Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2024 19:51

General

  • Target

    8765c39cc6647adc171220b11942422b_JaffaCakes118.exe

  • Size

    3.3MB

  • MD5

    8765c39cc6647adc171220b11942422b

  • SHA1

    5a45fd626dcf26b1f933e5a18db138fe1df64444

  • SHA256

    f52e34603c58c806081a09fc4ba38eabe1e3f12b7a57a75353ecf593177fa7ef

  • SHA512

    8c5bf35e5d6dc7aab1bff4836ef00e44d7e158d4b8d3f9bcf9ebb39a02b21078c5879f061ac926aa52b9a0f9a83752f322db1d98c1a2908a9ec5eed60919fa65

  • SSDEEP

    98304:xpeKfE9KlGB9z8qTsF5iOew3qrCvLUBsKxp:x8/9HHoGDQLUCKxp

Malware Config

Extracted

Family

nullmixer

C2

http://znegs.xyz/

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • Nullmixer family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8765c39cc6647adc171220b11942422b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8765c39cc6647adc171220b11942422b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_1.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe
          zaiqa_1.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:572
          • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe" -a
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_2.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4292
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_2.exe
          zaiqa_2.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          PID:780
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 360
            5⤵
            • Program crash
            PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_3.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4632
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_3.exe
          zaiqa_3.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:5052
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1992
            5⤵
            • Program crash
            PID:1728
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1984
            5⤵
            • Program crash
            PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_4.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_4.exe
          zaiqa_4.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
            "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
            5⤵
            • Executes dropped EXE
            PID:4716
          • C:\Users\Admin\AppData\Local\Temp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\setup.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Windows\winnetdriv.exe
              "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1730578621 0
              6⤵
              • Executes dropped EXE
              PID:2332
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_5.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_5.exe
          zaiqa_5.exe
          4⤵
          • Executes dropped EXE
          PID:1484
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_6.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_6.exe
          zaiqa_6.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2684
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_7.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3588
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_7.exe
          zaiqa_7.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4524
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_8.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3560
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_8.exe
          zaiqa_8.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5088
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c zaiqa_9.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_9.exe
          zaiqa_9.exe
          4⤵
          • Executes dropped EXE
          PID:2240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 560
        3⤵
        • Program crash
        PID:2316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2308 -ip 2308
    1⤵
      PID:4972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 780 -ip 780
      1⤵
        PID:1728
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2528
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3160
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:3940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5052 -ip 5052
          1⤵
            PID:2368
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5052 -ip 5052
            1⤵
              PID:3896

