Overview

overview

8

Static

static

3

2023-08-26...JC.exe

windows7-x64

8

2023-08-26...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    121s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 05:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-26_d0970cd90cba7049a4528b788d3e6fef_mafia_JC.exe

  • Size

    2.7MB

  • MD5

    d0970cd90cba7049a4528b788d3e6fef

  • SHA1

    d7d572cbdd6a19eaa8f7af618e4868f8febc4ea3

  • SHA256

    abbac38f625193762d1f5a626043019147cc02c01eb5d4adf1a66afb62e94048

  • SHA512

    e71e2c1771bdeca84a654eb044aa1a9289f4d89ea0a6d9425efe2d582f909462c90ac5b7242a641d57299b14757f87fe57fe207ffcc0626dac14f9e18684bc0c

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlpy5GjDNl1:c+8X9G3vP3AMQGj1

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-26_d0970cd90cba7049a4528b788d3e6fef_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-26_d0970cd90cba7049a4528b788d3e6fef_mafia_JC.exe"
    1⤵
      PID:3212
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3420
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4896
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1060
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3628
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1208
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4560
    • C:\Windows\system32\werfault.exe
      werfault.exe /hc /shared Global\e7865bcb69694121bcf4b12a0aa22c2b /t 4728 /p 1204
      1⤵
        PID:1560
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4976
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3340
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3484
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4108
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:5096
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3188
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3088
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1736
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:916
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1420
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:448
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2296
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3380
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4572
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1336

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                  Filesize

                  471B

                  MD5

                  0085711bef17acad9eacf0bbf9bf3906

                  SHA1

                  20041eb81473c406da0ebfd7717231c0852ba344

                  SHA256

                  98c31705ae2dbde79cc8916db28c40c875597004ae24d94ac42433e0989d70a1

                  SHA512

                  3354239703701d843124bc466fd9794dd65ed766e4a1df64f784250292be3f24239a9e7156738d07a1c12316952cc1ee71ae9feba9b8fdbfb545e273ae871a6e

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                  Filesize

                  412B

                  MD5

                  8fb694ee507916e31d8134782db37d50

                  SHA1

                  5b5ef5ec0a21f98c643880359d2b4da8e277ab3c

                  SHA256

                  78eae06d284e65cea714796d825986fe7e1f174cfd4dfb313e1ef422be3191ec

                  SHA512

                  2131e1a5c1618f1eae60cea6cc4f9d075dc6e8a603024d2073e5460c199dece3bbb073634f29b6ed45b1c0d99cf1ef0ef79881fa21461b7f99cf67a8ae60024e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133414773043189795.txt
                  Filesize

                  75KB

                  MD5

                  62d81c2e1e8b21733f95af2a596e4b18

                  SHA1

                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                  SHA256

                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                  SHA512

                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133414773043189795.txt
                  Filesize

                  75KB

                  MD5

                  62d81c2e1e8b21733f95af2a596e4b18

                  SHA1

                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                  SHA256

                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                  SHA512

                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  82b066a0c26e9c3c026d421e012a093e

                  SHA1

                  2e4493ff239034dd93befa48a286616fa1222526

                  SHA256

                  a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                  SHA512

                  4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                  Download Submit

                • memory/448-124-0x0000014C74F50000-0x0000014C74F70000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/448-120-0x0000014C74B80000-0x0000014C74BA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/448-122-0x0000014C74B40000-0x0000014C74B60000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1060-14-0x0000017EE3EF0000-0x0000017EE3F10000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1060-12-0x0000017EE3A70000-0x0000017EE3A90000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1060-10-0x0000017EE3AE0000-0x0000017EE3B00000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1060-24-0x00000186F62A0000-0x00000186F63A0000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/1336-214-0x0000020276D80000-0x0000020276DA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1336-212-0x0000020276970000-0x0000020276990000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1336-210-0x00000202769B0000-0x00000202769D0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1420-102-0x000001976AE20000-0x000001976AE40000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1420-105-0x000001976B230000-0x000001976B250000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1420-99-0x000001976AE60000-0x000001976AE80000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2296-148-0x0000020DB5D90000-0x0000020DB5DB0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2296-142-0x0000020DB5A60000-0x0000020DB5A80000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2296-145-0x0000020DB5A20000-0x0000020DB5A40000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3088-84-0x0000024318AD0000-0x0000024318AF0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3088-80-0x00000243183C0000-0x00000243183E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3088-78-0x0000024318700000-0x0000024318720000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3340-56-0x0000021F844A0000-0x0000021F844C0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3340-54-0x0000021F83E80000-0x0000021F83EA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3340-53-0x0000021F83EC0000-0x0000021F83EE0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3380-169-0x0000019FE9440000-0x0000019FE9460000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3380-171-0x0000019FE9850000-0x0000019FE9870000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3380-167-0x0000019FE9480000-0x0000019FE94A0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4560-45-0x0000000004480000-0x0000000004481000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4572-185-0x00000282700D0000-0x00000282700F0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4572-188-0x0000028270090000-0x00000282700B0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4572-190-0x00000282706A0000-0x00000282706C0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5096-70-0x0000000003F60000-0x0000000003F61000-memory.dmp

                  Filesize

                  4KB

                  Download