Analysis

  • max time kernel
    50s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    08-04-2022 07:15

General

  • Target

    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

  • Size

    131KB

  • MD5

    c4f79edc4498c5570495bb36fc942134

  • SHA1

    00046b588252502480e8e708a22d25ae1d9b05fa

  • SHA256

    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

  • SHA512

    07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

Malware Config

Extracted

Family

blacknet

Version

v3.5 Public

Botnet

HacKed

C2

http://finalb.xyz/NiggaNet

Mutex

BN[RqfcWolJ-7232457]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    df7427b5e05183e625345c3c37ef31c0

  • startup

    true

  • usb_spread

    true

aes.plain

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • BlackNET Payload 17 IoCs
  • Contains code to disable Windows Defender 17 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1736
    • C:\Users\Admin\AppData\Local\Temp\svchosts.exe
      "C:\Users\Admin\AppData\Local\Temp\svchosts.exe"
      2⤵
        PID:1132
        • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
          "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
          3⤵
            PID:960
            • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
              4⤵
                PID:1716
            • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
              "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
              3⤵
                PID:1208
              • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                3⤵
                  PID:240
                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                  "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                  3⤵
                    PID:1740
                  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                    3⤵
                      PID:660
                    • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                      "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                      3⤵
                        PID:2028
                      • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                        "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                        3⤵
                          PID:960
                        • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                          "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                          3⤵
                            PID:884
                          • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                            "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                            3⤵
                              PID:1996
                            • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                              3⤵
                                PID:1560
                              • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                                "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                                3⤵
                                  PID:1316
                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                                  3⤵
                                    PID:1696
                                  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                                    3⤵
                                      PID:1744

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Local\Temp\svchosts.exe

                                  Filesize

                                  17KB

                                  MD5

                                  89dd6e72358a669b7d6e2348307a7af7

                                  SHA1

                                  0db348f3c6114a45d71f4d218e0e088b71c7bb0a

                                  SHA256

                                  ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

                                  SHA512

                                  93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

                                • C:\Users\Admin\AppData\Local\Temp\svchosts.exe

                                  Filesize

                                  17KB

                                  MD5

                                  89dd6e72358a669b7d6e2348307a7af7

                                  SHA1

                                  0db348f3c6114a45d71f4d218e0e088b71c7bb0a

                                  SHA256

                                  ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

                                  SHA512

                                  93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

                                • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

                                  Filesize

                                  131KB

                                  MD5

                                  c4f79edc4498c5570495bb36fc942134

                                  SHA1

                                  00046b588252502480e8e708a22d25ae1d9b05fa

                                  SHA256

                                  b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

                                  SHA512

                                  07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

                                • memory/240-130-0x0000000000000000-mapping.dmp

                                • memory/240-132-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/240-133-0x0000000002066000-0x0000000002085000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/660-147-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/660-145-0x0000000000000000-mapping.dmp

                                • memory/884-161-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/884-159-0x0000000000000000-mapping.dmp

                                • memory/960-107-0x0000000000AE5000-0x0000000000AF0000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/960-111-0x000000001DC39000-0x000000001DC41000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/960-156-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/960-119-0x0000000000ADD000-0x0000000000AE4000-memory.dmp

                                  Filesize

                                  28KB

                                • memory/960-118-0x0000000000A9C000-0x0000000000AA7000-memory.dmp

                                  Filesize

                                  44KB

                                • memory/960-117-0x0000000000AB1000-0x0000000000AB6000-memory.dmp

                                  Filesize

                                  20KB

                                • memory/960-116-0x0000000000AAA000-0x0000000000AAF000-memory.dmp

                                  Filesize

                                  20KB

                                • memory/960-97-0x000000001DC71000-0x000000001DC81000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/960-98-0x0000000000AAE000-0x0000000000AB0000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/960-99-0x0000000000AB7000-0x0000000000AB9000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/960-100-0x0000000000AB9000-0x0000000000ABB000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/960-91-0x0000000000000000-mapping.dmp

                                • memory/960-101-0x0000000000ABD000-0x0000000000AC1000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/960-93-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/960-94-0x0000000000A70000-0x0000000000A72000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/960-95-0x0000000000A76000-0x0000000000A95000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/960-96-0x0000000000AAC000-0x0000000000AAE000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/960-113-0x000000001DC51000-0x000000001DC61000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/960-112-0x000000001DC41000-0x000000001DC51000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/960-114-0x000000001DC61000-0x000000001DC71000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/960-115-0x000000001DC81000-0x000000001DC91000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/960-154-0x0000000000000000-mapping.dmp

