e989c57501eca719e6a3d03387c8134aa55f2da17e0fca87a96b50c8110efefc8255c615360c9b78ac0bb41ed10a481eb0422031c5864defee

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              781c310e4cae51d519609ef0d89b1f04

                              SHA1

                              882946e5e85233f13d2fc486c967d9e0b23be71c

                              SHA256

                              dcffcf91efb6508e9b5f2de9d80a43866adcdd39b1de2a86ca53f24c23c45975

                              SHA512

                              df36d054324e69b740cf917cf3b9881bb4fdd3f27a6bfb46b478d41bc891fb955cc87219e83156463ce687929184178dd84ea15e143241262910ba912bdfd201

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              8675620193ad12d981264ba351ede367

                              SHA1

                              2e6b675849007721d4f7e631510d79c3f273663e

                              SHA256

                              92c3313e55564a02a72a0d6b5da3f2bc642a4238a13fe893246dfca343235ed1

                              SHA512

                              90214425d12777deb446a220d2a9d7054508e6d40765dd436900f1823ca6b444fa95dc2de21f9b68732e1e872c66b583fc51ee23694a4bd4fec0d4541d18220b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              28d4af5c4e52cc3be136943846eb19f4

                              SHA1

                              4a5ee11476ba114273a6c835e6403c66e1a99977

                              SHA256

                              38b77559ab94c0520603ae02fa0116c40b7a2df39468ed432a5bc27a762165ac

                              SHA512

                              c6af919653740f469fa2325e438da630f22007ec966a42d739144f77b130d3b62085f1e0a535577ae9145f2f5426f900eb6df782fc95ff240d5595a3fa28f4f0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              f362a7157e8ccbeb21c30141747094ae

                              SHA1

                              dd1256694b9904202d31973f8038105c79f1e5cc

                              SHA256

                              063cf5422df575c5a5acc1575df37391a77841b490b450674942633e6d68c2e9

                              SHA512

                              65ab5b222ced597c40ea0b4fadb7d0faa9a3fbbe828511e87d21b976d3dcdc27caed1494985238f133e18587c05d69460b4ebf245c0035413287f19b5c475c92

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              eb3ca0857aec6d6270a23597c3fd58ce

                              SHA1

                              99c1387ab006db0d5c978b1e8da9b101dc425913

                              SHA256

                              ea5ee67a2b91952046f51cf9fc899b5d5decfebddd6189cf2c085abed885d8a6

                              SHA512

                              144fc76457733527c101f7635d7ada0e60b4baec2c0bc1f4e214e7eb4d377ba2e58b231ca2d99f7184da8bf8a2070e3c7f3229292fec7f0d72432e860af87b4b

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                              Filesize

                              18KB

                              MD5

                              f96e76762f64ed9c29cfb67b3e0c4fef

                              SHA1

                              61f8df3943fbc87e2deff1d0020217a3d0d44b0f

                              SHA256

                              1af5915a8d20b0a3781e626aab8588e05a5071e3d0de0a5abad6032bba62f472

                              SHA512

                              d57a89e370ef19179fbdfd28c0a45882320530c39492677217093aed62205ebff94a41c06267d6750f3db2ff950b418283e3f608f4d4126398f50a04f83132c3

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cufoqzzn.0ms.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Local\Temp\tmpAD95.tmp

                              Filesize

                              1KB

                              MD5

                              e607b036b0d643a39d1852cf765ed103

                              SHA1

                              bc47108d053d904215f23e03163ec3ec62064ce6

                              SHA256

                              ad23750f7029f9eea278248549e1223ce7d2d37ee7f7929f0908519a3b492077

                              SHA512

                              59fd9bacd216fa03cb96b21b8df1636439ff190a048a5fed7bd4da97abd737af8b15f663421b02eddee5f549edd89d7a3bb3eb5a5b55804662ae55c607e64a1c

                            • memory/564-10-0x000000000AA00000-0x000000000AA9C000-memory.dmp

                              Filesize

                              624KB

                            • memory/564-9-0x00000000070B0000-0x000000000713C000-memory.dmp

                              Filesize

                              560KB

                            • memory/564-8-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/564-7-0x00000000750CE000-0x00000000750CF000-memory.dmp

