Analysis

  • max time kernel
    157s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 18:16

General

  • Target

    80C6039DC12399E3F771632F0A44C4C3.exe

  • Size

    1.6MB

  • MD5

    80c6039dc12399e3f771632f0a44c4c3

  • SHA1

    f609ba2e8bc0d4b395b83f38a4867fcdb9b6bfdd

  • SHA256

    f6b10c59c9ce33c5c8f6b02c3293fe5d479e59542698c91b15af74bcce50ab8f

  • SHA512

    83b8fb0f9943c11012a82049d7861a3b7ec9753036de402c82ac433a5235cb95a104dd69b29ed110cd9dfe3b8ab062d916956f6f66864bf79876e926c2c5a6a5

  • SSDEEP

    49152:2dh0Omwse7edN51glfneOTS9rFJMkn4Rli/Ea:2dcwN25efeIS9rF6k4RQM

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

links-transition.gl.at.ply.gg:41958

127.0.0.1:41958

Mutex

973dbaac-5242-4f6a-aaef-307dad24cdde

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2023-10-14T03:00:38.071092836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    41958

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    973dbaac-5242-4f6a-aaef-307dad24cdde

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    links-transition.gl.at.ply.gg

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

njrat

Version

0.7d

Botnet

stupids

C2

hakim32.ddns.net:2000

hands-social.at.ply.gg:46242

Mutex

d4529f156f8f79f81b02518c9cf09857

Attributes
  • reg_key

    d4529f156f8f79f81b02518c9cf09857

  • splitter

    |'|'|

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • Nirsoft 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe
    "C:\Users\Admin\AppData\Local\Temp\80C6039DC12399E3F771632F0A44C4C3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe
      "C:\Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAZQBlACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGoAcQB3ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAaQBmACAAZQByAHIAbwByAHMAIABjAG8AbgB0AGEAYwB0ACAAbQBlACAAbQBhAGkAawBrAGkANAAyADAAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHMAbABwACMAPgA="
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AcABiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AcAB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZQBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAeQBqACMAPgA="
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2560
      • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe
        "C:\Users\Admin\AppData\Local\Temp\FreeScript.exe"
        3⤵
        • Executes dropped EXE
        PID:2588
      • C:\Users\Admin\AppData\Local\Temp\Server2223.exe
        "C:\Users\Admin\AppData\Local\Temp\Server2223.exe"
        3⤵
        • Executes dropped EXE
        PID:1916
      • C:\Users\Admin\AppData\Local\Temp\Server.exe
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe
          "C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1868
    • C:\Users\Admin\AppData\Local\Temp\microsofts.exe
      "C:\Users\Admin\AppData\Local\Temp\microsofts.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2328
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\tzgozqiz.fac"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:1312
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\0jnz403f.ivn"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2852
    • C:\Users\Admin\AppData\Local\Temp\sanas.scr
      "C:\Users\Admin\AppData\Local\Temp\sanas.scr" /S
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Server
        3⤵
        • Modifies registry class
        PID:1608

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\0jnz403f.ivn

          Filesize

          926B

          MD5

          919e671c3d5959a91ef2d4c377d2b2ff

          SHA1

          b1202b19512bbd390d3d5164792501c87bb42c41

          SHA256

          d2e079df7cf6388315368ba79bf099ad2ff5428af51bf5abf2d99a2d7c5eb651

          SHA512

          f3298256372beab8efe81b2e08d3b3869281f625de1ee13189c6b95eb2134d223df6f64cc9e490dd6b52a53aa936adc17bd5dfe4e50ee0fe420f3ebae276381c

        • C:\Users\Admin\AppData\Local\Temp\FreeScript.exe

          Filesize

          913KB

          MD5

          799c188cf6df366f4c0f98b8800a4977

          SHA1

          161d6006518879ecba6cf45b29599992d8eadfce

          SHA256

          32e96ac5e9d2f869ad11ca48401ca8eaeb520027751427145ddb5ab43bce1841

          SHA512

          32a3749f4ef40e9345644c84666207a7c4f0369274cc18f71eecd1eeb6ea22733bc4cc6751f7281bbdff7e0a2187209a6c00653a95d6d39adb4dab06f355e1b1

