Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2023 09:00

General

  • Target

    Roblox-UWP-Executor-main/XYZ.exe

  • Size

    3.1MB

  • MD5

    6798986718c9d923ae747ff1bed1a16f

  • SHA1

    dbf6ebb0b412286ec6007409f15d20c90038528b

  • SHA256

    aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

  • SHA512

    07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

  • SSDEEP

    49152:yvdt62XlaSFNWPjljiFa2RoUYI8lCtBeiLoG/pTHHB72eh2NT:yvf62XlaSFNWPjljiFXRoUYIuCF

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

smirkdns.ddns.net:4782

Mutex

45259779-0dcb-4afe-a014-ae49cf73286e

Attributes
  • encryption_key

    38F8A837013773F52CA41CD4456A32A9B17A9557

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    AustiBlox

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 11 IoCs
  • Executes dropped EXE 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox-UWP-Executor-main\XYZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox-UWP-Executor-main\XYZ.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RSAoVxMgZLOy.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          4⤵
          • Runs ping.exe
          PID:2640
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2576
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1744
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\3Kjaw31GnX6K.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2936
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:2120
                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2468
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\hikiA94lON3j.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:920
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:2912
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:2900
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2184
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\sngyeydey1je.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2960
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:1716
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:1724
                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1768
                              • C:\Windows\system32\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\yK5RFjpXTs8H.bat" "
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2436
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:780
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • Runs ping.exe
                                    PID:1580
                                  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:2236
                                    • C:\Windows\system32\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\8vBqg7QGZtF4.bat" "
                                      13⤵
                                        PID:656
                                        • C:\Windows\system32\chcp.com
                                          chcp 65001
                                          14⤵
                                            PID:1820
                                          • C:\Windows\system32\PING.EXE
                                            ping -n 10 localhost
                                            14⤵
                                            • Runs ping.exe
                                            PID:1616
                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:732
                                            • C:\Windows\system32\cmd.exe
                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\ezULDGz348vO.bat" "
                                              15⤵
                                                PID:2188
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  16⤵
                                                    PID:3068
                                                  • C:\Windows\system32\PING.EXE
                                                    ping -n 10 localhost
                                                    16⤵
                                                    • Runs ping.exe
                                                    PID:608

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\3Kjaw31GnX6K.bat

                      Filesize

                      207B

                      MD5

                      1871a8320768851e9186fc98004489dd

                      SHA1

                      3a6ca8603755cab4fb589ae0609c835be19b31b1

                      SHA256

                      61d7d79eebdae12beb3b7c5be2eec1502ba30bfcab8b44a4bc6a570959bade1f

                      SHA512

                      7c8844ca47f20c66f9fdfd12fe1a58ded3e939d07d43dd896e9235a1f247acd312d35709a6bc3eef4c46b39b3910100aaa700a0694ebd7d36e5911e6fa84f0bc

                    • C:\Users\Admin\AppData\Local\Temp\3Kjaw31GnX6K.bat

                      Filesize

                      207B

                      MD5

                      1871a8320768851e9186fc98004489dd

                      SHA1

                      3a6ca8603755cab4fb589ae0609c835be19b31b1

                      SHA256

                      61d7d79eebdae12beb3b7c5be2eec1502ba30bfcab8b44a4bc6a570959bade1f

                      SHA512

                      7c8844ca47f20c66f9fdfd12fe1a58ded3e939d07d43dd896e9235a1f247acd312d35709a6bc3eef4c46b39b3910100aaa700a0694ebd7d36e5911e6fa84f0bc

                    • C:\Users\Admin\AppData\Local\Temp\8vBqg7QGZtF4.bat

                      Filesize

                      207B

                      MD5

                      8434437cc32b1f56d394b60aa0c47cce

                      SHA1

                      97232301991b661bd04fa038e95e2395e69cc4de

                      SHA256

                      3f0b53016128e1d9562b16e68d13785898cace386fdbee5252b8543f22683fd1

                      SHA512

                      b0c864d02149f84329bafeb58780fc0d39e434e8baec93fc60148c6b8bb70994749988d6721b37e58c804d25a2707bd64a6eb91a3e0a4ebfaadf64c23c0a6127

