Overview

overview

8

Static

static

971b5e84c8...bd.exe

windows7_x64

8

971b5e84c8...bd.exe

windows10_x64

8

Analysis

  • max time kernel
    124s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-05-2021 16:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe

  • Size

    13.2MB

  • MD5

    9632b1f804ec7e7e67f16d6395574ede

  • SHA1

    5b3747e53335523cdc2305f83a7fa803d969f72b

  • SHA256

    971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd

  • SHA512

    21cbd99c9b727824dc855a3198826c828300b2d36409b8ed0c9a52c2a11ea7b3fdcad37c4244f4e6957fd0d269f40566e218e982d4ea8fb4f88d03e3845c8ba0

Score
8/10
macropersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe
    "C:\Users\Admin\AppData\Local\Temp\971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\._cache_971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1460
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2896
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3380
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2608
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:580
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    PID:1536
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3992
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    MD5

    af4f848c5d2fd90c5e0d81d7672497b9

    SHA1

    153669eb359603d17b1872422057a2cb4c0934d6

    SHA256

    6c7dee509814ac1779f7bd29cc3f504b7b4e50cdc136324add91e748ce971530

    SHA512

    cb672b273a6594ec75730ea6e1cf3105781cb8fffcde8b2dbd77d79e04ae0a0a6ba971cdbe8dc47a5b552fe0dbb58557346f751808eae9f5d7edd2acbf3c28b4

    Download Submit
  • C:\ProgramData\Synaptics\Synaptics.exe
    MD5

    af4f848c5d2fd90c5e0d81d7672497b9

    SHA1

    153669eb359603d17b1872422057a2cb4c0934d6

    SHA256

    6c7dee509814ac1779f7bd29cc3f504b7b4e50cdc136324add91e748ce971530

    SHA512

    cb672b273a6594ec75730ea6e1cf3105781cb8fffcde8b2dbd77d79e04ae0a0a6ba971cdbe8dc47a5b552fe0dbb58557346f751808eae9f5d7edd2acbf3c28b4

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\0GF8IZ2H.cookie
    MD5

    e199a84172baf4b7e3e2bbe2cd3dd23e

    SHA1

    3cbf3a3d56843ae40a84f99e2799428088a7f98d

    SHA256

    7740d95a75bf14ee9975c36217f5ccb5111b512b00af8c56488ebe52a5ac64fd

    SHA512

    56238f665557e8d7c3b9cb88e61616d74ab8719c32f98f68176b209aaa7ac6035cda9f66d78757b86ec983d8477cfe6385541be73c8b42b9e000b125a342b948

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\6E877PD5.cookie
    MD5

    75f539847313e9738fb220fb42dc5d69

    SHA1

    01740febbe35107b9ceb9d2b17254e5e57360dad

    SHA256

    c3c737175cd35dfa12f20b751146d5f72d3fd8e3b876cde4f988ddd3abce12d6

    SHA512

    b30af4391316da64c858cce0bca12cd5bc4c192d89b181e678986a1c165062bb6e9f0595dfb5c9273858a22b3a661d2062f424f41a81fcdb820f205e33f14634

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\MZKK6WEN.cookie
    MD5

    c3eacba7dc88c85012cbeeca933ff131

    SHA1

    9c8bc558af33fd0433ec521c306e3ef0e27b5cda

    SHA256

    61d63adc94b5e717a4a2d8c58efd6bb481e1f7bcbab61b5e7390ae766ce4d58a

    SHA512

    45b4406c65254e4ce64e5f8b63e54cca44a4c882f408b58ea91ae089ca63520b6eba2555346958f2ac1d385f11f68a02aad7fa59ac8d9281aca9307ceabc0939

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\QPZ8EH0I.cookie
    MD5

    fac2d5f6f68db11fee7303144d8b3cd9

    SHA1

    548f9860ba64d17004820afc1d75e21a0be3a24e

    SHA256

    0e68c7d38431a4e650f51465828c0c17317981713af4bd5746e2e140a50ecffd

    SHA512

    d4f29e84ed5713861274f619f827ad6d22b98db827310e7885864fff578ec695a514814c507e86251d446bddd7f6a9a5b20dc4daafe84dd02248a7a1c48451e0

