71800e871e5ba0e16662a63adde65180a7353a75e5f63c9970f12162854c876b

Analysis

max time kernel
31s
max time network
21s
platform
windows7_x64
resource
win7-20230831-de
resource tags

arch:x64arch:x86image:win7-20230831-delocale:de-deos:windows7-x64systemwindows
submitted
03/10/2023, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSE ACTlVATlON - TrendingBot.bat
Size

199KB
MD5

10fffe8df427eed52e2ced1b71c47dec
SHA1

fc065b23dcf2047050033dc5cb8c9f46fe83c8ee
SHA256

71800e871e5ba0e16662a63adde65180a7353a75e5f63c9970f12162854c876b
SHA512

56e48bcfe2df01ab0df27ebf41caea8a66c6af2408d443a1595e646472da3483adfd3526580583a4f7761f43bcf0e770a74e35fb09022bd1b2cebec866023144
SSDEEP

3072:CbWXLnN1afKn4viIH5pF6eU6qXpHMfAa4dZ5ni4jiHiZSl/Z0G3c43X1a8yJEok5:7N16OKiUpFG6exa4HBi23Qc943Qp6QG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2704	powershell.exe
2248	powershell.exe
2880	powershell.exe
2544	powershell.exe
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2624	2576	cmd.exe	29
PID 2576 wrote to memory of 2624	2576	cmd.exe	29
PID 2576 wrote to memory of 2624	2576	cmd.exe	29
PID 2576 wrote to memory of 2632	2576	cmd.exe	30
PID 2576 wrote to memory of 2632	2576	cmd.exe	30
PID 2576 wrote to memory of 2632	2576	cmd.exe	30
PID 2576 wrote to memory of 2676	2576	cmd.exe	31
PID 2576 wrote to memory of 2676	2576	cmd.exe	31
PID 2576 wrote to memory of 2676	2576	cmd.exe	31
PID 2576 wrote to memory of 2680	2576	cmd.exe	32
PID 2576 wrote to memory of 2680	2576	cmd.exe	32
PID 2576 wrote to memory of 2680	2576	cmd.exe	32
PID 2576 wrote to memory of 2724	2576	cmd.exe	33
PID 2576 wrote to memory of 2724	2576	cmd.exe	33
PID 2576 wrote to memory of 2724	2576	cmd.exe	33
PID 2576 wrote to memory of 2740	2576	cmd.exe	34
PID 2576 wrote to memory of 2740	2576	cmd.exe	34
PID 2576 wrote to memory of 2740	2576	cmd.exe	34
PID 2576 wrote to memory of 2948	2576	cmd.exe	35
PID 2576 wrote to memory of 2948	2576	cmd.exe	35
PID 2576 wrote to memory of 2948	2576	cmd.exe	35
PID 2576 wrote to memory of 2636	2576	cmd.exe	36
PID 2576 wrote to memory of 2636	2576	cmd.exe	36
PID 2576 wrote to memory of 2636	2576	cmd.exe	36
PID 2576 wrote to memory of 2628	2576	cmd.exe	37
PID 2576 wrote to memory of 2628	2576	cmd.exe	37
PID 2576 wrote to memory of 2628	2576	cmd.exe	37
PID 2576 wrote to memory of 2608	2576	cmd.exe	38
PID 2576 wrote to memory of 2608	2576	cmd.exe	38
PID 2576 wrote to memory of 2608	2576	cmd.exe	38
PID 2576 wrote to memory of 1984	2576	cmd.exe	39
PID 2576 wrote to memory of 1984	2576	cmd.exe	39
PID 2576 wrote to memory of 1984	2576	cmd.exe	39
PID 2576 wrote to memory of 2736	2576	cmd.exe	40
PID 2576 wrote to memory of 2736	2576	cmd.exe	40
PID 2576 wrote to memory of 2736	2576	cmd.exe	40
PID 2576 wrote to memory of 2704	2576	cmd.exe	41
PID 2576 wrote to memory of 2704	2576	cmd.exe	41
PID 2576 wrote to memory of 2704	2576	cmd.exe	41
PID 2576 wrote to memory of 3020	2576	cmd.exe	43
PID 2576 wrote to memory of 3020	2576	cmd.exe	43
PID 2576 wrote to memory of 3020	2576	cmd.exe	43
PID 2576 wrote to memory of 2532	2576	cmd.exe	44
PID 2576 wrote to memory of 2532	2576	cmd.exe	44
PID 2576 wrote to memory of 2532	2576	cmd.exe	44
PID 2576 wrote to memory of 2372	2576	cmd.exe	45
PID 2576 wrote to memory of 2372	2576	cmd.exe	45
PID 2576 wrote to memory of 2372	2576	cmd.exe	45
PID 2576 wrote to memory of 1820	2576	cmd.exe	46
PID 2576 wrote to memory of 1820	2576	cmd.exe	46
PID 2576 wrote to memory of 1820	2576	cmd.exe	46
PID 2576 wrote to memory of 3036	2576	cmd.exe	47
PID 2576 wrote to memory of 3036	2576	cmd.exe	47
PID 2576 wrote to memory of 3036	2576	cmd.exe	47
PID 2576 wrote to memory of 2460	2576	cmd.exe	48
PID 2576 wrote to memory of 2460	2576	cmd.exe	48
PID 2576 wrote to memory of 2460	2576	cmd.exe	48
PID 2576 wrote to memory of 2248	2576	cmd.exe	49
PID 2576 wrote to memory of 2248	2576	cmd.exe	49
PID 2576 wrote to memory of 2248	2576	cmd.exe	49
PID 2576 wrote to memory of 2868	2576	cmd.exe	50
PID 2576 wrote to memory of 2868	2576	cmd.exe	50
PID 2576 wrote to memory of 2868	2576	cmd.exe	50
PID 2576 wrote to memory of 2880	2576	cmd.exe	51