                    • C:\Users\Admin\AppData\Local\Temp\8vBqg7QGZtF4.bat

                      Filesize

                      207B

                      MD5

                      8434437cc32b1f56d394b60aa0c47cce

                      SHA1

                      97232301991b661bd04fa038e95e2395e69cc4de

                      SHA256

                      3f0b53016128e1d9562b16e68d13785898cace386fdbee5252b8543f22683fd1

                      SHA512

                      b0c864d02149f84329bafeb58780fc0d39e434e8baec93fc60148c6b8bb70994749988d6721b37e58c804d25a2707bd64a6eb91a3e0a4ebfaadf64c23c0a6127

                    • C:\Users\Admin\AppData\Local\Temp\RSAoVxMgZLOy.bat

                      Filesize

                      207B

                      MD5

                      f052318f3a6401964a784adb20b07d4c

                      SHA1

                      4e539e06c17aeac580b98555640bf103227f3d69

                      SHA256

                      b081af4b84a5bb6960bcd75d6e89ba58f3325a7d8b4cd907f31cd5148efb4cd6

                      SHA512

                      1782175c7bb217e1e9d7fc19bac803286e557f68e61e02eeee77f7b83c3497470d94b99c4bcd464c1c7d521a5bdc2fabd3a7d573b7311f0625909469ac0e9cc5

                    • C:\Users\Admin\AppData\Local\Temp\RSAoVxMgZLOy.bat

                      Filesize

                      207B

                      MD5

                      f052318f3a6401964a784adb20b07d4c

                      SHA1

                      4e539e06c17aeac580b98555640bf103227f3d69

                      SHA256

                      b081af4b84a5bb6960bcd75d6e89ba58f3325a7d8b4cd907f31cd5148efb4cd6

                      SHA512

                      1782175c7bb217e1e9d7fc19bac803286e557f68e61e02eeee77f7b83c3497470d94b99c4bcd464c1c7d521a5bdc2fabd3a7d573b7311f0625909469ac0e9cc5

                    • C:\Users\Admin\AppData\Local\Temp\ezULDGz348vO.bat

                      Filesize

                      207B

                      MD5

                      ab4a5d4514ee91bc77f4a4f4da01c75a

                      SHA1

                      622e8dcaddf7aafee6e27283301d706625004f36

                      SHA256

                      24afe8e97776feee77d8e99cdd17e526cb85a6bac2cdb1d982897d8b8804f8e9

                      SHA512

                      03921ece9d6bc7614e62b10d1567b67fd272c4cfb707aa1467df918b59db366e11c4112b85ec4ad04c98aa09e9f5eab01d4d1521c9c0904d64eb599d071f5a7c

                    • C:\Users\Admin\AppData\Local\Temp\ezULDGz348vO.bat

                      Filesize

                      207B

                      MD5

                      ab4a5d4514ee91bc77f4a4f4da01c75a

                      SHA1

                      622e8dcaddf7aafee6e27283301d706625004f36

                      SHA256

                      24afe8e97776feee77d8e99cdd17e526cb85a6bac2cdb1d982897d8b8804f8e9

                      SHA512

                      03921ece9d6bc7614e62b10d1567b67fd272c4cfb707aa1467df918b59db366e11c4112b85ec4ad04c98aa09e9f5eab01d4d1521c9c0904d64eb599d071f5a7c

                    • C:\Users\Admin\AppData\Local\Temp\hikiA94lON3j.bat

                      Filesize

                      207B

                      MD5

                      f2ffde0bf1b48118b2359bcc6ae06d57

                      SHA1

                      7798bbdc58b2442680ca35189d621d7e3acd7e68

                      SHA256

                      7c587adb90c9aea10cbfeb14093054439fe2f4515416f3e60266c78d717c2cf8

                      SHA512

                      2f8550adf712faf0ff126d6acd51f7f1f6c9a10f3f405f8139af5270bc4a26fb86ffa7056db033ba05493b82e7ce1e405ad18e2c40bf69063464c99eb6c9a501

                    • C:\Users\Admin\AppData\Local\Temp\hikiA94lON3j.bat

                      Filesize

                      207B

                      MD5

                      f2ffde0bf1b48118b2359bcc6ae06d57

                      SHA1

                      7798bbdc58b2442680ca35189d621d7e3acd7e68

                      SHA256

                      7c587adb90c9aea10cbfeb14093054439fe2f4515416f3e60266c78d717c2cf8

                      SHA512

                      2f8550adf712faf0ff126d6acd51f7f1f6c9a10f3f405f8139af5270bc4a26fb86ffa7056db033ba05493b82e7ce1e405ad18e2c40bf69063464c99eb6c9a501

