Analysis

  • max time kernel
    25s
  • max time network
    56s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-11-2022 11:39

General

  • Target

    1877.exe

  • Size

    1.0MB

  • MD5

    fd9cbccbd2803786c5ea2bf54b22d693

  • SHA1

    97b675207f5679503f89096e7ae99b38b1bea382

  • SHA256

    0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

  • SHA512

    900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

  • SSDEEP

    24576:1LY5kMJDyGouUqg75HVDBvdJ9x5LESqRel+kvujSZGp:x4kMJDyGouUqg75HVDBvdzESqRelDvuc

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

1877

C2

overthinker1877.duckdns.org:4545

Mutex

xiBqon3YI4gHicsPTt

Attributes
  • encryption_key

    IshCdNN3oYnjATmMydkq

  • install_name

    1877.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 18 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1877.exe
    "C:\Users\Admin\AppData\Local\Temp\1877.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Program Files (x86)\1877.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:3360
    • C:\Program Files (x86)\1877.exe
      "C:\Program Files (x86)\1877.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Venom Client Startup" /sc ONLOGON /tr "C:\Program Files (x86)\1877.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2656
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Execution.vbs
        3⤵
          PID:3300
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution2.vbs"
          3⤵
            PID:3308
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution5.vbs"
            3⤵
            • Checks computer location settings
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1584
            • C:\Program Files (x86)\1877.exe
              "C:\Program Files (x86)\1877.exe"
              4⤵
                PID:4440
              • C:\Program Files (x86)\1877.exe
                "C:\Program Files (x86)\1877.exe"
                4⤵
                  PID:1712
                • C:\Program Files (x86)\1877.exe
                  "C:\Program Files (x86)\1877.exe"
                  4⤵
                    PID:2388
                  • C:\Program Files (x86)\1877.exe
                    "C:\Program Files (x86)\1877.exe"
                    4⤵
                      PID:948
                    • C:\Program Files (x86)\1877.exe
                      "C:\Program Files (x86)\1877.exe"
                      4⤵
                        PID:420
                      • C:\Program Files (x86)\1877.exe
                        "C:\Program Files (x86)\1877.exe"
                        4⤵
                          PID:1600
                        • C:\Program Files (x86)\1877.exe
                          "C:\Program Files (x86)\1877.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:4440
                        • C:\Program Files (x86)\1877.exe
                          "C:\Program Files (x86)\1877.exe"
                          4⤵
                            PID:3784
                          • C:\Program Files (x86)\1877.exe
                            "C:\Program Files (x86)\1877.exe"
                            4⤵
                              PID:3840
                            • C:\Program Files (x86)\1877.exe
                              "C:\Program Files (x86)\1877.exe"
                              4⤵
                                PID:948
                              • C:\Program Files (x86)\1877.exe
                                "C:\Program Files (x86)\1877.exe"
                                4⤵
                                  PID:1284
                                • C:\Program Files (x86)\1877.exe
                                  "C:\Program Files (x86)\1877.exe"
                                  4⤵
                                    PID:4852
                                  • C:\Program Files (x86)\1877.exe
                                    "C:\Program Files (x86)\1877.exe"
                                    4⤵
                                      PID:4804
                                    • C:\Program Files (x86)\1877.exe
                                      "C:\Program Files (x86)\1877.exe"
                                      4⤵
                                        PID:3812
                                      • C:\Program Files (x86)\1877.exe
                                        "C:\Program Files (x86)\1877.exe"
                                        4⤵
                                          PID:4976
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iHT2Za5wXleF.bat" "
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:424
                                      • C:\Windows\SysWOW64\chcp.com
                                        chcp 65001
                                        3⤵
                                          PID:3880
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping -n 10 localhost
                                          3⤵
                                          • Runs ping.exe
                                          PID:5004
                                    • C:\Windows\explorer.exe
                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4284
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Execution.vbs"
                                        2⤵
                                        • Adds Run key to start application
                                        PID:4692