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LICENSE ACTlVATlON - TrendingBot.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$VM=Get-WmiObject -Class Win32_ComputerSystem ; if ($VM.Model -match 'Virtual') { Write-Host 'Virtual Machine Detected. Exiting script.' ; taskkill /F /IM cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$VM=Get-WmiObject -Class Win32_ComputerSystem ; if ($VM.Model -match 'Virtual') { Write-Host 'Virtual Machine Detected. Exiting script.' ; taskkill /F /IM cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$VM=Get-WmiObject -Class Win32_ComputerSystem ; if ($VM.Model -match 'Virtual') { Write-Host 'Virtual Machine Detected. Exiting script.' ; taskkill /F /IM cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$VM=Get-WmiObject -Class Win32_ComputerSystem ; if ($VM.Model -match 'Virtual') { Write-Host 'Virtual Machine Detected. Exiting script.' ; taskkill /F /IM cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2848
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$VM=Get-WmiObject -Class Win32_ComputerSystem ; if ($VM.Model -match 'Virtual') { Write-Host 'Virtual Machine Detected. Exiting script.' ; taskkill /F /IM cmd.exe }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b
  2⤵
  PID:2260
- C:\Windows\system32\wscript.exe
  wscript /b
  2⤵
  PID:1296
- C:\Windows\system32\forfiles.exe
  forfiles /p C:\Users\Admin\AppData\Local\Temp /m RAT.exe /c 'cmd /c start @file'
  2⤵
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be873d8aa205202d6bb1b6edfa9c3170

SHA1
dbf5261adb675860aa1e37003e750d1285e3cdb6

SHA256
ea4c0ecee5dcc1a21afd27584c5e1a250b99f2ddc08eec62315d87692f0915ce

SHA512
7118d20dc062eedd4a96d96d326b1aa9404028eef97d3dad712341fb1074035382909c56a7ee83aec569725c1986aa45f8138c636613ca9c52cc34ecf6219926

