Resubmissions

28-04-2024 22:49

240428-2rygzsbb42 10

Analysis

  • max time kernel
    27s
  • max time network
    29s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 22:49

General

  • Target

    JPoint_exe..scr

  • Size

    29.1MB

  • MD5

    3a642521a98b0fbd81443aa9c11f17c3

  • SHA1

    a124b3dd773c39af691a616ad36dc4df14c64dfc

  • SHA256

    5eecb69d92705c3bf225df3f4adc7965bd73b1c60f49bdf345cf1657a1dba84d

  • SHA512

    6c863f1c81c08573b4950fbfa210a49106d7d503a808de8e45f72cb12b326fe84c11124c83d6db59edbf164eb855fa0723d4cbd43f03d6f5a3d80b77d604a964

  • SSDEEP

    393216:TCUjvuM6PCZZIPGRVW2GHm3pVO/Gz/goYI4qq0EyEv1B35t1is3z1fr+4fLnjUme:TCJq4uPYHWVO9oyV3n1bz1z+WHFcg

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot6757178519:AAEAoqCn5s-kTgxcmCUqE1t4PNO8wKlQVag/sendMessage?chat_id=1328108259

Signatures

  • BlackGuard

    Infostealer first seen in Late 2021.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JPoint_exe..scr
    "C:\Users\Admin\AppData\Local\Temp\JPoint_exe..scr" /S
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\LocalNeiiJnQNpT.exe
      "C:\Users\Admin\AppData\LocalNeiiJnQNpT.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Users\Admin\AppData\Local\Temp\v2.exe
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
    • C:\Users\Admin\AppData\LocalKxgwwqKxPK..exe
      "C:\Users\Admin\AppData\LocalKxgwwqKxPK..exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalKxgwwqKxPK..exe

    Filesize

    21.3MB

    MD5

    650a1cce61876f1a3739e398c720893f

    SHA1

    377998a6fb0d5ff55cec8a015cd7c7cf10f555d3

    SHA256

    8ed9a032b5f21c4b12bb76dd191e08af6943083c0619fdb07a8e2fff2c2bae03

    SHA512

    495306321bafc3d85bce9978423828e24d0e71a82d08833cc2b566af5f78a550e72d1962890bc5fb252ef44f103b8fbc6ad90490607d797ea6376ae37e0a7f20

  • C:\Users\Admin\AppData\LocalNeiiJnQNpT.exe

    Filesize

    7.7MB

    MD5

    e5c2b6c60c817774bae0b34af8817eed

    SHA1

    795e04e91de7c453e3079c3c3587115f5c3d4037

    SHA256

    5deb49aa660568188c8e4138c85d4cf5dbae3121bb544ea80ecb360bcfc27086

    SHA512

    a7f07e53177807dbef797bd151ff3f6b760eed8d01a85fc18ecf621b4fd5f6b218fe9152c7567669fced04c5369e7d237b89c3230beca7fe17df7e7e6a1fd75a

  • C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

    Filesize

    571KB

    MD5

    169b6d383b7c650ab3ae2129397a6cf3

    SHA1

    fcaef7defb04301fd55fb1421bb15ef96d7040d6

    SHA256

    b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf

    SHA512

    7a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe

    Filesize

    183KB

    MD5

    95fd1f57da049790723c6011a8bcf9d4

    SHA1

    16a1dfd3dd92cdc8a80cd68aa66622a90d41846f

    SHA256

    5a9fe17d41938d555a4c3e53cdc38cde79ce54a6aced83ff65eb7628e353c49c

    SHA512

    da590979b848a7a59dc682fc97f39d6cd6f5defe55222c3e6b4fe0eba9dfae1cb943deedea294691fd9bf8bb03b62627e5961064f9a7d17f9acb4d3c2d744fc4

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll

    Filesize

    116KB

    MD5

    e9b690fbe5c4b96871214379659dd928

    SHA1

    c199a4beac341abc218257080b741ada0fadecaf

    SHA256

    a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

    SHA512

    00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\d3dcompiler_47.dll

    Filesize

    4.7MB

    MD5

    cb9807f6cf55ad799e920b7e0f97df99

    SHA1

    bb76012ded5acd103adad49436612d073d159b29

    SHA256

    5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

    SHA512

    f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so

    Filesize

    13.8MB

    MD5

    9dd98b582f7c7abdb502ce89aa182b58

    SHA1

    c19a63f37f8628c01fafdf905fe7cdfeaaf114f4

    SHA256

    f86e82b9475317faeac418a8aba9ea8432cb0253956b30ed92005043d6c3b3fb

    SHA512

    e5d113a7e9a604a0e89101bb746c31a996806a1f51d9bd111fba30f7673c5b2f439b3b4493454bc9799788d871719a3c11d7a65f594714d1ee6dbfbebf11e9f4

