ff1d55a3e2659aa81ee4bb693bdfaa42119fda8e3c4c043ee2d39357e6ca7eac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ɼ/application/WechatDownload.exe
Size

2.8MB
MD5

409ea08b9476c432eca16322d84b83a3
SHA1

5fe40f5d80a411fa230406bae79429f01e3a1b53
SHA256

2abb7ba2d2af2d382993589fc7a032240abf04de33dea32f0affa240865c8c9a
SHA512

6869ab8ac2909f7dcecf951867cf58bb8ad4ba6a0ae7fd979767c5fb7a1987703f2902a61adeb0000409b698722891cf7be7c32859172743622bd164c94eefaf
SSDEEP

49152:3Y5Wa90q29v0MlNXhM/av/bRsVNNL0237sjOr+k96HloClPqsQ0w:3YINX9PRMo/birNL02L+k98loClPI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
32	msedge.exe
32	msedge.exe
1148	identity_helper.exe
1148	identity_helper.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	WechatDownload.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 32	3616	WechatDownload.exe	86
PID 3616 wrote to memory of 32	3616	WechatDownload.exe	86
PID 32 wrote to memory of 416	32	msedge.exe	87
PID 32 wrote to memory of 416	32	msedge.exe	87
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4348	32	msedge.exe	91
PID 32 wrote to memory of 4884	32	msedge.exe	90
PID 32 wrote to memory of 4884	32	msedge.exe	90
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92
PID 32 wrote to memory of 4464	32	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\ɼ\application\WechatDownload.exe
"C:\Users\Admin\AppData\Local\Temp\ɼ\application\WechatDownload.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://i.ijrou.com/?
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6d6a46f8,0x7fff6d6a4708,0x7fff6d6a4718
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12197659974802034344,18287471980160191551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2dd32c0b14d726be7e4ca8600dc8b7fe

SHA1
fe02efc2428f8ea3d7054ef39f1e5311353cc9c8

SHA256
b9f89757748530a21124c0bea667708cba9837a66e8d360aa54a09ba64e6d19b

SHA512
f92e10e448cb622a626cf4254081df13dfcdc7cf699cdf931d781e0d1ec754eab9ebea36585a5243a2f643ea31df3ad60ea8e00d52eec63dcb02053c0fae8b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
804B

MD5
481461ece918c61917d51f3273a817e7

SHA1
5b56a4e83e06ca7c1ab2542581dbc05318dceb42

SHA256
cd6596e4bd5d32c7c063a55a29afe96fee687ea0e4527a277ebf89277019fd68

SHA512
3e7e3a559f92364b9ab24317850298a18816a044c5a0ac76dc38c8d6f2273242d87fcd1dd045009df4d91b7fd9573d1d8c059317ee5469cda69db0cd45935f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff06d729b5c3110536a898bc8a4d1820

SHA1
711261ba7fc00015fc87a5d3c51754e47ff4f669

SHA256
b1a8b7faca3e10ff8916dab6d3a1632ff96ec059d4577da8884753807db4b82c

SHA512
f54e13055260bd93b06925adba6e0c556e434d8e0936c333d0a3d35585901a3909dc264f6d6c7e10cbca5eb0e12ab8055511a4a34ab550da07464e0e6d12915c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfc88631-0c13-4074-bd47-475044730261.tmp

Filesize
5KB

MD5
b3fcd7f1cca0f0e04a951d7d0e613587

SHA1
668d72b730493cf8064e4507b497d6dfdb8af226

SHA256
e14e60067e88ebd134a95676c9cf7b939de91c872981bc73e42aca1d00ff80da

SHA512
59075f43b7071f2d934cae0a4d464d193232aaa639e9803599a52c475922237ff88df425b081ad105e82c1f73f92befaa99760f6cd8d094a6ad8f5fa464d09cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2459a007023421d4e561e0d5899ccc1e

SHA1
e9e411d955250c6fe4c950bd3d5ef8ad4d6ee931

SHA256
7c874c359302b5b3b66951b043af31b9fa9806eb239fe8242c30464ce4beb06f

SHA512
ba5630d74f5cc08f579da373861ab9f887858655892fa0a219cfc95cfb309c431724729666ce5a529bdc817392eafd19af9ded26727433b6ef2b7c7510c765c4

Download Submit
memory/3616-57-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-63-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-7-0x0000020079D40000-0x0000020079D4A000-memory.dmp

Filesize
40KB

Download
memory/3616-47-0x00007FFF73BB0000-0x00007FFF74671000-memory.dmp

Filesize
10.8MB

Download
memory/3616-6-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-9-0x0000020076D90000-0x0000020076DB2000-memory.dmp

Filesize
136KB

Download
memory/3616-62-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-8-0x0000020076DF0000-0x0000020076EA0000-memory.dmp

Filesize
704KB

Download
memory/3616-0-0x0000020073B70000-0x0000020073E3C000-memory.dmp

Filesize
2.8MB

Download
memory/3616-5-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-4-0x00000200773F0000-0x000002007763A000-memory.dmp

Filesize
2.3MB

Download
memory/3616-3-0x0000020077160000-0x00000200771F0000-memory.dmp

Filesize
576KB

Download
memory/3616-2-0x0000020076380000-0x0000020076390000-memory.dmp

Filesize
64KB

Download
memory/3616-1-0x00007FFF73BB0000-0x00007FFF74671000-memory.dmp

Filesize
10.8MB

Download