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
    MD5

    f7dcb24540769805e5bb30d193944dce

    SHA1

    e26c583c562293356794937d9e2e6155d15449ee

    SHA256

    6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

    SHA512

    cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    MD5

    c19d6490cad523f2a8e6a9ee7359228e

    SHA1

    2406a52ff91f4d97ab4b2ff79180350a252b3421

    SHA256

    215a7197ef6502780e4b14c9842c58608798308c81108cf33efb23119638baa9

    SHA512

    593c3707e37a7c944ec53fed845de04d25ae830c4d0d6dd734aabd5ec400db4591e7d005ef68b796799ccfd7fc7b6418552c150491004c0bcecf30dfdb8958f9

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_096127A9E1E107F17F8526FD82B94E40
    MD5

    6556ca1e88f730cf2d9eadeb6158227c

    SHA1

    a99633750ca038802235e245cac163531f6f7cdc

    SHA256

    0d808e92c67790a78cac4e05359f9a2301b7d64570df3541f4dd64e8d9cb35fd

    SHA512

    d4620401e2a9b24f27bc92dfad1f3a4eb5b161f4d385509dc0b5b5b5c0f94675043912cca535e0e8d7e617d74c0896fe3ace259a7d19ec393d98f5427f9e61b9

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_12581005FAAA458AF2B26E11159E6E6C
    MD5

    073b62400c2fdf8451d4c5f2bc892caf

    SHA1

    acd963e51145b6a7da8c26639ec129f14e132dfb

    SHA256

    07f07e27e813e8e40f08989edb066fb09ccb02321211447a3f44717daa313bf4

    SHA512

    c308d501f55c8becfb4cbfc43ca944c70e9da2b22682290cf30bd3a42267ca28deece3150fb4bf10653802b94c054fb9a6f7f63df1258ef8e19fb03ccd771099

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
    MD5

    4f914d6a12b48374677859978d3def97

    SHA1

    d29a1ff9bc1fbf5c4c0cf3210c9aefe33fc8e5a5

    SHA256

    eb9ac8c88c0857b9588076073491eec79f4725aa32bc7af00c20ef31095d1d68

    SHA512

    ab9cc44820d05b5207d1210e189041f3df258346619f05ae1b058de8b358438095a09b0fed26fcf09d7d08caae353f680936ebe24fdc94c18411463d5ecfbe61

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
    MD5

    c6d87e7dab46d3c58773279cf8a9152a

    SHA1

    18780df2d59e924d8510b665ab606a2e939e4a66

    SHA256

    55527bbfe67d64c9a8b130c319ff464eea49ec3a42ad9e782d2c22baf3e8eb3f

    SHA512

    40dab165d1fb70aec45c3198cd470dd2a725656298fc953e2231e76e0f24b0fd6db9efc386f2f1986b93e199993771b325bbdabd4838dc9e778e9b3a4bfb788c

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    MD5

    f9f020e13ecf613de9fb8f48390736e9

    SHA1

    6fc30746e43a1b365ad0bd9558eaa8f9848e92f5

    SHA256

    0a35b121c0d765fa3cef57d979deb870120e90de5e56612f16079c4c934305d1

    SHA512

    7484b7c9c1d61908d2a4f526f144038fe4bf113ecfb18253f463bd1413ebd20194ddb001dc20fab81e2944fb1e308443b7e130112acaf8ce1bfda0cf983ed240

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    MD5

    f9f020e13ecf613de9fb8f48390736e9

    SHA1

    6fc30746e43a1b365ad0bd9558eaa8f9848e92f5

    SHA256

    0a35b121c0d765fa3cef57d979deb870120e90de5e56612f16079c4c934305d1

    SHA512

    7484b7c9c1d61908d2a4f526f144038fe4bf113ecfb18253f463bd1413ebd20194ddb001dc20fab81e2944fb1e308443b7e130112acaf8ce1bfda0cf983ed240

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_096127A9E1E107F17F8526FD82B94E40
    MD5

    841bfeef11dec6d494255ef4e49059dd

    SHA1

    e860ade28a7b43dca67457e437d1bdad472b954a

    SHA256

    adbdfb2b51ed4f3e6e52b6285b3a087a28f89395678ebfd318bf8d362dab5bc4

    SHA512

    1ad9955e9220c533bfd58e30a9de0e786ba93140b12bc824d431501d4e94a568ac173337967c299d21e780e0c6c75529fff16b42aa235acc16a20af1cc0facfe

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_12581005FAAA458AF2B26E11159E6E6C
    MD5

    0602ab0b272fb649b942a7fecf001f24

    SHA1

    726013e2a0363ba2d2bf379744b6de2eaaf88fc2

    SHA256

    66a06b2cd863fb34defb9f99e7e45bb6db0132db00174cf77a21cca5a3befebb

    SHA512

    b208ec7fa87abebfd2d679048b87a473dbf4505c50d9d56e81e146cf955710fa6d2340716f6268ceb906fa1a6c55313875c0180b1bbebc3db3a05f75d6df7ce6

