Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 21:45

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    4d037c46eaf6b2e5ae5db85ef045c0d1

  • SHA1

    7bc3b6647192157a2cc4894f4c58365d9932a2cf

  • SHA256

    c18eadfdcee5050757e12c48fc44db31612863eb37db0fbc2dcbaad7ff5ae821

  • SHA512

    163d60321af8d3da76d10ea550b4c792dd0b6a18abe603ab049043246b2136fb2543f8089e3e5d3fbd6e6bfcf1786f4f7b8a96cb28e353cefbe1a2553e753ab3

  • SSDEEP

    49152:8vGlL26AaNeWgPhlmVqvMQ7XSKGSRJ6pbR3LoGd+THHB72eh2NTf:8vGL26AaNeWgPhlmVqkQ7XSKGSRJ6rP

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.154:4782

Mutex

ba502bba-c1c8-4a0b-95e6-4b1a3d5f551e

Attributes
  • encryption_key

    7195172212FD0C3E2300AE89FC3318C365A0CFF8

  • install_name

    window security.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    window security

  • subdirectory

    C:\Windows\System32

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "window security" /sc ONLOGON /tr "C:\Windows\System32\window security.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:4428
    • C:\Windows\System32\window security.exe
      "C:\Windows\System32\window security.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3640
      • C:\Windows\System32\schtasks.exe
        "schtasks" /create /tn "window security" /sc ONLOGON /tr "C:\Windows\System32\window security.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2768
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.0.139893765\391655219" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99764600-2c0d-48ce-89e3-5e7b99a2bed1} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 1964 18be6dd9358 gpu
        3⤵
          PID:4332
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.1.2048140710\1961094550" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf96a93b-f99b-4382-b612-b53c2d423a4a} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 2364 18bda371c58 socket
          3⤵
            PID:4676
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.2.2042228525\1882891753" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2872 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65c3b4e0-9562-4afa-84c9-b2d62bb4d493} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 2984 18be6d59458 tab
            3⤵
              PID:3412
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.3.503966835\1877543414" -childID 2 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db5b5b36-951b-4147-a5f4-0eb0aca0978f} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 3604 18bda362258 tab
              3⤵
                PID:5084
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.4.110759247\1023639588" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a796236b-d1b8-4c20-969b-8c1e257958b5} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 4300 18bebfec658 tab
                3⤵
                  PID:3688
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.5.874469985\2107388083" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5060 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3ec3c84-2e55-40c3-8870-c9837edee9f7} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 5076 18bed391758 tab
                  3⤵
                    PID:5680
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.6.1279530681\734125218" -childID 5 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ce70376-e6d5-4222-afe2-fed039914eab} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 5216 18bed392658 tab
                    3⤵
                      PID:5700
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.7.951141115\299101342" -childID 6 -isForBrowser -prefsHandle 2824 -prefMapHandle 5404 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46a12b30-2ed3-480a-8dfb-1f97a2d2f1c9} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 5496 18bed393e58 tab
                      3⤵
                        PID:5712
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                    1⤵
                      PID:6044

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

                      Filesize

                      13KB

                      MD5

                      0b415232f95ebdcbe3a633519bf7ca72

                      SHA1

                      69b4569e310ba3d5d5af10808f06f9ba6d684573

                      SHA256

                      63c7fe9535ced68f5abd4e714f8c45cff6472aa071c6f90d268128a3000f1ddb

                      SHA512

                      cd5be39b0f1688e52d3b1bf8d066f6bb3745b6458f53be2770ac233cc644fe7c39914033b55a967d0734f4e725e14ccd4ecfea89adf0ed79d7a5fa11b17a597c

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                      Filesize

                      442KB

                      MD5

                      85430baed3398695717b0263807cf97c

                      SHA1

                      fffbee923cea216f50fce5d54219a188a5100f41

                      SHA256

                      a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                      SHA512

                      06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                      Filesize