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin

    Filesize

    14KB

    MD5

    29b2176e332fcad27b610e65b68d9b25

    SHA1

    41e5ce04d4ba90e0c0a0a04277065d4aa9203567

    SHA256

    80f2fb484f4bd47358e6ab0c0b8c0be903ebed49a6342ea6b6ce3c90a731582f

    SHA512

    0e7528b70ee2e024792ba91a535a1a6b93335e4b0845bf000d0e84ca05d68a28390b3d6e47a3ae11cacd6284e6429662597d53b5f2d041553e4c1b2c9b87df7b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json

    Filesize

    413B

    MD5

    fb1230bb41c3c1290008b9e44059dd39

    SHA1

    66493d0f8a6a112d8376cd296b05c277b111dca1

    SHA256

    2429b610ba9010211d18626d311d3dea7274473c2dd50fae833ed739b67b1292

    SHA512

    d5ae9b9124a7c7f8c3d04c4750459c9bc620e3aeb84f5d56a64308eb9b343d4fb62f8b3e03210e04ad90b91bbbb35dd1a56148d06dbcc0872f99e9b1b9d37c7c

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Ori%20and%20the%20Blind%20Forest.jpg

    Filesize

    93KB

    MD5

    babd1b019be8944f7ef6c64c8194bc8d

    SHA1

    702a50d3e3a0933db4dc1f37423bca3b5c52acde

    SHA256

    71ea07c900e7993072f4896c0ab621303feaf4d13b7c9a4b2993e06122b10f76

    SHA512

    6a854fc0db7206dd182f6ebc594d763b62a75f64663d3e58029cfa2586048838fe8878b043d174923e05f4e3cd2f3e9d96a6dcf5ba8bbd7322bbc3540bbb8b0d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Bold.otf

    Filesize

    46KB

    MD5

    e57b6bc24b970a377574124e026a7c01

    SHA1

    00184aedd4ee4d2ca6b5c87cf41e78f64304c89b

    SHA256

    b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6

    SHA512

    c162cd8a7130d2c94dac5c3dad58794f368436cbf782e8063c245d4cae405af6aa25c2f381549defd520c3f7cdbc04a27f891798697e9c291317d3b3ba82efdc

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Light.otf

    Filesize

    45KB

    MD5

    d10d77b03ba3abe6ccc1c142d9852595

    SHA1

    6108edf0cfb3d5f25e3c593949c301c5c2aa5f25

    SHA256

    3c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44

    SHA512

    71c4fc3b6f43b4125c5ea5ae09297d72446de81ffc2928fee33aef386754e60dab11cc170c4d6689dd6eeac451f2a57b9d3372278f750dca6ed39ec82fcf9368

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Medium.otf

    Filesize

    46KB

    MD5

    df63e8855d04ab0e25d2bb6a0b1fabfb

    SHA1

    5512dc285f36cdf7da5ba5eabaca128ca3442537

    SHA256

    a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed

    SHA512

    eba8afd3289089841e4eda4abd992c2e2020d18d44741733b5a51a2a1e0c0982ffd9da187aa56ba3b891bc259398ec156e08e45265f7218e87eb914794ca69d6

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Regular.otf

    Filesize

    45KB

    MD5

    d969db6adb881f1dfa91a5b7ec0154d9

    SHA1

    d7b44b20eb246b0ff5c41147c0d0fb96fde47c48

    SHA256

    c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152

    SHA512

    2a225a8c12b46aa14e14dd547c6a55c80aef6bfe8cc791dcf60a14ef91994eddc4dec473d856f7c2446d62a41d017d256b64b603d87ae45e75fdeb2230deb5b2

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-SemiBold.otf

    Filesize

    46KB

    MD5

    5177edfb54762b59df676052d11b363d

    SHA1

    fa18815bf4914b93d587c2758b65e234ad51b38b

    SHA256

    50000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d

    SHA512

    7475fe248eafd528a05acab94f3973eeeb0d169203769ee6b42d007b5fa0605a58a290e145d74d57e17486367bacffed22e4a88e576fa9f65d000e487aa78e27