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
    MD5

    49a4e4c4bd2543ba671156d3f4ae42e4

    SHA1

    bf22a9c78f29868ad05b93672df774efcd4ce191

    SHA256

    95836a24569db232d822820fe70f027fc72fb435aa9386a4b220aaf53025ec16

    SHA512

    188d592f82f12fa761fb1921c6320008980534859450895fbbd2c8993dc95b293855d359ce60cdf8dfaaffd68a728114a2b40afe26f86ccd30d760655d3962c0

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
    MD5

    1b9ea84b8f3e05dd50c37a95ddeaa813

    SHA1

    08919d3d48196d6a11e0e243f0b6459e1d844ef1

    SHA256

    669c4ca13d1d76fd815c1af9798dc8ff33f153f954b3fb565fce6afbcd4dfcfa

    SHA512

    bff34fc582c7a5f11be9f9f6a73507f0b1fb985d99f32408195de656ab009ac18b508e2d8606c500515e7e234b1b68267d0d87c96f214494d91ffa70d99d3bae

    Download Submit
  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
    MD5

    1b9ea84b8f3e05dd50c37a95ddeaa813

    SHA1

    08919d3d48196d6a11e0e243f0b6459e1d844ef1

    SHA256

    669c4ca13d1d76fd815c1af9798dc8ff33f153f954b3fb565fce6afbcd4dfcfa

    SHA512

    bff34fc582c7a5f11be9f9f6a73507f0b1fb985d99f32408195de656ab009ac18b508e2d8606c500515e7e234b1b68267d0d87c96f214494d91ffa70d99d3bae

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\._cache_971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe
    MD5

    88cd3369ceb3a4e22fd54a852fd4258d

    SHA1

    18a7e0eb41eb6dbf9314a7f472d4d60210142e5f

    SHA256

    f0fd284e05d346eebec8c3aa8640edf2e1e7e1f45d7a28af23719b1a8b925c85

    SHA512

    eec7aed2168ca929e8455e76a64082bb545145e37d84dd173eb5500f16ab8cd29724f27344d6cf49f6fcc0e0428a6936af55603f34ca8f4f46c693415cc8d63a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\._cache_971b5e84c8f1244ecee167dbce3b0007fb988c5676d6fae10c2dd2d1b85454bd.exe
    MD5

    88cd3369ceb3a4e22fd54a852fd4258d

    SHA1

    18a7e0eb41eb6dbf9314a7f472d4d60210142e5f

    SHA256

    f0fd284e05d346eebec8c3aa8640edf2e1e7e1f45d7a28af23719b1a8b925c85

    SHA512

    eec7aed2168ca929e8455e76a64082bb545145e37d84dd173eb5500f16ab8cd29724f27344d6cf49f6fcc0e0428a6936af55603f34ca8f4f46c693415cc8d63a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\6QcS5fr3.xlsm
    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit
  • memory/672-114-0x0000000002E90000-0x0000000002E91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1460-124-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1460-126-0x00000000001D0000-0x00000000001F3000-memory.dmp
    Filesize

    140KB

    Download
  • memory/1460-115-0x0000000000000000-mapping.dmp
    Download
  • memory/1460-123-0x00000000001F0000-0x00000000001F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1460-125-0x0000000000400000-0x0000000001EDE000-memory.dmp
    Filesize

    26.9MB

    Download
  • memory/2896-118-0x0000000000000000-mapping.dmp
    Download
  • memory/2896-121-0x00000000005E0000-0x000000000072A000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3380-130-0x00007FF8ACF90000-0x00007FF8ACFA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3380-122-0x00007FF61D840000-0x00007FF620DF6000-memory.dmp
    Filesize

    53.7MB

    Download
  • memory/3380-127-0x00007FF8ACF90000-0x00007FF8ACFA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3380-128-0x00007FF8ACF90000-0x00007FF8ACFA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3380-129-0x00007FF8ACF90000-0x00007FF8ACFA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3380-135-0x00007FF8CB310000-0x00007FF8CD205000-memory.dmp
    Filesize

    31.0MB

    Download
  • memory/3380-131-0x00007FF8ACF90000-0x00007FF8ACFA0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3380-134-0x00007FF8CDDF0000-0x00007FF8CEEDE000-memory.dmp
    Filesize

    16.9MB

    Download