Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2024 05:23

General

  • Target

    ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe

  • Size

    3.4MB

  • MD5

    05e8c507d40aa6d05720a1f6bdf7f52e

  • SHA1

    0d065c8aa7f5399a32eea3185b865770bfc26fd8

  • SHA256

    ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405

  • SHA512

    9178b7678d4432a3fa813ee9cc5cdb0c60bdba8b69a4c6ab15932973a964f8d6066e82c432f8799830f8121df4ddea12c6cd2061db197f5763355de6479b89c2

  • SSDEEP

    49152:HJTIYbGQdAjED+aE0LaiIve+mbrErGEVV1BCjBysTt0jUiwg:HJThbGQdAjED+aE0LaitrErrT14

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

pcpanel.hackcrack.io:32544

Mutex

Windows Explorer

Attributes
  • reg_key

    Windows Explorer

  • splitter

    |'|'|

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • AgentTesla payload 6 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe
    "C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1852
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4000
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
            dw20.exe -x -s 796
            5⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:1096
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4360
          • \??\c:\windows\system32\cmstp.exe
            "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0h4aqfsw.inf
            5⤵
              PID:2932
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2416
              • C:\Windows\SYSTEM32\netsh.exe
                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
                6⤵
                • Modifies Windows Firewall
                PID:1420
      • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe
        "C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe"
        2⤵
        • Executes dropped EXE
        • Enumerates system info in registry
        PID:3868
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1912
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4900
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1524
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1512
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4152
    • C:\Windows\system32\taskkill.exe
      taskkill /IM cmstp.exe /F
      1⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\explorer.exe.log

      Filesize

      676B

      MD5

      e9b84a8ca80d8de18390d788a80f3721

      SHA1

      0d9eae4cb2aad66bcf93e996cb8407dbc2311a84

      SHA256

      57c4764bb9a07ebfc036015105d466c65da3d97a2fed4006d4690c76bdc8bc59

      SHA512

      9183a91e1a583a66d6b5fb8d30dcc05f6f3e3419ba3aa7885d8f35981058dc803b01cd1f7e33f4109cd8da1e3457fd6ed088b07acf5fb3a9c9ae080a1749fe5b

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Setup.exe.log

      Filesize

      1KB

      MD5

      7ca69c3a50dd1e107b36424371d545aa

      SHA1

      af96b7133f339588b8de9e29be762dd8fbe2da08

      SHA256

      fb56bfa6682034270cd833c70e9ab03a606372aef15b2e305da0318873394664

      SHA512

      bf3b5a590335e671cd44f244bf20fc30028a56c55f69f4f8b0a46aba787b248c343391998ed5267b5ca9aa0075697e169056120c18837ddc3ca97c5ace83c6fd

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

      Filesize

      1KB

      MD5

      cafd74774ee92e32d33d986aa1d02887

      SHA1

      4eba3d811e150ea0e03193916820ceb1353d7d3a

      SHA256

      a9a2445fa2c7695be72695fb46f2d5fbb7106691d7840d454fac2b91ddd014b0

      SHA512

      27baef4953ca7ffd10dfc22d6ee2e6b961c1c08aa2a9813737afb4a265bfa9dfa56d577b20b0aefa84c157ab8fbc3fc4a7456c4e5093dd480f22c3fbdef30bf6

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      d28a889fd956d5cb3accfbaf1143eb6f

      SHA1

      157ba54b365341f8ff06707d996b3635da8446f7

      SHA256

      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

      SHA512

      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      bd5940f08d0be56e65e5f2aaf47c538e

      SHA1

      d7e31b87866e5e383ab5499da64aba50f03e8443

      SHA256

      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

      SHA512

      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

    • C:\Users\Admin\AppData\Local\Temp\0h4aqfsw.inf

      Filesize

      619B

      MD5

      6f1420f2133f3e08fd8cdea0e1f5fe27

      SHA1

      3aa41ec75adc0cf50e001ca91bbfa7f763adf70b

      SHA256

      aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242

      SHA512

      d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

    • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

      Filesize

      992KB

      MD5

      b6a17adf6c356cc0007722c102e05ef1

      SHA1

      ceb34c2eac1a5d5cb2803f6eab34f4e0c1b15e4d

      SHA256

      0ef45bdf29e9bd2da871af058e676d6c33c6ea5b95a1587fc8025a4ca1f49197

      SHA512

      75e06fd4448c5df480c45a2f713bc7e806847c8e58fab7382eb61cd5e2c2b54f43ca162d739de2284af7ae6163670d4802dfbdedc2b6b4aa2d73a512a614c051

    • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

      Filesize

      787KB

      MD5

      cd35f448685e44afc2f65854d087f07b

      SHA1

      2184dfbb615e437c3807da0f04a8b1cd91ed55c2

      SHA256

      f37d07238e2ee5234a64daa2b3704444f72e790802e83f533908ef4d675241da

      SHA512

      50aec6c69687e8e18ccb51c09a728933789c4d093ccc283fe3ae9be1be7d1e343fbb33860828ee3525338d9283af719dedb9c51f364374780a8f91cbb92c28ef

    • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

      Filesize

      628KB

      MD5

      d4941525df91a894119bd6ec6190583b

      SHA1

      0b114d6428d86d5326ddfe06680ea2e566741823

      SHA256

      b8edfc4c4993e8277129a8939ce37df083635205e2dbb88524d2d0027fdfcd2e

      SHA512

      c01b33be43502b0dc6c85f8f3a81f2f70012023db3938f438b2ed88ea3456e1c00484515ba4015c0c1b6248251740ea664d301ad3fea9e344ca9c93d1d3d63f1

    • C:\Users\Admin\AppData\Local\Temp\Setup.exe

      Filesize

      461KB

      MD5

      ee76425b767c9ab812a53c133b8363f8

      SHA1

      1daa4700a5f1849eb7e810986ac24bd58786da61

      SHA256

      f962e1a60673963b7c2fa51a0663260df63771dfbd7423af67c2d142f7245747

      SHA512

      004d1b4acc7084ba8c520d94032c19342228ed6346321b04641450f87a32f78a92212e3940e4cf0790af2e5640c6001e7c805dc99cf8f9a146d752b5ee117c3b

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avmt1km2.wiv.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

      Filesize

      162KB

      MD5

      a9b0d84f4872b4352371e33a973cfdda

      SHA1

      6a2f976500c939987ed0427a5c7c88103e79471a

      SHA256

      937c2943f9773d84a1ad3540115abe9447c74085a08f1c5f5ec19c5d6145b1bb

      SHA512

      f56ef1f698c8bfd8e047f19b1e5da6dc1fb8f07e441bc2efebda2beb6f63725e385ee28946baa0841cad007288fd8524c799504708bce880e2358bdac2505662

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.zip

      Filesize

      176KB

      MD5

      3d3435b18469b7d581bcaffea5397df0

      SHA1

      6b22009c0b6bc7f7fff9cf1bd4f749300d8cad7c

      SHA256

      7c7d6e28fbee6b1a0686950ab4ea4b954b7f3a52c770e439b84e77e74cf574c9

      SHA512

      2833ca96cdfb39d211c2e678e643f5530664d5122d914d4be507a928ab5819bd23f27b365d47d79b649ac7dfa936cc186d4f71c2fdf0de469fe684d57d3eb515

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

      Filesize

      153KB

      MD5

      5c8053e0987abd96bbe3908486feb5c0

      SHA1

      2b218cfa22419227a055ba25a54ce9d4c3b04ee6

      SHA256

      9a54618271f6c9437c8cdfd40a5a5d4f43c163cf073bc219bb9ba1bcf0b66ee9

      SHA512

      20e0a75cfd4eba55554009efd78e8b63594122aa3d0eb5a60e80594fa9c44eb242b0f5f38785d19638e79b1e847bb058d7dcf43afafde6a52c9b44efcfce66b4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

      Filesize

      325KB

      MD5

      f36e535fdc82208fca08acfa44f790c6

      SHA1

      a3cc1aa7d614094faebada2aed1e6c519bd18c94

      SHA256

      51efbe235b492c7e99c480915c7eeecf85f5ee6d540189ee5aa54fe9f0fafcdc

      SHA512

      631db5246159e045ed6911867f25991ae8824951e608c2fef25bc48482271aeb3ad26f1c98a04b4cbbf431ce20ef027cacb4bf0b3d85e048885da2b709f3a9af

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

      Filesize

      137KB

      MD5

      a1814c03d8d16639b62d770e246e1bdd

      SHA1

      89670fc4cd0673219f92945e2cbc4a40efcaeaae

      SHA256

      4c45a9ae842dd14a49e3231890a734e09ea285c48f9e867d865ca74ae358ab2b

      SHA512

      5e7a92f3dc1b99cfc6cbc407b56162b8982ce367cc23700c4745f6e3959d6c5bf0f1a876e08d33964b4ca30e51d72afcf83fcff8b837ecf31b9bc9d5e59cb1fe

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

      Filesize

      11KB

      MD5

      10d90137afcca51c429a2c0aa78c92d6

      SHA1

      c7cb2762e0a31b06aaca0c440db5556fd23df24f

      SHA256

      44a4f73cc6a5a89208372ded41ed5e3cecc8bf2064ee1224275f21061dae11a1

      SHA512

      c914381e197450f3e576d3c77f103796be594444499ff2397e0bb74f9249baff973ea5c66ab42540835e060ad6032694fc2b8d01c95795d71adf6f1c91d000b0

    • memory/1512-142-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

      Filesize

      10.8MB

    • memory/1512-143-0x00000284F2170000-0x00000284F2180000-memory.dmp

      Filesize

      64KB

    • memory/1512-148-0x00000284F2170000-0x00000284F2180000-memory.dmp

      Filesize

      64KB

    • memory/1524-121-0x0000022DB8150000-0x0000022DB8160000-memory.dmp

      Filesize

      64KB

    • memory/1524-122-0x0000022DB8150000-0x0000022DB8160000-memory.dmp

      Filesize

      64KB

    • memory/1524-134-0x0000022DD0C40000-0x0000022DD0C62000-memory.dmp

      Filesize

      136KB

    • memory/1524-120-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

      Filesize

      10.8MB

    • memory/1852-50-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

      Filesize

      32KB

    • memory/1852-57-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/1852-90-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/1852-68-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/1912-149-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

      Filesize

      10.8MB

    • memory/1912-159-0x000002A0AB6F0000-0x000002A0AB700000-memory.dmp

      Filesize

      64KB

    • memory/1912-160-0x000002A0AB6F0000-0x000002A0AB700000-memory.dmp

      Filesize

      64KB

    • memory/2760-41-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/2760-0-0x00000000005C0000-0x0000000000936000-memory.dmp

      Filesize

      3.5MB

    • memory/2760-1-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/2956-123-0x00000193E86B0000-0x00000193E86C0000-memory.dmp

      Filesize

      64KB

    • memory/2956-124-0x00000193E86B0000-0x00000193E86C0000-memory.dmp

      Filesize

      64KB

    • memory/2956-135-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

      Filesize

      10.8MB

    • memory/3044-53-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/3044-117-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/3044-119-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/3044-115-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/3044-14-0x0000000000410000-0x0000000000488000-memory.dmp

      Filesize

      480KB

    • memory/3044-15-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/3044-17-0x0000000002600000-0x000000000262A000-memory.dmp

      Filesize

      168KB

    • memory/3044-16-0x000000001B040000-0x000000001B050000-memory.dmp

      Filesize

      64KB

    • memory/3044-116-0x0000000000F10000-0x0000000000F20000-memory.dmp

      Filesize

      64KB

    • memory/3868-65-0x0000000074960000-0x0000000075110000-memory.dmp

      Filesize

      7.7MB

    • memory/3868-69-0x0000000002B60000-0x0000000002B70000-memory.dmp

      Filesize

      64KB

    • memory/3868-56-0x0000000005280000-0x000000000528A000-memory.dmp

      Filesize

      40KB

    • memory/3868-60-0x0000000002B60000-0x0000000002B70000-memory.dmp

      Filesize

      64KB

    • memory/3868-61-0x0000000006A70000-0x0000000006A8A000-memory.dmp

      Filesize

      104KB

    • memory/3868-44-0x0000000005770000-0x0000000005D14000-memory.dmp

      Filesize

      5.6MB

    • memory/3868-45-0x00000000051C0000-0x0000000005252000-memory.dmp

      Filesize

      584KB

    • memory/3868-58-0x0000000005420000-0x0000000005616000-memory.dmp

      Filesize

      2.0MB

    • memory/3868-43-0x0000000074960000-0x0000000075110000-memory.dmp

      Filesize

      7.7MB

    • memory/3868-64-0x00000000090C0000-0x0000000009170000-memory.dmp

      Filesize

      704KB

    • memory/3868-55-0x0000000002B60000-0x0000000002B70000-memory.dmp

      Filesize

      64KB

    • memory/3868-67-0x0000000002B60000-0x0000000002B70000-memory.dmp

      Filesize

      64KB

    • memory/3868-42-0x0000000000610000-0x0000000000906000-memory.dmp

      Filesize

      3.0MB

    • memory/4000-98-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/4000-108-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/4000-94-0x0000000001430000-0x0000000001440000-memory.dmp

      Filesize

      64KB

    • memory/4000-104-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/4152-136-0x000001CACA670000-0x000001CACA680000-memory.dmp

      Filesize

      64KB

    • memory/4360-110-0x0000000000F40000-0x0000000000F48000-memory.dmp

      Filesize

      32KB

    • memory/4360-114-0x0000000000F20000-0x0000000000F2C000-memory.dmp

      Filesize

      48KB

    • memory/4360-111-0x0000000000DF0000-0x0000000000E00000-memory.dmp

      Filesize

      64KB

    • memory/4360-89-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/4360-91-0x0000000000DF0000-0x0000000000E00000-memory.dmp

      Filesize

      64KB

    • memory/4360-93-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

      Filesize

      9.6MB

    • memory/4360-109-0x000000001B830000-0x000000001B8CC000-memory.dmp

      Filesize

      624KB

    • memory/4360-92-0x000000001B550000-0x000000001B5F6000-memory.dmp

      Filesize

      664KB

    • memory/4360-97-0x000000001C220000-0x000000001C6EE000-memory.dmp

      Filesize

      4.8MB

    • memory/4528-59-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/4528-40-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

      Filesize

      64KB

    • memory/4528-31-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/4900-170-0x000002D7A5D50000-0x000002D7A5D60000-memory.dmp

      Filesize

      64KB

    • memory/5040-86-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/5040-66-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB

    • memory/5040-48-0x00000000000A0000-0x00000000000F6000-memory.dmp

      Filesize

      344KB

    • memory/5040-52-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

      Filesize

      10.8MB