                                • memory/960-110-0x000000001DC31000-0x000000001DC39000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/960-109-0x000000001DC29000-0x000000001DC31000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/960-108-0x000000001DC10000-0x000000001DC19000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/960-103-0x0000000000ACD000-0x0000000000AD1000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/960-106-0x0000000000ADD000-0x0000000000AE5000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/960-105-0x0000000000AD9000-0x0000000000ADD000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/960-104-0x0000000000AD5000-0x0000000000AD9000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/960-102-0x0000000000AC9000-0x0000000000ACD000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/1132-88-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1132-85-0x0000000000000000-mapping.dmp

                                • memory/1132-90-0x0000000000AD6000-0x0000000000AF5000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1132-89-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1208-129-0x0000000000AF6000-0x0000000000B15000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1208-128-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1208-126-0x0000000000000000-mapping.dmp

                                • memory/1316-174-0x0000000000000000-mapping.dmp

                                • memory/1316-176-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1560-171-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1560-169-0x0000000000000000-mapping.dmp

                                • memory/1696-179-0x0000000000000000-mapping.dmp

                                • memory/1696-181-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1716-141-0x000000000097B000-0x000000000097D000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1716-124-0x0000000000930000-0x0000000000932000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1716-125-0x0000000000936000-0x0000000000955000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1716-123-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1716-120-0x0000000000000000-mapping.dmp

                                • memory/1716-142-0x000000000097D000-0x0000000000981000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/1716-140-0x0000000000977000-0x0000000000979000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1716-139-0x000000000096E000-0x0000000000970000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1716-138-0x000000000096C000-0x000000000096E000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1736-83-0x0000000002180000-0x0000000002182000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1736-79-0x0000000000000000-mapping.dmp

                                • memory/1736-82-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1736-84-0x0000000002186000-0x00000000021A5000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1740-134-0x0000000000000000-mapping.dmp

                                • memory/1740-136-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1740-137-0x0000000001EA6000-0x0000000001EC5000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1744-184-0x0000000000000000-mapping.dmp

                                • memory/1744-186-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1996-166-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1996-164-0x0000000000000000-mapping.dmp

                                • memory/2028-150-0x0000000000000000-mapping.dmp

                                • memory/2028-152-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2032-76-0x0000000000B45000-0x0000000000B48000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/2032-64-0x0000000000B3B000-0x0000000000B3D000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-73-0x0000000000B1C000-0x0000000000B26000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2032-74-0x0000000000B51000-0x0000000000B55000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-71-0x0000000000B38000-0x0000000000B3A000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-70-0x0000000000B37000-0x0000000000B3A000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/2032-69-0x0000000000B31000-0x0000000000B34000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/2032-68-0x0000000000B49000-0x0000000000B4D000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-67-0x0000000000B45000-0x0000000000B49000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-60-0x0000000000B33000-0x0000000000B35000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-75-0x0000000000B1B000-0x0000000000B1D000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-61-0x0000000000B35000-0x0000000000B37000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-55-0x0000000000AF0000-0x0000000000AF2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-72-0x0000000000B29000-0x0000000000B2F000-memory.dmp

                                  Filesize

                                  24KB

                                • memory/2032-66-0x0000000000B41000-0x0000000000B45000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-65-0x0000000000B3D000-0x0000000000B41000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-63-0x0000000000B39000-0x0000000000B3B000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-62-0x0000000000B37000-0x0000000000B39000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-59-0x0000000000B31000-0x0000000000B33000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-58-0x0000000000B2E000-0x0000000000B30000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-57-0x0000000000B2C000-0x0000000000B2E000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2032-56-0x0000000000AF6000-0x0000000000B15000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/2032-77-0x0000000000B38000-0x0000000000B3C000-memory.dmp

                                  Filesize

                                  16KB

                                • memory/2032-54-0x000007FEF1DF0000-0x000007FEF2E86000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2032-78-0x0000000000B31000-0x0000000000B33000-memory.dmp

                                  Filesize

                                  8KB