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\softokn3.dll

              Filesize

              275B

              MD5

              a378c450e6ad9f1e0356ed46da190990

              SHA1

              d457a2c162391d2ea30ec2dc62c8fb3b973f6a66

              SHA256

              b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978

              SHA512

              e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\libcurl.dll

              Filesize

              218KB

              MD5

              d09be1f47fd6b827c81a4812b4f7296f

              SHA1

              028ae3596c0790e6d7f9f2f3c8e9591527d267f7

              SHA256

              0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

              SHA512

              857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\libcurlpp.dll

              Filesize

              54KB

              MD5

              e6e578373c2e416289a8da55f1dc5e8e

              SHA1

              b601a229b66ec3d19c2369b36216c6f6eb1c063e

              SHA256

              43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

              SHA512

              9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\libgcc_s_dw2-1.dll

              Filesize

              113KB

              MD5

              9aec524b616618b0d3d00b27b6f51da1

              SHA1

              64264300801a353db324d11738ffed876550e1d3

              SHA256

              59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

              SHA512

              0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\libstdc++-6.dll

              Filesize

              647KB

              MD5

              5e279950775baae5fea04d2cc4526bcc

              SHA1

              8aef1e10031c3629512c43dd8b0b5d9060878453

              SHA256

              97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

              SHA512

              666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\libwinpthread-1.dll

              Filesize

              69KB

              MD5

              1e0d62c34ff2e649ebc5c372065732ee

              SHA1

              fcfaa36ba456159b26140a43e80fbd7e9d9af2de

              SHA256

              509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

              SHA512

              3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\setup_install.exe

              Filesize

              287KB

              MD5

              a52a590e1f8f93cd1d4108293415975c

              SHA1

              49db2a15b6f32c6189f24a8ae6e4bb33d0485f05

              SHA256

              12d2f007dcc8cb316493fe0f61fd330fdec70f872ae81693e12f9fcc47590149

              SHA512

              47893f8117466821b89b29836e638bc76d2ee93e57179ba49d2242eb066fa01ff4e0033f194099065e29278b4d4ba653cca00e270f85ccd6cb91b7d3285d6161

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe

              Filesize

              56KB

              MD5

              3263859df4866bf393d46f06f331a08f

              SHA1

              5b4665de13c9727a502f4d11afb800b075929d6c

              SHA256

              9dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2

              SHA512

              58205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_2.exe

              Filesize

              188KB

              MD5

              44dc205a5701b53f391a3a750c2c4712

              SHA1

              14e82b1f6bb987d8f2783db2ab5f82dd9ab8eacc

              SHA256

              508c41442ba856a3266b3e58a31fe8c4b0ad7491e04dfead265daaa028efd768

              SHA512

              02890434c81867499e0911e8062797bf7fc184e05b6de2ab14ffa6f95c48f88e07250b4e5a7ff565bbf45d66d8d7cb5c1009b85085ee3a6bbdac218f356c5749

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_3.exe

              Filesize

              555KB

              MD5

              8595f5515fac09b73ff463056cb07a15

              SHA1

              80f39da9a52cffb70edaa4d7de82f543ba4d417e

              SHA256

              8223619e305ec5063e9e2c1490fa25f6e924c317b08fd5eed938bb5de2e57de1

              SHA512

              26f0a15484a8780fedcea91f9d90ab4b81a91598fad4cad54f45fd18eccf73914215851909bf8acadeafc7b89c656c98ec988a46aa43e17a364b39b5d8ac477a

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_4.exe

              Filesize

              923KB

              MD5

              13a289feeb15827860a55bbc5e5d498f

              SHA1

              e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

              SHA256

              c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

              SHA512

              00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_5.exe

              Filesize

              900KB

              MD5

              8cad9c4c58553ec0ca5fd50aec791b8a

              SHA1

              a2a4385cb2df58455764eb879b5d6aaf5e3585ac

              SHA256

              f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294

              SHA512

              1eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_6.exe

              Filesize

              186KB

              MD5

              28e40b1adae683f70b178d025ea7bf64

              SHA1

              24851934bbb9a67c6d07e48503e6296c91fff502

              SHA256

              1cde227af526781ff9553ffef5d3eb52bc5e78240150d8bddd20644f4bf80af5

              SHA512

              f02b499b6e10411affba70caf96694f6297f6b754c00b6a179421f5aa21a21bb8f8863d87fea358a280979dfede22a06188abc695e5be4ed578bb60d73aada57

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_7.txt

              Filesize

              1.7MB

              MD5

              fdaa4ceadfc95047aa93dbd903669f25

              SHA1

              97549c52142d192383e8f2018141901a1a0ec112

              SHA256

              22af1522526444b485228e2021f039523e03003bd1ab68b6da275b69c96b018b

              SHA512

              598e77c39f5e443228a7f1926540ad3ffa6eaf8bb9b7f10be9e24fd49f96446511166f0750deebe708a7dbb2d8bb98adcdd330132a24fd932f75068f6524c696