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\close.svg

    Filesize

    201B

    MD5

    7f8d672a2849987b498734dcb90f0c51

    SHA1

    e53b9319bf964c15099080ac5497ee39f8bab362

    SHA256

    4a290648cd1cfaaf1db4909d7552ae8cb83cb0b0e36770e64d153ab07ce6e7d4

    SHA512

    b3ddbf719f42440238c55cee896409179b4562ffe74f607d3640f623c8264c2fd2000b085dfd9a25ffd8ba2166695dcd663efec56cdac679f9993cfb602459d4

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\cloud-off.svg

    Filesize

    1KB

    MD5

    e99140f842b471d330fc27cd73817c4c

    SHA1

    9957147463f586824b65bc7bfb121d33a9523a96

    SHA256

    0f4cb470185e3c6c26ae033a3a88e3995340bb08a63432dd9ebb82b73dd665ae

    SHA512

    f579aef41980539675609c62ff4d80dde22bad59917d439dbd4d325173bed3f24534a72e9903aef58c6ee5d4b03fcb7d0a7be8c93c35da6dbb2e1e046b7da0f2

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\icons\window-minimize.svg

    Filesize

    151B

    MD5

    d47255b6d3e685cac4804eb58207d0b6

    SHA1

    7fe02211cf6b77f3971522a3b3888460491ae153

    SHA256

    29bc4875912360fac26586adaca21449026cc2cf6479f9d9bbb066abe2dd2640

    SHA512

    b39c96fd2479585b32146a3b33a5419f665391f1b1857b08896c8254b48fdb733551bd9974a3c7dcfb679cbb5b35ed9b8f538f5c44156d399b02b8d0d4fe95ef

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png

    Filesize

    79KB

    MD5

    3577f702479e7f31a32a96f38a36e752

    SHA1

    e407b9ac4cfe3270cdd640a5018bec2178d49bb1

    SHA256

    cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2

    SHA512

    1a4a03931ab56c8352382414f55eb25b324e11890d51ba95597dbd867b35db45db5adcefb47d95b3763f413a66e3228e59531bdbd5ba5541469196adb5eb3d70

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat

    Filesize

    798KB

    MD5

    da48e432fe61f451154f0715b2a7b174

    SHA1

    51b6add0bbc4e0b5200b01deca5d009f1daf9f39

    SHA256

    65ea729083128dfce1c00726ba932b91aaaf5e48736b5644dd37478e5f2875ac

    SHA512

    5af9c1e43b52536272a575ca400a9eee830a8fcecb83bb1a490515851bef48957d8de669b9f77b8614eb586838af23385e1afce622edb82a90ec7549f882d381

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll

    Filesize

    17.1MB

    MD5

    9cc0d19cf87a7ad0eb1064d40042812b

    SHA1

    81caa7d244a07f79947f7d35c61816f31bb7b147

    SHA256

    8d40c3ee7110217470a322ce85bbfb5aeda2ec123b057265c4f26da2f679ab1c

    SHA512

    0bc448545372bf841ffe0a49f5cd3b18e88d0cffe849bedb67bc8c500ede61c9c230aec44d4ff478abe4403ed06d978f0e82ec637f1afd5c80e6aaf40c0d3f1b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll

    Filesize

    559KB

    MD5

    c3d497b0afef4bd7e09c7559e1c75b05

    SHA1

    295998a6455cc230da9517408f59569ea4ed7b02

    SHA256

    1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

    SHA512

    d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll

    Filesize

    48KB

    MD5

    eb49c1d33b41eb49dfed58aafa9b9a8f

    SHA1

    61786eb9f3f996d85a5f5eea4c555093dd0daab6

    SHA256

    6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

    SHA512

    d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

  • C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

    Filesize

    1.3MB

    MD5

    0a1e95b0b1535203a1b8479dff2c03ff

    SHA1

    20c4b4406e8a3b1b35ca739ed59aa07ba867043d

    SHA256

    788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e

    SHA512

    854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e

  • C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

    Filesize

    410KB

    MD5

    056d3fcaf3b1d32ff25f513621e2a372

    SHA1

    851740bca46bab71d0b1d47e47f3eb8358cbee03

    SHA256

    66b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9

    SHA512

    ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180

  • C:\Users\Admin\AppData\Local\Temp\v2.exe

    Filesize

    271KB

    MD5

    a3894132a98e32c4d2240890884789c9

    SHA1

    b6a8e8840fd53c6cc214c57b702d0ff21bf3e7f7

    SHA256

    34490ef4ed975183fb977ae970f196beee3d052db95f2d40f26a4c8012043f64

    SHA512

    90eae90e997d2ac0a9298322d2440b58033f6059ec32b3c9b2c3f9620ed3150daad01a269d421a27692051d12f97399a380ec67fd34bb0767c3398763e661223