                                    Network

                                    MITRE ATT&CK Matrix ATT&CK v6

                                    Execution

                                    Scheduled Task

                                    1
                                    T1053

                                    Persistence

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1060

                                    Scheduled Task

                                    1
                                    T1053

                                    Privilege Escalation

                                    Scheduled Task

                                    1
                                    T1053

                                    Defense Evasion

                                    Modify Registry

                                    1
                                    T1112

                                    Discovery

                                    Query Registry

                                    1
                                    T1012

                                    System Information Discovery

                                    2
                                    T1082

                                    Remote System Discovery

                                    1
                                    T1018

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Program Files (x86)\1877.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      fd9cbccbd2803786c5ea2bf54b22d693

                                      SHA1

                                      97b675207f5679503f89096e7ae99b38b1bea382

                                      SHA256

                                      0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

                                      SHA512

                                      900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

                                    • C:\Users\Admin\AppData\Local\Execution.vbs
                                      Filesize

                                      398B

                                      MD5

                                      8364b6232798be3f9097c309cc7f5eb9

                                      SHA1

                                      d20fdc49824a5983b39f2274a795b85d4e051720

                                      SHA256

                                      3c36660c9dcfe796d26ff9388e25427e636bb2caf4aeea59531b5b55daf74ca1

                                      SHA512

                                      2cbfaeb7807fe219fc6f663f0fbbc313fbb1e56b713d0084eb4c31f241ded4b9117e06254299a0a8e481a0aa6cd8c639cbdcdb14d732636755d26fe2c5ef947f

                                    • C:\Users\Admin\AppData\Local\Execution2.vbs
                                      Filesize

                                      715B

                                      MD5

                                      06a0c4e556a181467dcb1905d75b3315

                                      SHA1

                                      595c5bd8b5e1f8eb5c6311b177b220a6794d29f7

                                      SHA256

                                      4f8c00fbc3aedc46a307bd55faaada56f92ee73ab8a43da7bfca44a58484aa2f

                                      SHA512

                                      d2a8d137598072735eb124f2b8170357edaff5af9d8e67ba5be202b597dc1041fa48198c7a553482de46887b11ace1052c9c0c8ce9068beb3bc5d5b18cd42fad

                                    • C:\Users\Admin\AppData\Local\Execution5.vbs
                                      Filesize

                                      444B

                                      MD5

                                      7d38aaad93decc85f2ed1656a12e7766

                                      SHA1

                                      5b50955778acf93b44b1551b0719bad9d60e61b5

                                      SHA256

                                      10dfa4af44209b83419b1c71a992196bf340b9c818a4997f7411042485e4c115

                                      SHA512

                                      26f048b869bf09ab29b9e1ddc7e4997b9e27d4662fae9e7b928c9206284d462f1d89c66bd4e5453b77aa507e20c1c3fe9293a6024bc5a36f4ac45ce4f78adf91

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1877.exe.log
                                      Filesize

                                      1KB

                                      MD5

                                      4bca262ae8f262a79e844c7942cded56

                                      SHA1

                                      b99c8e6661a2a1c20b5a1ba10eab1fa40742a4cf

                                      SHA256

                                      1f1d4725d46f3e73b1778d508681552f66154520cf9da27752289faedf63bbf8

                                      SHA512

                                      3bf43bb20757d12938658c86ac8ac197b390000a3baa954150144b601c8e902dcccd5f23e009af7d817fd434572c5fbe438e6a38bf97328f349ddb62e40d9d1e

                                    • C:\Users\Admin\AppData\Local\Temp\iHT2Za5wXleF.bat
                                      Filesize

                                      201B

                                      MD5

                                      82a455a28057d901deb987ab0f723b4f

                                      SHA1

                                      ad9294c271d9c5bc59677224cd7eff431d4f3c8e

                                      SHA256

                                      f584ef19e33610486e612c1ff0c73a603fa2d11b611581d28cad41647417fbfc

                                      SHA512

                                      9db4650ef61a19fd16783c1f4bbde5e20af8509b71d232150f2a5e934eacfd0999f2a66508f8f8f698b1b902dfbbd2fdaebdf3b7fbba7e058d7d358f756b58da