                      8.0MB

                      MD5

                      a01c5ecd6108350ae23d2cddf0e77c17

                      SHA1

                      c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                      SHA256

                      345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                      SHA512

                      b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      064332ba90f38c7c67c23134cb127cca

                      SHA1

                      6dcae9d8ccb19011ab4022a88501ff2c508bab9b

                      SHA256

                      d2e65aa40fab5ae1a7a83e9e2c506978e4aa3b1f8e67ca45e54e5f0ae8d12ce1

                      SHA512

                      931b191d5db0a56d1a8b48b7b3a2301d272fc628764d3a942778a30d635c9562d4b0cdeb21fe3e8089193261274fa3c5a5d6612d5f305c73153ed17c7ef59fd8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\66a90592-66ca-42c9-97f0-c7045cbe2448

                      Filesize

                      746B

                      MD5

                      53acb3edfc57ff3397f1bd7223162313

                      SHA1

                      461777b1b0718950ec86bc78f7c8567a6549857b

                      SHA256

                      8f4d216902ab1d444da26d9767947f2f64b1ed60aae9af09a4da2aa44266e1c0

                      SHA512

                      6202d0138085a33a410fa2aa37801e72514e6e8e82cf9bc72b4ab9e683c68fe9166ee89284a97be170ccc38fd4bf90cf030463fd0624a470d4d1e34b0b3ff397

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\f55b2e08-2546-4ed9-8683-69aec6970509

                      Filesize

                      11KB

                      MD5

                      4dc5100848732d9d02ea6b6abf113901

                      SHA1

                      44ff952c6df297489d80f02b3911d87b7ff8172e

                      SHA256

                      05ab63a89c81539ec728bf034e92ac6a9d6404b9a10901d156f548954c0a4e44

                      SHA512

                      4dcf8ee3fbc9be7181ae277c4acdbf5e55cdfce3a65b64bda67ba21db95d1b73d77a747ca8aa82c5917f3e0fb007d3c7918161c01f393aec2696423cabf9d537

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                      Filesize

                      997KB

                      MD5

                      fe3355639648c417e8307c6d051e3e37

                      SHA1

                      f54602d4b4778da21bc97c7238fc66aa68c8ee34

                      SHA256

                      1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                      SHA512

                      8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                      Filesize

                      116B

                      MD5

                      3d33cdc0b3d281e67dd52e14435dd04f

                      SHA1

                      4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                      SHA256

                      f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                      SHA512

                      a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                      Filesize

                      479B

                      MD5

                      49ddb419d96dceb9069018535fb2e2fc

                      SHA1

                      62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                      SHA256

                      2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                      SHA512

                      48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                      Filesize

                      372B

                      MD5

                      8be33af717bb1b67fbd61c3f4b807e9e

                      SHA1

                      7cf17656d174d951957ff36810e874a134dd49e0

                      SHA256

                      e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                      SHA512

                      6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                      Filesize

                      11.8MB

                      MD5

                      33bf7b0439480effb9fb212efce87b13

                      SHA1

                      cee50f2745edc6dc291887b6075ca64d716f495a

                      SHA256

                      8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                      SHA512

                      d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                      Filesize

                      1KB

                      MD5

                      688bed3676d2104e7f17ae1cd2c59404

                      SHA1

                      952b2cdf783ac72fcb98338723e9afd38d47ad8e

                      SHA256

                      33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                      SHA512

                      7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                      Filesize

                      1KB

                      MD5

                      937326fead5fd401f6cca9118bd9ade9

                      SHA1

                      4526a57d4ae14ed29b37632c72aef3c408189d91

                      SHA256

                      68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                      SHA512

                      b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                      Filesize