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be873d8aa205202d6bb1b6edfa9c3170

SHA1
dbf5261adb675860aa1e37003e750d1285e3cdb6

SHA256
ea4c0ecee5dcc1a21afd27584c5e1a250b99f2ddc08eec62315d87692f0915ce

SHA512
7118d20dc062eedd4a96d96d326b1aa9404028eef97d3dad712341fb1074035382909c56a7ee83aec569725c1986aa45f8138c636613ca9c52cc34ecf6219926

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be873d8aa205202d6bb1b6edfa9c3170

SHA1
dbf5261adb675860aa1e37003e750d1285e3cdb6

SHA256
ea4c0ecee5dcc1a21afd27584c5e1a250b99f2ddc08eec62315d87692f0915ce

SHA512
7118d20dc062eedd4a96d96d326b1aa9404028eef97d3dad712341fb1074035382909c56a7ee83aec569725c1986aa45f8138c636613ca9c52cc34ecf6219926

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be873d8aa205202d6bb1b6edfa9c3170

SHA1
dbf5261adb675860aa1e37003e750d1285e3cdb6

SHA256
ea4c0ecee5dcc1a21afd27584c5e1a250b99f2ddc08eec62315d87692f0915ce

SHA512
7118d20dc062eedd4a96d96d326b1aa9404028eef97d3dad712341fb1074035382909c56a7ee83aec569725c1986aa45f8138c636613ca9c52cc34ecf6219926

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MZ4GWKEYOQ2E9M28AZU0.temp

Filesize
7KB

MD5
be873d8aa205202d6bb1b6edfa9c3170

SHA1
dbf5261adb675860aa1e37003e750d1285e3cdb6

SHA256
ea4c0ecee5dcc1a21afd27584c5e1a250b99f2ddc08eec62315d87692f0915ce

SHA512
7118d20dc062eedd4a96d96d326b1aa9404028eef97d3dad712341fb1074035382909c56a7ee83aec569725c1986aa45f8138c636613ca9c52cc34ecf6219926

Download Submit
memory/2176-72-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-71-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2176-70-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2176-69-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2176-68-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-67-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-33-0x00000000027B0000-0x00000000027B8000-memory.dmp

Filesize
32KB

Download
memory/2248-34-0x0000000002940000-0x0000000002990000-memory.dmp

Filesize
320KB

Download
memory/2248-36-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2248-35-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2248-23-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2248-25-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2248-24-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2248-26-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2248-27-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Filesize
32KB

Download
memory/2248-28-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2248-30-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2248-29-0x0000000002000000-0x000000000200E000-memory.dmp

Filesize
56KB

Download
memory/2248-31-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/2248-32-0x00000000027A0000-0x00000000027AA000-memory.dmp

Filesize
40KB

Download
memory/2544-58-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2544-55-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-61-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-60-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2544-59-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2544-57-0x000007FEF5520000-0x000007FEF5EBD000-memory.dmp

Filesize
9.6MB

Download
memory/2544-56-0x00000000025E0000-0x0000000002660000-memory.dmp

Filesize
512KB

Download
memory/2704-12-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2704-14-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/2704-5-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-6-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/2704-7-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-13-0x0000000002640000-0x000000000264A000-memory.dmp

Filesize
40KB

Download
memory/2704-4-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2704-8-0x0000000002060000-0x000000000206E000-memory.dmp

Filesize
56KB

Download
memory/2704-9-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2704-10-0x00000000027D0000-0x0000000002818000-memory.dmp

Filesize
288KB

Download
memory/2704-17-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2704-11-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2704-16-0x000000001BA80000-0x000000001BAD0000-memory.dmp

Filesize
320KB

Download
memory/2704-15-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2880-45-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2880-42-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2880-43-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2880-44-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2880-48-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2880-47-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/2880-46-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download