                    • C:\Users\Admin\AppData\Local\Temp\sngyeydey1je.bat

                      Filesize

                      207B

                      MD5

                      f9ef5154c5a662fef5e198e8e6e67fc4

                      SHA1

                      5c46023401b067dc222212feb5403d4d11e0d77b

                      SHA256

                      162be2717b979ffd02a590156b5118697b69fd0b703c6148f596f5c39b189869

                      SHA512

                      0f7c82b3dc6eb8070fa21a41eca3f647103237385a75757432107ed8cff828985cf48671eb85233d39f71ae8b8d729016ad5e1c483f0e972cc18d87e0f7e1f3f

                    • C:\Users\Admin\AppData\Local\Temp\sngyeydey1je.bat

                      Filesize

                      207B

                      MD5

                      f9ef5154c5a662fef5e198e8e6e67fc4

                      SHA1

                      5c46023401b067dc222212feb5403d4d11e0d77b

                      SHA256

                      162be2717b979ffd02a590156b5118697b69fd0b703c6148f596f5c39b189869

                      SHA512

                      0f7c82b3dc6eb8070fa21a41eca3f647103237385a75757432107ed8cff828985cf48671eb85233d39f71ae8b8d729016ad5e1c483f0e972cc18d87e0f7e1f3f

                    • C:\Users\Admin\AppData\Local\Temp\yK5RFjpXTs8H.bat

                      Filesize

                      207B

                      MD5

                      21fd7ddf5c05234a989191434e7abef9

                      SHA1

                      d9b7afdf6ed18e9619c1f19e2e6ff522354866dd

                      SHA256

                      33901698c1fc9e7447dfbe279b4829f761699ee8de301ebd705506bfe5747454

                      SHA512

                      576f3495e2e77461ea1838937f9996dba0f8ec50eb9f5cd1420f2d67864771788ac1a3b9855c7a8ca476842f2473550db95b2d9e6102eee1c504c000aa34a30f

                    • C:\Users\Admin\AppData\Local\Temp\yK5RFjpXTs8H.bat

                      Filesize

                      207B

                      MD5

                      21fd7ddf5c05234a989191434e7abef9

                      SHA1

                      d9b7afdf6ed18e9619c1f19e2e6ff522354866dd

                      SHA256

                      33901698c1fc9e7447dfbe279b4829f761699ee8de301ebd705506bfe5747454

                      SHA512

                      576f3495e2e77461ea1838937f9996dba0f8ec50eb9f5cd1420f2d67864771788ac1a3b9855c7a8ca476842f2473550db95b2d9e6102eee1c504c000aa34a30f

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                      Filesize

                      3.1MB

                      MD5

                      6798986718c9d923ae747ff1bed1a16f

                      SHA1

                      dbf6ebb0b412286ec6007409f15d20c90038528b

                      SHA256

                      aa820cb29814aa7a79e6016c8d5a3b1a0bcf13fdea5b9625c7939095f37848d9

                      SHA512

                      07f0b0de77bc63492033e7fa5891286fe52597913d353b48fc97d6ed99116a729a2154ce0e32a11679c212b058daa0c8b299cff9a7c7506ee9d47fbf4eabedf7

                    • memory/732-102-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/732-91-0x000000001A930000-0x000000001A9B0000-memory.dmp

                      Filesize

                      512KB

                    • memory/732-90-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1744-25-0x00000000024C0000-0x0000000002540000-memory.dmp

                      Filesize

                      512KB

                    • memory/1744-23-0x0000000000D40000-0x0000000001064000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1744-24-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1744-36-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1764-10-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1764-2-0x000000001B2E0000-0x000000001B360000-memory.dmp

                      Filesize

                      512KB

                    • memory/1764-0-0x0000000000130000-0x0000000000454000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1764-1-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1768-76-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1768-65-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1768-66-0x000000001AF60000-0x000000001AFE0000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-20-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1996-8-0x0000000000D00000-0x0000000001024000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1996-9-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1996-11-0x000000001B170000-0x000000001B1F0000-memory.dmp

                      Filesize

                      512KB

                    • memory/2184-63-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2184-52-0x000000001B030000-0x000000001B0B0000-memory.dmp

                      Filesize

                      512KB

                    • memory/2184-51-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2236-78-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2236-87-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2468-49-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/2468-39-0x000000001B450000-0x000000001B4D0000-memory.dmp

                      Filesize

                      512KB

                    • memory/2468-38-0x000007FEF4AB0000-0x000007FEF549C000-memory.dmp

                      Filesize

                      9.9MB