                      8KB

                      MD5

                      d5ab38fb161a8a9fa43003c8bc42a001

                      SHA1

                      a9e24a1023f8c239ba6f199bde0b3d1303ab7271

                      SHA256

                      a2a6be9a0625a9ba6c4500a5b900d6acf8bf858f692874e2d01dab33ccc007ae

                      SHA512

                      50ba3ef11dfe06f474fac08f612d5be4bc2a0c7fc99551af63c20e7e0d4cf327a3d2d5540b4aad953a1d42c81398946d601455a1d9532e9520ebf26abf873c0f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      9bcda68cde7944353f61d96e94394afe

                      SHA1

                      1b33794d32c8576ebbb35498b6280e23f174ddd0

                      SHA256

                      acb4c752b5c4d359186be0e0789eed60aacb7d34cc6f2ce8cdf36fe34f9eeab2

                      SHA512

                      c619d48f348a266fd8042bbe1c3ac6133be17823797a0395d8b4521016112d71e71cde2981197ec8289098baaecbf9d3a4f24f56962431f3d8ee0c3d81705bf1

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      e3486a221a3064bc9f42ee13c9cd33b1

                      SHA1

                      964e7da68f61325f00d0168c5d6c26bbe71a5ed9

                      SHA256

                      3f950cb627022dfd499e725474bd996a6aea63b9e5c8036d13455ba3fdb4934f

                      SHA512

                      6673afcd7a4dfa4b69a8484e4b7d46ee209f94138a9cca78c0d9781058b792424d4dc85e8a4dedb021129674741fe7fd56d39ca405092cbc2d6aec5bf4250b7f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                      Filesize

                      6KB

                      MD5

                      aeda38a9d6bc30a5f54b384f20a1b4b8

                      SHA1

                      0dcc2f57c2c387ffd3facb09dd19907011fc2ecc

                      SHA256

                      b3f66a3cf61cafe8024e5db7275dac2edb33366fb51162e758a0cb1e3216b0de

                      SHA512

                      3e311e5d079f2fea14fa828a6deea443888cd96395b24b22983ece06d8959b54f4929753ab6f31d5dbe257116179857535ae657f188e305e32e117b39bb29ede

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      1KB

                      MD5

                      37c66f7997481d5f6dc28260ce40bcda

                      SHA1

                      e5bbad45018ef7b220c348ce830cd05276067cb3

                      SHA256

                      aa6718b9ee2a6b30fbd6498934d17a72b1368f582b4713dcfcfac0902115a457

                      SHA512

                      532fb049834bee7e6e0f9424e5eb8bdbbfdeddf2f2de0ac4863cee77ee92cf2c0bfb2bca7b67056d861e16bb03c61e30c73ad0356ead7c7a5e1ff106badf508f

                    • C:\Windows\System32\window security.exe

                      Filesize

                      3.1MB

                      MD5

                      4d037c46eaf6b2e5ae5db85ef045c0d1

                      SHA1

                      7bc3b6647192157a2cc4894f4c58365d9932a2cf

                      SHA256

                      c18eadfdcee5050757e12c48fc44db31612863eb37db0fbc2dcbaad7ff5ae821

                      SHA512

                      163d60321af8d3da76d10ea550b4c792dd0b6a18abe603ab049043246b2136fb2543f8089e3e5d3fbd6e6bfcf1786f4f7b8a96cb28e353cefbe1a2553e753ab3

                    • memory/1600-11-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1600-0-0x00000000008F0000-0x0000000000C18000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/1600-2-0x000000001B9F0000-0x000000001BA00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1600-1-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3640-9-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/3640-10-0x000000001BA30000-0x000000001BA40000-memory.dmp

                      Filesize

                      64KB

                    • memory/3640-13-0x000000001C750000-0x000000001C802000-memory.dmp

                      Filesize

                      712KB

                    • memory/3640-12-0x000000001BB40000-0x000000001BB90000-memory.dmp

                      Filesize

                      320KB

                    • memory/3640-16-0x000000001D080000-0x000000001D5A8000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/3640-15-0x000000001BA30000-0x000000001BA40000-memory.dmp

                      Filesize

                      64KB

                    • memory/3640-14-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

                      Filesize

                      10.8MB