        • C:\Users\Admin\AppData\Local\Temp\Server.exe

          Filesize

          183KB

          MD5

          b9d1be8ae4f4a7a77f309b032a914564

          SHA1

          3b9da974e959adbb0f12705c64fd58e0c8ec5b18

          SHA256

          5f9c9f9af0dc5779d63ea334443d512d675b99c588f2505b652d49d02650c3ba

          SHA512

          dfadf27f176fe700df9dd9a979e030d362e906a25815eccb1a40c09d8dfee542a75ababbc361833742891fd5d0358233ad68cac05c12aedca1e5d93ae370fc14

        • C:\Users\Admin\AppData\Local\Temp\Server2223.exe

          Filesize

          93KB

          MD5

          86757f6c08b6cb698250cc9fc1816a8e

          SHA1

          fa8a2fbc982943a031ad202b3e4b1cdb11bcff6a

          SHA256

          98fa9c5139362be3e25333a7c48229ed220cc61c0dc41b8270e66d2886aa7dff

          SHA512

          cb87cf73deda4299561af9e7c4d65a82816ca5f82890edd76cfec258dbf973b197cd6c40bca2f8643d39f451072e71c5f9529864689cc68097a4382bec97a7dc

        • C:\Users\Admin\AppData\Local\Temp\Server2223.exe

          Filesize

          33KB

          MD5

          1c4da972f19b9b17a4131bc7061dc7af

          SHA1

          4d56a55b060a91e56be8958908747bd55a167ad8

          SHA256

          b64dc28af6c4090f604d113946f0958c05763c71c63d864f160f34f6ae905431

          SHA512

          13a37c99a1599f8bed06df229ebb011109fffa0cfc991f4d40714f5c9592b9984e748de5084bd13abf94cc524f7215e67c8ce7aefbce99732f4eccb873a11281

        • C:\Users\Admin\AppData\Local\Temp\melt.txt

          Filesize

          44B

          MD5

          5389b11510f65424863e2e9724bd65e4

          SHA1

          071102005e3217b50283b71ee33858bb15606549

          SHA256

          fecb0cdb9664c0c83a84dff897fecff3773df1d4d5a6fc5c84e2187027315fa7

          SHA512

          ba78a6c2619bd7a4d4428a5b0b739e109dfa9ddb8925a005067f8b7091744bd9e16e007d32f62ae42768f3f45fb8aefe496f5a3ef617862127b53a88f86514ff

        • C:\Users\Admin\AppData\Local\Temp\melt.txt

          Filesize

          43B

          MD5

          fba0a770926236f6ba95be6e970e6b84

          SHA1

          6706c0cf9ce59152c17b887d454c877a9579bd1d

          SHA256

          10f09dcc6b21f03ab4293d302475f90c96ccc4b746bb3dcdc1b241bcac03aca6

          SHA512

          700016be260852b8909b69e0fbf26ffc24d3ebfe40604e8f5d8a0bc76dcef861c11b269047ec5b68177dd7f29b8836f92c38864a5a42568f8a1ac8f360fcf252

        • C:\Users\Admin\AppData\Local\Temp\tzgozqiz.fac

          Filesize

          523B

          MD5

          69b2a2e17e78d24abee9f1de2f04811a

          SHA1

          d19c109704e83876ab3527457f9418a7d053aa33

          SHA256

          1b1491f21e64681f8fdc27b2265e2274fb7813eecb6ad8b446d2e431f6300edd

          SHA512

          eb7269979bc4187520636fe3d7b3089f2c7c02e81c4ce2a738ade680f72c61c67fe9577eeaa09d3ca93f34b60be8c434d2cfbfed6566e783f6611279f056150f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1K7DPGZQTW99TYG2FPZW.temp