                              Filesize

                              4KB

                            • memory/564-6-0x0000000006E50000-0x0000000006E68000-memory.dmp

                              Filesize

                              96KB

                            • memory/564-5-0x0000000005990000-0x000000000599A000-memory.dmp

                              Filesize

                              40KB

                            • memory/564-4-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/564-3-0x00000000058E0000-0x0000000005972000-memory.dmp

                              Filesize

                              584KB

                            • memory/564-2-0x0000000005DF0000-0x0000000006396000-memory.dmp

                              Filesize

                              5.6MB

                            • memory/564-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

                              Filesize

                              4KB

                            • memory/564-46-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/564-1-0x0000000000D10000-0x0000000000DC4000-memory.dmp

                              Filesize

                              720KB

                            • memory/3104-85-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3104-21-0x0000000005A60000-0x0000000005A82000-memory.dmp

                              Filesize

                              136KB

                            • memory/3104-15-0x0000000005460000-0x0000000005496000-memory.dmp

                              Filesize

                              216KB

                            • memory/3104-16-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3104-18-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3104-61-0x0000000075970000-0x00000000759BC000-memory.dmp

                              Filesize

                              304KB

                            • memory/3104-17-0x0000000005BC0000-0x00000000061EA000-memory.dmp

                              Filesize

                              6.2MB

                            • memory/3104-19-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/3104-22-0x0000000005B00000-0x0000000005B66000-memory.dmp

                              Filesize

                              408KB

                            • memory/3104-23-0x00000000062F0000-0x0000000006356000-memory.dmp

                              Filesize

                              408KB

                            • memory/3104-74-0x0000000007E40000-0x0000000007E51000-memory.dmp

                              Filesize

                              68KB

                            • memory/3104-75-0x0000000007E70000-0x0000000007E7E000-memory.dmp

                              Filesize

                              56KB

                            • memory/3104-76-0x0000000007E80000-0x0000000007E95000-memory.dmp

                              Filesize

                              84KB

                            • memory/3104-77-0x0000000007F90000-0x0000000007FAA000-memory.dmp

                              Filesize

                              104KB

                            • memory/3104-78-0x0000000007F70000-0x0000000007F78000-memory.dmp

                              Filesize

                              32KB

                            • memory/3104-38-0x00000000063E0000-0x0000000006737000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/5028-29-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5028-50-0x0000000075970000-0x00000000759BC000-memory.dmp

                              Filesize

                              304KB

                            • memory/5028-84-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5028-59-0x00000000068F0000-0x000000000690E000-memory.dmp

                              Filesize

                              120KB

                            • memory/5028-49-0x00000000072C0000-0x00000000072F4000-memory.dmp

                              Filesize

                              208KB

                            • memory/5028-44-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5028-42-0x00000000750C0000-0x0000000075871000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5028-48-0x0000000006850000-0x000000000689C000-memory.dmp

                              Filesize

                              304KB

                            • memory/5028-47-0x00000000062D0000-0x00000000062EE000-memory.dmp

                              Filesize

                              120KB

                            • memory/5028-60-0x0000000007500000-0x00000000075A4000-memory.dmp

                              Filesize

                              656KB

                            • memory/5028-73-0x00000000078B0000-0x0000000007946000-memory.dmp

                              Filesize

                              600KB

                            • memory/5028-72-0x00000000076A0000-0x00000000076AA000-memory.dmp

                              Filesize

                              40KB

                            • memory/5028-70-0x0000000007C60000-0x00000000082DA000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/5028-71-0x0000000007620000-0x000000000763A000-memory.dmp

                              Filesize

                              104KB

                            • memory/5036-43-0x0000000000400000-0x0000000000448000-memory.dmp

                              Filesize

                              288KB

                            • memory/5036-87-0x0000000006930000-0x0000000006980000-memory.dmp

                              Filesize

                              320KB

                            • memory/5036-86-0x0000000006AA0000-0x0000000006C62000-memory.dmp

                              Filesize

                              1.8MB