Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 10:27

General

  • Target

    SynsWaveV1.exe

  • Size

    358KB

  • MD5

    fe2e1aa24f67aef8cca2a83269e49eb8

  • SHA1

    22eff1e84d25f5daf052a046c4c6a66c37f63cc4

  • SHA256

    712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50

  • SHA512

    97a7dc677ee2c8ca61729b2ec0532a2d59fb705d413c76f2f5b197053d15cd462a560038e49a75c4b76b3c9255a48690a97dfd7d89d81692c37a7547c6bad837

  • SSDEEP

    6144:o5aLkSNxlSl2ZvRbTs6iG0GkBnTYQSeMMHg/dRS4Y83PUf0KrZUNsC:AfG+2ZRQ7GdynTYQSMAV44YGPNKraS

Malware Config

Extracted

Family

xworm

C2

expected-schema.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe
    "C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe
      "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe"
        3⤵
        • Views/modifies file attributes
        PID:1500
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4080
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3056
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:3944
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:2784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1492
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:2992
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe" && pause
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:2044
            • C:\Windows\system32\PING.EXE
              ping localhost
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2508
        • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
          "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4440
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:716
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4212
        • C:\Users\Admin\AppData\Roaming\SynsWave.exe
          "C:\Users\Admin\AppData\Roaming\SynsWave.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3840
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:212
        • C:\Users\Admin\RuntimeBroker
          C:\Users\Admin\RuntimeBroker
          1⤵
          • Executes dropped EXE
          PID:4868
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2856
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3940
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5024
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:864
          • C:\Users\Admin\RuntimeBroker
            C:\Users\Admin\RuntimeBroker
            1⤵
            • Executes dropped EXE
            PID:368
          • C:\Windows\System32\u5btjl.exe
            "C:\Windows\System32\u5btjl.exe"
            1⤵
              PID:2520

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.log

              Filesize

              654B

              MD5

              2ff39f6c7249774be85fd60a8f9a245e

              SHA1

              684ff36b31aedc1e587c8496c02722c6698c1c4e

              SHA256

              e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

              SHA512

              1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              107102102e02e48f37f5318c7e113c43

              SHA1

              7fb10fc65c85fb4c050309f0872bc9389dcccc0d

              SHA256

              3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7

              SHA512

              b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              21169979ffbe5f470ba32cc36867e150

              SHA1

              2037147dc14955b4ebd6f73d3930c3d6e609d33f

              SHA256

              e324d4506308520b7ab6589424d6ea140618621a4eea6926f2d633f143ede53e

              SHA512

              0dfdc72744e18eb56cd2e3b82e722d979433cc36dfa93c2bb204f19881a384c3376d0ebae2c1ad9a59e3c1c07f3c1d2779febcb8ae33453568c8525ec66e10b1

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              ba169f4dcbbf147fe78ef0061a95e83b

              SHA1

              92a571a6eef49fff666e0f62a3545bcd1cdcda67

              SHA256

              5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

              SHA512

              8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              64B

              MD5

              90b2459a6432f59ed2d225f7e4b77d96

              SHA1

              e9d41ca7105a28e987fadfd188438e08f1bde664

              SHA256

              3f9daee99f25633b64f3484dce77abf499c125d4072047368e933bf50d0b016b

              SHA512

              41f256166d406f2299f9cf8daf4ab08b0cda00782b15ad951c1f123a315147b9cb7c27ea963f4619ac891a6b77a99c4f5a4a4f5dd8c852f059ddd4013f6b59b6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              96ff1ee586a153b4e7ce8661cabc0442

              SHA1

              140d4ff1840cb40601489f3826954386af612136

              SHA256

              0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

              SHA512

              3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              77d622bb1a5b250869a3238b9bc1402b

              SHA1

              d47f4003c2554b9dfc4c16f22460b331886b191b

              SHA256

              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

              SHA512

              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              948B

              MD5

              966914e2e771de7a4a57a95b6ecfa8a9

              SHA1

              7a32282fd51dd032967ed4d9a40cc57e265aeff2

              SHA256

              98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

              SHA512

              dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              276798eeb29a49dc6e199768bc9c2e71