          Filesize

          7KB

          MD5

          b69b633770273a207d0a6cbfd63f1e10

          SHA1

          66bb1d35ab42aa080c465b558b469107819722e9

          SHA256

          7b2df526bbb1a7e58287fecd97cb61b922220d9d1d21b510e98e22f1b8080b1b

          SHA512

          82aa68d9e0aaa7feaeb368716f5c8525190ba576e794091e5e10bb8769df4de9b2ae7723c0306731d28c297aa54a06e6337818d1cbb2bd09113e9d9dddfb9bcc

        • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe

          Filesize

          64KB

          MD5

          3fddfcbf4d1ad3af7ecb226649f8201c

          SHA1

          106fa1517c77ad55c306d640afa495318c9702b9

          SHA256

          eba86f8181f775a75983054f58eeccd914d80b02697076e89a20c7f8318db5d1

          SHA512

          06eb37faa45d360f059e10324410ecd075a055d3614095087b23d07a16566e71ea776985ec905205b176527790eb84350f4a8c44b627141e3b11655ce842ea1c

        • C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe

          Filesize

          15KB

          MD5

          a6791ce328bbeb45b5c94fc0f7c0a2cd

          SHA1

          aee4953385feb9a57a6dde8d6022a5feabe4bb5b

          SHA256

          231b468f237017af2b49885473cb4fd670f9794bce204d7d5712afaff02ed3de

          SHA512

          565924c6673ca22ce8edf43a93dae1d5556d1a9c4a6ddb6c9ae7d8d84871d5fd28cc86d36061e022f7902aff8e3d3c17790ed25b3e193fcce6909c268e696e6d

        • \Users\Admin\AppData\Local\Temp\FreeScript.exe

          Filesize

          611KB

          MD5

          42c65d605a64d8aec459d064f2e73c6c

          SHA1

          2ce31f3d85f0f55114c365ac07f13984d83434fa

          SHA256

          05fb898d917829cc0148b44b2cda2d0fa9bd1864c2034f94e8232cef76ff8325

          SHA512

          4436d13b33d4bad25da7cd77519aab5f369d8e3d873604280c151422916172d1dfebd2a8aafd8d51242601898fb742f2a16af1e5bb35ace4026fc045df398152

        • \Users\Admin\AppData\Local\Temp\Server.exe

          Filesize

          135KB

          MD5

          0b9e45143182f10bde6fff990736d04d

          SHA1

          de8ceb06ea033e91d69f3f309a66a9b8d2603b9e

          SHA256

          938c8fb00f7f43b043c53a41f10841c4754f2f82ff4e10b6e3d25c4795db4b28

          SHA512

          e4fc33f11016bb5f5b847d672afe8825826d185fe63c7924cf0601c5977f41687c930159eefba9150e2fd283b22d7f381efe93fae5f25132dd86055b0be00249

        • \Users\Admin\AppData\Local\Temp\Server2223.exe

          Filesize

          64KB

          MD5

          2d66b8b76c4331aa371c4f93b38451a9

          SHA1

          2e6a05a162de54858e5693098b483fdfc797dd01

          SHA256

          91a67fb63c52a6c3a72db412b118fb35c87164d131ab5fd059703c60aef1aab6

          SHA512

          48820cd84a6c49c93f2b5ebfa27ee95a62948fe3e3f6453df161f1762d7993bc910234b2d9ca03108a44e35223de4feeb1fd3deb367d0babef7f8307ff86866e

        • \Users\Admin\AppData\Local\Temp\microsofts.exe

          Filesize

          202KB

          MD5

          5fdd418baf9c0d789e67758ad9f2dd1a

          SHA1

          c0be3be193af670cfe01a64aef7c5b0a0b9d091a

          SHA256

          82f59d1a1a65c0651ae7a965bb6481ba1351ea9efc9f9457de372043709e5a47

          SHA512

          9ace7aed4e4db6f2df7a8df22227079acf176cb7b7e90a0d2638dfd44296653fae6194531a7335fb10fd9396f3cd4f11621715b2a2e4f948209055a809b00c50