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_8.txt

              Filesize

              8KB

              MD5

              c85639691074f9d98ec530901c153d2b

              SHA1

              cac948e5b1f9d7417e7c5ead543fda1108f0e9ed

              SHA256

              55701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4

              SHA512

              4911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d

            • C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_9.txt

              Filesize

              900KB

              MD5

              5c2e28dedae0e088fc1f9b50d7d28c12

              SHA1

              f521d9d8ae7381e3953ae5cf33b4b1b37f67a193

              SHA256

              2261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f

              SHA512

              f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f

            • C:\Users\Admin\AppData\Local\Temp\chrome2.exe

              Filesize

              43KB

              MD5

              ad0aca1934f02768fd5fedaf4d9762a3

              SHA1

              0e5b8372015d81200c4eff22823e854d0030f305

              SHA256

              dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

              SHA512

              2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

            • C:\Users\Admin\AppData\Local\Temp\setup.exe

              Filesize

              869KB

              MD5

              01ad10e59fa396af2d5443c5a14c1b21

              SHA1

              f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

              SHA256

              bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

              SHA512

              1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

            • memory/780-146-0x0000000000400000-0x0000000002C66000-memory.dmp

              Filesize

              40.4MB

            • memory/1484-201-0x00007FFCD1E60000-0x00007FFCD1E91000-memory.dmp

              Filesize

              196KB

            • memory/1484-199-0x00007FFCD3FE0000-0x00007FFCD408D000-memory.dmp

              Filesize

              692KB

            • memory/2240-164-0x00007FFCD46F0000-0x00007FFCD46F8000-memory.dmp

              Filesize

              32KB

            • memory/2240-202-0x00007FFCD24F0000-0x00007FFCD2512000-memory.dmp

              Filesize

              136KB

            • memory/2308-131-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/2308-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2308-63-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-62-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-61-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/2308-60-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/2308-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2308-36-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2308-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2308-53-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/2308-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/2308-50-0x0000000064941000-0x000000006494F000-memory.dmp

              Filesize

              56KB

            • memory/2308-127-0x000000006EB40000-0x000000006EB63000-memory.dmp

              Filesize

              140KB

            • memory/2308-55-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2308-54-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/2308-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/2308-66-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-49-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/2308-51-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/2308-65-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-64-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-129-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/2308-132-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/2308-67-0x0000000000400000-0x000000000051D000-memory.dmp

              Filesize

              1.1MB

            • memory/2308-130-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/2332-198-0x0000000000F40000-0x000000000101D000-memory.dmp

              Filesize

              884KB

            • memory/2684-92-0x0000000002880000-0x0000000002886000-memory.dmp

              Filesize

              24KB

            • memory/2684-93-0x0000000002890000-0x00000000028B8000-memory.dmp

              Filesize

              160KB

            • memory/2684-94-0x0000000002940000-0x0000000002946000-memory.dmp

              Filesize

              24KB

            • memory/2684-90-0x00000000008F0000-0x0000000000928000-memory.dmp

              Filesize

              224KB

            • memory/3560-207-0x00000000001A0000-0x00000000001FA000-memory.dmp

              Filesize

              360KB

            • memory/4664-118-0x0000000000400000-0x00000000004E4000-memory.dmp

              Filesize

              912KB

            • memory/4716-106-0x0000000000B40000-0x0000000000B50000-memory.dmp

              Filesize

              64KB

            • memory/4820-89-0x0000000000150000-0x000000000023E000-memory.dmp

              Filesize

              952KB

            • memory/5052-162-0x0000000000400000-0x0000000002CC2000-memory.dmp

              Filesize

              40.8MB

            • memory/5052-212-0x0000000076510000-0x00000000766B0000-memory.dmp

              Filesize

              1.6MB

            • memory/5052-215-0x0000000000400000-0x0000000002CC2000-memory.dmp

              Filesize

              40.8MB

            • memory/5088-88-0x0000000000130000-0x0000000000138000-memory.dmp

              Filesize

              32KB

            • memory/5096-205-0x00007FFCD3DC0000-0x00007FFCD3E19000-memory.dmp

              Filesize

              356KB

            • memory/5096-206-0x00007FFCD3D30000-0x00007FFCD3DB3000-memory.dmp

              Filesize

              524KB