              SHA1

              5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

              SHA256

              cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

              SHA512

              0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iatzu23l.0ip.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe

              Filesize

              229KB

              MD5

              8bb8292d00e8218192562b888b4d7671

              SHA1

              61a03523336bd54964fbb62338027673d0a138cb

              SHA256

              a9f8c9cf4ceadfa6bc56ab230c8dfe8a7018e1123ba01039a4059b1814b757a0

              SHA512

              c19a19dd6b49cc237e751db9d58db56e745f7d00c8d81397928fddef8902b9abec4b9331573be9478d33554c6b77b4f52a055bf2251300736035b5eec24faa1e

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk

              Filesize

              784B

              MD5

              f988adbbbb9d5e2094f7bc4d9cf953ca

              SHA1

              d8508cbcaf6f9b5925e1035b65c1c973972ac676

              SHA256

              c6a4520264dcf349fbb64aa87bdbd1d8329f794e632beee1b97b825b1509216a

              SHA512

              d06732fd0fd6a2711b6ebf7b50202b8c450df73ab2a0296e92c9b20ebf4c78fb7b86a76609f04dd8d1c8c5102ba85f74f6c32a5a5d411aefa3c229d3b89c7841

            • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

              Filesize

              94KB

              MD5

              5e6bae23e86272120e9ccfa3413ece3e

              SHA1

              7cf89daa0119650ec13ef056c143249c4002a4f1

              SHA256

              116b46762acbc220ec42b00329392668bf3e24cc00a650f68013465c319cbf4d

              SHA512

              7a607b3e850f930794bc493aa68d0ecf236a23e98ee912e279b1649bd0e2110e01cefcc5259744c06e1b4a8cccaececdde6c2f18ef8d252414cb461bdd9d3f0d

            • C:\Users\Admin\AppData\Roaming\SynsWave.exe

              Filesize

              25KB

              MD5

              12e7359129744823438f3d6b97192955

              SHA1

              89872a5a18abefe25d10efa824281718cf85ae39

              SHA256

              348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e

              SHA512

              b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563

            • memory/1256-42-0x000001E8F6900000-0x000001E8F6922000-memory.dmp

              Filesize

              136KB

            • memory/2372-101-0x00000157A2900000-0x00000157A290A000-memory.dmp

              Filesize

              40KB

            • memory/2372-164-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

              Filesize

              10.8MB

            • memory/2372-28-0x0000015788100000-0x0000015788140000-memory.dmp

              Filesize

              256KB

            • memory/2372-102-0x00000157A2940000-0x00000157A2952000-memory.dmp

              Filesize

              72KB

            • memory/2372-64-0x00000157A28B0000-0x00000157A2900000-memory.dmp

              Filesize

              320KB

            • memory/2372-63-0x00000157A2830000-0x00000157A28A6000-memory.dmp

              Filesize

              472KB

            • memory/2372-65-0x00000157A2800000-0x00000157A281E000-memory.dmp

              Filesize

              120KB

            • memory/2372-34-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

              Filesize

              10.8MB

            • memory/2856-182-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-183-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-178-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-172-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-173-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-174-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-184-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-179-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-180-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/2856-181-0x000001FC3E240000-0x000001FC3E241000-memory.dmp

              Filesize

              4KB

            • memory/3356-36-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

              Filesize

              10.8MB

            • memory/3356-33-0x0000000000E80000-0x0000000000E9E000-memory.dmp

              Filesize

              120KB

            • memory/3356-168-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

              Filesize

              10.8MB

            • memory/4016-0-0x00007FFCF0573000-0x00007FFCF0575000-memory.dmp

              Filesize

              8KB

            • memory/4016-1-0x00000000006A0000-0x0000000000700000-memory.dmp

              Filesize

              384KB