                                    • memory/420-904-0x0000000000000000-mapping.dmp
                                    • memory/424-280-0x0000000000000000-mapping.dmp
                                    • memory/948-825-0x0000000000000000-mapping.dmp
                                    • memory/948-1301-0x0000000000000000-mapping.dmp
                                    • memory/1284-1378-0x0000000000000000-mapping.dmp
                                    • memory/1584-400-0x0000000000000000-mapping.dmp
                                    • memory/1600-983-0x0000000000000000-mapping.dmp
                                    • memory/1712-667-0x0000000000000000-mapping.dmp
                                    • memory/2388-746-0x0000000000000000-mapping.dmp
                                    • memory/2656-353-0x0000000000000000-mapping.dmp
                                    • memory/3300-380-0x0000000000000000-mapping.dmp
                                    • memory/3308-384-0x0000000000000000-mapping.dmp
                                    • memory/3360-198-0x0000000000000000-mapping.dmp
                                    • memory/3784-1138-0x0000000000000000-mapping.dmp
                                    • memory/3812-1626-0x0000000000000000-mapping.dmp
                                    • memory/3840-1219-0x0000000000000000-mapping.dmp
                                    • memory/3880-296-0x0000000000000000-mapping.dmp
                                    • memory/4300-516-0x0000000007390000-0x000000000739A000-memory.dmp
                                      Filesize

                                      40KB

                                    • memory/4300-218-0x0000000000000000-mapping.dmp
                                    • memory/4328-147-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-151-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-161-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-162-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-163-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-164-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-165-0x0000000005480000-0x00000000054E6000-memory.dmp
                                      Filesize

                                      408KB

                                    • memory/4328-166-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-167-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-168-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-169-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-170-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-171-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-172-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-173-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-174-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-175-0x0000000006010000-0x0000000006022000-memory.dmp
                                      Filesize

                                      72KB

                                    • memory/4328-176-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-177-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-178-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-179-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-180-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-181-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-182-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-183-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-184-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-185-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-186-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-196-0x00000000063E0000-0x000000000641E000-memory.dmp
                                      Filesize

                                      248KB

                                    • memory/4328-159-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-158-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-157-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-222-0x00000000064F0000-0x000000000658C000-memory.dmp
                                      Filesize

                                      624KB

                                    • memory/4328-156-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-155-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-154-0x00000000052B0000-0x0000000005342000-memory.dmp
                                      Filesize

                                      584KB

                                    • memory/4328-153-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-119-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-152-0x00000000056F0000-0x0000000005BEE000-memory.dmp
                                      Filesize

                                      5.0MB

                                    • memory/4328-160-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-150-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-149-0x0000000000940000-0x0000000000A50000-memory.dmp
                                      Filesize

                                      1.1MB

                                    • memory/4328-148-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-118-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-146-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-145-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-120-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-144-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-121-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-143-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-142-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-141-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-140-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-139-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-138-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-137-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-136-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-135-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-134-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-133-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-122-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-132-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-131-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-130-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-129-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-128-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-127-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-126-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-125-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-124-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4328-123-0x00000000776D0000-0x000000007785E000-memory.dmp
                                      Filesize

                                      1.6MB

                                    • memory/4440-1060-0x0000000000000000-mapping.dmp
                                    • memory/4440-596-0x0000000000000000-mapping.dmp
                                    • memory/4692-558-0x0000000000000000-mapping.dmp
                                    • memory/4804-1547-0x0000000000000000-mapping.dmp
                                    • memory/4852-1457-0x0000000000000000-mapping.dmp
                                    • memory/4976-1705-0x0000000000000000-mapping.dmp
                                    • memory/5004-312-0x0000000000000000-mapping.dmp