        • \Users\Admin\AppData\Local\Temp\sanas.scr

          Filesize

          183KB

          MD5

          b7cedaa564e3fb095f94aef59f7ed0da

          SHA1

          3f93a84f2d290840cfb5418e15c47dda39ab967d

          SHA256

          526a5aae8d6af5d4af48bef2bf37f6a79b1584b7b48d32bef6a2f6f4ee69ccfc

          SHA512

          18d274dba047179d7cc6b2bb14ede76618bf5c93d8a4b4d1a32bbcf2f6494c9ecc4a601a5a4eae5d7672967be5c3a0c5bfc402f97626638ba7825d6412538f7d

        • \Users\Admin\AppData\Local\Temp\shadowscripts fixed.exe

          Filesize

          1.2MB

          MD5

          4c624867a94fee20d81b9e14755165de

          SHA1

          6f5afb06ff6278616f8fb0cd81ad1e164b0fee24

          SHA256

          9a1ef7b5af62c005df90a75846e390e1695ecd18c7727b8e039e4b5842d6f388

          SHA512

          0a40dc67d116b9726c3129a88e82c536273b4ad42f850ca78828b042dc5d20313caf1ee8a8a7136efab6027fa2f7bcf1551fac61f239c10d865f5664a8006064

        • memory/784-53-0x0000000001F90000-0x0000000002010000-memory.dmp

          Filesize

          512KB

        • memory/784-86-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/784-72-0x0000000001F90000-0x0000000002010000-memory.dmp

          Filesize

          512KB

        • memory/784-52-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/1312-109-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-112-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-111-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-107-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-118-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-119-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-116-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-122-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1312-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1312-113-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/1868-85-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/1868-105-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-104-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-103-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-102-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/1868-94-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-87-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-93-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-91-0x0000000000A90000-0x0000000000B10000-memory.dmp

          Filesize

          512KB

        • memory/1868-88-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/1916-70-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/1916-54-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/1916-58-0x00000000023D0000-0x0000000002410000-memory.dmp

          Filesize

          256KB

        • memory/1916-61-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2328-57-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2328-98-0x00000000004C0000-0x0000000000500000-memory.dmp

          Filesize

          256KB

        • memory/2328-97-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2328-56-0x00000000004C0000-0x0000000000500000-memory.dmp

          Filesize

          256KB

        • memory/2328-55-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-64-0x00000000002B0000-0x00000000002F0000-memory.dmp

          Filesize

          256KB

        • memory/2560-62-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-71-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2560-65-0x00000000002B0000-0x00000000002F0000-memory.dmp

          Filesize

          256KB

        • memory/2708-106-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2708-63-0x0000000001E40000-0x0000000001E80000-memory.dmp

          Filesize

          256KB

        • memory/2708-101-0x0000000001E40000-0x0000000001E80000-memory.dmp

          Filesize

          256KB

        • memory/2708-100-0x0000000001E40000-0x0000000001E80000-memory.dmp

          Filesize

          256KB

        • memory/2708-60-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2708-99-0x00000000737D0000-0x0000000073D7B000-memory.dmp

          Filesize

          5.7MB

        • memory/2708-67-0x0000000001E40000-0x0000000001E80000-memory.dmp

          Filesize

          256KB

        • memory/2780-66-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/2780-73-0x0000000001FA0000-0x0000000002020000-memory.dmp

          Filesize

          512KB

        • memory/2780-96-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/2780-50-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

          Filesize

          9.6MB

        • memory/2780-51-0x0000000001FA0000-0x0000000002020000-memory.dmp

          Filesize

          512KB

        • memory/2852-129-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-128-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-126-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-130-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-133-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-135-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-136-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-141-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2852-124-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB