Resubmissions

11-04-2024 07:23

240411-h79qeaee77 10

11-04-2024 07:22

240411-h7ha6aee65 10

11-04-2024 07:22

240411-h7g1dshf5x 10

11-04-2024 07:22

240411-h7gdvsee63 10

11-04-2024 07:22

240411-h7fsbshf5w 10

07-04-2024 08:58

240407-kxh6tahg75 10

07-04-2024 07:55

240407-jr6jgsgd3z 10

07-04-2024 07:54

240407-jrz2psgh28 10

07-04-2024 07:54

240407-jrvf8agd3w 10

07-04-2024 07:51

240407-jqb89agg76 10

Analysis

  • max time kernel
    301s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 07:22

General

  • Target

    6ec74da2134bd56250ca32be04b9b697.exe

  • Size

    7.8MB

  • MD5

    6ec74da2134bd56250ca32be04b9b697

  • SHA1

    d20ff3ed5ff0f49b10d6c06dbc5710fb910e2e28

  • SHA256

    1ab1a15e1e4a19c7d77a01f00de5d401bc7ab0ffaa33c332788aadeeedddc386

  • SHA512

    d4d71707f0d8e5d7473980ddebea9fe7764dd38cc3cb51e789336869f28425d5d42aa229cdaac08ba22bebdabf108bfeb8c5f30452f9fd2787275c2863e3fea2

  • SSDEEP

    196608:6CRAktw/6k1Juxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTVI:VRAktqJuxwZ6v1CPwDv3uFteg2EeJUOf

Malware Config

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ec74da2134bd56250ca32be04b9b697.exe
    "C:\Users\Admin\AppData\Local\Temp\6ec74da2134bd56250ca32be04b9b697.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Users\Admin\AppData\Local\Temp\ttttt.exe
      "C:\Users\Admin\AppData\Local\Temp\ttttt.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1792
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:216
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1656
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4012
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3636
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2064
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3484
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2268
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1964
      • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe
        "C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2652
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ttttt.exe

      Filesize

      7.8MB

      MD5

      fb3275ed37c90f2157066dcb2a8e46cb

      SHA1

      9eca563f4a66414d05ae700bcd57dfbb06644a19

      SHA256

      b9a5fed33c62e470f337ee1da21e4b1abab7a4b5107aabb01e432d8b32eab9ab

      SHA512

      408661a5c3b10a46bac7d5f4f0cf20baa4f97da31d1c9e7b994710f5e00de9afd343d3e74f60337058b06530aaca95c66af7698b0da34e9592a49f67933c8671

    • C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe

      Filesize

      973KB

      MD5

      5cfe61ff895c7daa889708665ef05d7b

      SHA1

      5e58efe30406243fbd58d4968b0492ddeef145f2

      SHA256

      f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

      SHA512

      43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

    • C:\Users\Admin\AppData\Local\a0d62031\tor\data\cached-certs

      Filesize

      20KB

      MD5

      1673c0708201520a71a46c84ce59ea92

      SHA1

      2142b3e4e645a57107457927a2a077f45a0e7cbc

      SHA256

      a40d0aa39f8661e91c609601e391dd9cb032f4e35591ad7639dce62dcd9c5df7

      SHA512

      efad4a83c32e3776d71ef6bb777cfd0b25353e80f033eb41458723e1d021df9797d2490e6f60498c15c3edbdeea0ac5f7152cd9ca558317025aaad4c3251f9a6

    • C:\Users\Admin\AppData\Local\a0d62031\tor\data\cached-microdesc-consensus.tmp

      Filesize

      2.7MB

      MD5

      4a588a9a8a45b44021e47fc04f8529de

      SHA1

      9da79dc4ce4697853891388fa2c6effe3d57fe50

      SHA256

      8c59043346979bf7be919489f68f453400e7ee05dfa334467a63d410fe9e3f5d

      SHA512

      8187287b39bed37d5307b5bfabacebb85072c6bf1bd485a5023b5e3bcc4282cc4bc21c543bcc95bf7a3ad5de17c90bf392dc5540432ed240657edb796223d1c2

    • C:\Users\Admin\AppData\Local\a0d62031\tor\data\cached-microdescs.new

      Filesize

      20.2MB

      MD5

      9fd3dc0c5586dd3dc582d523ef148421

      SHA1

      1cb0c44e3f1919695a7fb74d5be764575c65e923

      SHA256

      0eda6da81d30a3d131a70f1c054fe17367b03bd678b4e6953a610f4d8993afde

      SHA512

      2189e9faf3240f66cea62aec7ad153ddef8fb2dbf0ac37f5617e043c32d004aed5c720d53a7d1f79e4ebe5fa59d78b02d47f020db784f7aaf8ac87dc7fd53bf4

    • C:\Users\Admin\AppData\Local\a0d62031\tor\data\cached-microdescs.new

      Filesize

      12.0MB

      MD5

      acfc21150b37e8f11183296cb807a5c2

      SHA1

      b0aa3394c8271df944eac6f4206b182472bbc6fd

      SHA256

      31bb8bda9f22fc5942214b0d929745291ec761ef50c934d11f8fb2de2bf6cd6f

      SHA512

      cdf8a81092dd8b62c0f4234f753040a0fa8984761e8806349e1c1a97a16524d914cb49856c7bf452c2f0dbf31e03eaf90804759d91beafdc245432cb75a043c6

    • C:\Users\Admin\AppData\Local\a0d62031\tor\data\state

      Filesize

      6KB

      MD5

      d0a66c56c25f2bd760c1e809356aae9d

      SHA1

      1fcdfe5403c79276add9050e78d6dd286f80061f

      SHA256

      e705ae844b11f6a15143af77d0f6b548cd67b3064c1d8d5caaf1984e43b16c52

      SHA512

      af76f2d75231740a7445219c0ad63a5dac7b859de932fef55b1c8d8ac57c47b59c287d7ab305a75bf75761e539bb660799c5a4dd380b0b75926e774c1247a4e0

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libcrypto-1_1.dll

      Filesize

      1.7MB

      MD5

      2384a02c4a1f7ec481adde3a020607d3

      SHA1

      7e848d35a10bf9296c8fa41956a3daa777f86365

      SHA256

      c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

      SHA512

      1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libevent-2-1-6.dll

      Filesize

      366KB

      MD5

      099983c13bade9554a3c17484e5481f1

      SHA1

      a84e69ad9722f999252d59d0ed9a99901a60e564

      SHA256

      b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

      SHA512

      89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libgcc_s_sjlj-1.dll

      Filesize

      286KB

      MD5

      b0d98f7157d972190fe0759d4368d320

      SHA1

      5715a533621a2b642aad9616e603c6907d80efc4

      SHA256

      2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

      SHA512

      41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libssl-1_1.dll

      Filesize

      439KB

      MD5

      c88826ac4bb879622e43ead5bdb95aeb

      SHA1

      87d29853649a86f0463bfd9ad887b85eedc21723

      SHA256

      c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

      SHA512

      f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libssp-0.dll

      Filesize

      88KB

      MD5

      2c916456f503075f746c6ea649cf9539

      SHA1

      fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

      SHA256

      cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

      SHA512

      1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

    • C:\Users\Admin\AppData\Local\a0d62031\tor\libwinpthread-1.dll

      Filesize

      188KB

      MD5

      d407cc6d79a08039a6f4b50539e560b8

      SHA1

      21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

      SHA256

      92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

      SHA512

      378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

    • C:\Users\Admin\AppData\Local\a0d62031\tor\torrc

      Filesize

      139B

      MD5

      aed5236dc2f3c2c8244913bc771a0980

      SHA1

      24bf716687ea54e3f44f405da94acce3046aba2a

      SHA256

      69b07fcdeb4c47ad20869ac27c2b39dfe4afcba2e972500d24a5670904226f12

      SHA512

      ef367214b48860bd704eb52d35881f75cd18fe177be6d49c407e77b6b44dee46f717f578236a14f4028164beaaf616777aaef58b593b8f980a66c5241076c053

    • C:\Users\Admin\AppData\Local\a0d62031\tor\zlib1.dll

      Filesize

      52KB

      MD5

      add33041af894b67fe34e1dc819b7eb6

      SHA1

      6db46eb021855a587c95479422adcc774a272eeb

      SHA256

      8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

      SHA512

      bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

    • memory/216-153-0x0000000073E50000-0x0000000073F5A000-memory.dmp

      Filesize

      1.0MB

    • memory/216-147-0x0000000074060000-0x000000007412E000-memory.dmp

      Filesize

      824KB

    • memory/216-152-0x0000000073AF0000-0x0000000073DBF000-memory.dmp

      Filesize

      2.8MB

    • memory/216-154-0x0000000073F90000-0x0000000074058000-memory.dmp

      Filesize

      800KB

    • memory/216-151-0x0000000073F60000-0x0000000073F84000-memory.dmp

      Filesize

      144KB

    • memory/216-145-0x0000000073F90000-0x0000000074058000-memory.dmp

      Filesize

      800KB

    • memory/216-148-0x0000000074130000-0x0000000074179000-memory.dmp

      Filesize

      292KB

    • memory/216-150-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/216-144-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/216-155-0x0000000073DC0000-0x0000000073E48000-memory.dmp

      Filesize

      544KB

    • memory/216-156-0x0000000074060000-0x000000007412E000-memory.dmp

      Filesize

      824KB

    • memory/1120-17-0x0000000074C30000-0x0000000074C69000-memory.dmp

      Filesize

      228KB

    • memory/1120-63-0x00000000737C0000-0x00000000737F9000-memory.dmp

      Filesize

      228KB

    • memory/1120-161-0x0000000073F70000-0x0000000073FA9000-memory.dmp

      Filesize

      228KB

    • memory/1656-198-0x0000000072710000-0x00000000727DE000-memory.dmp

      Filesize

      824KB

    • memory/1656-172-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/1656-242-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1656-211-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1656-207-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1656-199-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1656-195-0x0000000072980000-0x00000000729A4000-memory.dmp

      Filesize

      144KB

    • memory/1656-194-0x00000000729B0000-0x00000000729F9000-memory.dmp

      Filesize

      292KB

    • memory/1656-196-0x0000000072870000-0x000000007297A000-memory.dmp

      Filesize

      1.0MB

    • memory/1656-193-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/1656-192-0x0000000073BC0000-0x0000000073E8F000-memory.dmp

      Filesize

      2.8MB

    • memory/1656-191-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1656-179-0x0000000072710000-0x00000000727DE000-memory.dmp

      Filesize

      824KB

    • memory/1656-178-0x0000000073BC0000-0x0000000073E8F000-memory.dmp

      Filesize

      2.8MB

    • memory/1656-177-0x00000000727E0000-0x0000000072868000-memory.dmp

      Filesize

      544KB

    • memory/1656-174-0x0000000072980000-0x00000000729A4000-memory.dmp

      Filesize

      144KB

    • memory/1656-176-0x0000000072870000-0x000000007297A000-memory.dmp

      Filesize

      1.0MB

    • memory/1656-173-0x00000000729B0000-0x00000000729F9000-memory.dmp

      Filesize

      292KB

    • memory/1792-109-0x0000000001900000-0x0000000001BCF000-memory.dmp

      Filesize

      2.8MB

    • memory/1792-79-0x0000000073AF0000-0x0000000073DBF000-memory.dmp

      Filesize

      2.8MB

    • memory/1792-55-0x0000000001050000-0x00000000010D8000-memory.dmp

      Filesize

      544KB

    • memory/1792-54-0x0000000073E50000-0x0000000073F5A000-memory.dmp

      Filesize

      1.0MB

    • memory/1792-49-0x0000000073F90000-0x0000000074058000-memory.dmp

      Filesize

      800KB

    • memory/1792-47-0x0000000074060000-0x000000007412E000-memory.dmp

      Filesize

      824KB

    • memory/1792-41-0x0000000074130000-0x0000000074179000-memory.dmp

      Filesize

      292KB

    • memory/1792-38-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-72-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-73-0x0000000074130000-0x0000000074179000-memory.dmp

      Filesize

      292KB

    • memory/1792-74-0x0000000074060000-0x000000007412E000-memory.dmp

      Filesize

      824KB

    • memory/1792-75-0x0000000073F90000-0x0000000074058000-memory.dmp

      Filesize

      800KB

    • memory/1792-53-0x0000000073DC0000-0x0000000073E48000-memory.dmp

      Filesize

      544KB

    • memory/1792-58-0x0000000001900000-0x0000000001BCF000-memory.dmp

      Filesize

      2.8MB

    • memory/1792-127-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-110-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-59-0x0000000073AF0000-0x0000000073DBF000-memory.dmp

      Filesize

      2.8MB

    • memory/1792-108-0x0000000001050000-0x00000000010D8000-memory.dmp

      Filesize

      544KB

    • memory/1792-100-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-77-0x0000000073E50000-0x0000000073F5A000-memory.dmp

      Filesize

      1.0MB

    • memory/1792-78-0x0000000073DC0000-0x0000000073E48000-memory.dmp

      Filesize

      544KB

    • memory/1792-146-0x0000000001050000-0x00000000010D8000-memory.dmp

      Filesize

      544KB

    • memory/1792-52-0x0000000073F60000-0x0000000073F84000-memory.dmp

      Filesize

      144KB

    • memory/1792-81-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/1792-76-0x0000000073F60000-0x0000000073F84000-memory.dmp

      Filesize

      144KB

    • memory/3636-274-0x0000000072710000-0x00000000727DE000-memory.dmp

      Filesize

      824KB

    • memory/3636-269-0x00000000727E0000-0x0000000072868000-memory.dmp

      Filesize

      544KB

    • memory/3636-294-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/3636-273-0x0000000072980000-0x00000000729A4000-memory.dmp

      Filesize

      144KB

    • memory/3636-295-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/3636-296-0x00000000727E0000-0x0000000072868000-memory.dmp

      Filesize

      544KB

    • memory/3636-297-0x00000000729B0000-0x00000000729F9000-memory.dmp

      Filesize

      292KB

    • memory/3636-272-0x0000000073BC0000-0x0000000073E8F000-memory.dmp

      Filesize

      2.8MB

    • memory/3636-271-0x0000000072870000-0x000000007297A000-memory.dmp

      Filesize

      1.0MB

    • memory/3636-265-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/3636-298-0x0000000072870000-0x000000007297A000-memory.dmp

      Filesize

      1.0MB

    • memory/4012-243-0x0000000072980000-0x00000000729A4000-memory.dmp

      Filesize

      144KB

    • memory/4012-245-0x0000000072870000-0x000000007297A000-memory.dmp

      Filesize

      1.0MB

    • memory/4012-247-0x00000000727E0000-0x0000000072868000-memory.dmp

      Filesize

      544KB

    • memory/4012-236-0x0000000073BC0000-0x0000000073E8F000-memory.dmp

      Filesize

      2.8MB

    • memory/4012-240-0x00000000729B0000-0x00000000729F9000-memory.dmp

      Filesize

      292KB

    • memory/4012-254-0x0000000072710000-0x00000000727DE000-memory.dmp

      Filesize

      824KB

    • memory/4012-255-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/4012-257-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/4012-256-0x0000000073BC0000-0x0000000073E8F000-memory.dmp

      Filesize

      2.8MB

    • memory/4012-239-0x0000000072710000-0x00000000727DE000-memory.dmp

      Filesize

      824KB

    • memory/4012-237-0x0000000073AF0000-0x0000000073BB8000-memory.dmp

      Filesize

      800KB

    • memory/4012-233-0x00000000005A0000-0x00000000009A4000-memory.dmp

      Filesize

      4.0MB

    • memory/4436-0-0x0000000000850000-0x000000000102C000-memory.dmp

      Filesize

      7.9MB

    • memory/4436-1-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

      Filesize

      10.8MB

    • memory/4436-3-0x000000001BC20000-0x000000001BC30000-memory.dmp

      Filesize

      64KB

    • memory/4436-2-0x00000000017D0000-0x00000000017D8000-memory.dmp

      Filesize

      32KB

    • memory/4436-4-0x000000001BC20000-0x000000001BC30000-memory.dmp

      Filesize

      64KB

    • memory/4436-5-0x000000001BC20000-0x000000001BC30000-memory.dmp

      Filesize

      64KB

    • memory/4436-6-0x000000001BC20000-0x000000001BC30000-memory.dmp

      Filesize

      64KB

    • memory/4436-15-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

      Filesize

      10.8MB