  • C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json

    Filesize

    269B

    MD5

    09b63d7bd61421abdb41e60c1ed56c48

    SHA1

    9b7bea3d801af32796cf4704c054a9f3405d4e04

    SHA256

    a748f9cad91d527979fb13f6413ada3c8f6812debbe34fe5804f24a7ca017bd1

    SHA512

    7f754e314599d707a94a94f18743e8b872443ccfe4a3f35021c06fec21db0b6b6439f539ac140859a6ff15cf2619c3930f556c162d2064504236c8daa8763999

  • C:\Users\Admin\AppData\Roaming\uBywLFLXyBVLFKTDJGL.Admin\Browsers\Firefox\Bookmarks.txt

    Filesize

    105B

    MD5

    2e9d094dda5cdc3ce6519f75943a4ff4

    SHA1

    5d989b4ac8b699781681fe75ed9ef98191a5096c

    SHA256

    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

    SHA512

    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

  • C:\Users\Admin\AppData\Roaming\uBywLFLXyBVLFKTDJGL.Admin\Process.txt

    Filesize

    115B

    MD5

    8878f160c769dd4c4493b35665db2d66

    SHA1

    1f7900db0cc32b687df4852450560d40d4942b7d

    SHA256

    f8b9665f5774a9072593a1e437ecedf9a4c38a5637e112a3b4bd670ffe3e884c

    SHA512

    d7f6476d1f57721ba94859e644536bdcbf3bf914d812f70ec7eda2c19bc618448b413608ef9e29bf02d11b4f0906b1d7a7a53e4b73e9ccd34b10baef21c709c9

  • C:\Users\Admin\AppData\Roaming\uBywLFLXyBVLFKTDJGL.Admin\Process.txt

    Filesize

    394B

    MD5

    e4a396fdd17d21cb108f85582663b8f1

    SHA1

    04b9dc1720ec9ef5ba71197625726fb08fd9d264

    SHA256

    78fcf8fa85ffb35a9526d11908ef5e813b62672e066b6413db9bb5f861b0b1d9

    SHA512

    5d21dfef1cbdc2ca4370e4e7eeffdc7ed6570bea2bd00165f4cce607eb4bfc0bb87fe016cdf4b9351eb600112cfa74822a802a796496a9f3493ef9e6a75fce38

  • C:\Users\Admin\AppData\Roaming\uBywLFLXyBVLFKTDJGL.Admin\Process.txt

    Filesize

    840B

    MD5

    15b981e62cbb1daea4b995c27471d3d3

    SHA1

    caff26f5f0bec370af9646840a0b22bc8c3c5579

    SHA256

    13e0ed94eba36ff355e4e6cf9103daa50d51b2e234104ec8f2c57e7845ad8195

    SHA512

    a950d7023c0d8e547b4d26e762dae3235dc5dc8e957bcee58830265ed6b8373238b628cd014ba6d3625469bcf18eb5ebe8460af2dabe2e6ab2db77102c1cd84e

  • C:\Users\Admin\AppData\Roaming\uBywLFLXyBVLFKTDJGL.Admin\Process.txt

    Filesize

    1KB

    MD5

    cef448bd21542b6d3ae61dd7d5b0c9d5

    SHA1

    4ac73fbc80b59fa5959dc35adccf8c48267e28f5

    SHA256

    1fa9394b1503134eb64dea19d77305e94a5372a5fc3592dd6ebba24702cc3280

    SHA512

    864aa0aa7ce5c4ed54b364d2b1fa20681aeab737527ed61e775f5a627720010a0c8a401ab08306c723474d196ecf616ce1bd184e05aff3b227b25803a349d138

  • memory/1156-562-0x000001F589100000-0x000001F589ED5000-memory.dmp

    Filesize

    13.8MB

  • memory/1156-563-0x000001F589100000-0x000001F589ED5000-memory.dmp

    Filesize

    13.8MB

  • memory/1156-561-0x000001F589100000-0x000001F589ED5000-memory.dmp

    Filesize

    13.8MB

  • memory/1156-564-0x000001F588F40000-0x000001F588F41000-memory.dmp

    Filesize

    4KB

  • memory/1156-560-0x000001F588F30000-0x000001F588F31000-memory.dmp

    Filesize

    4KB

  • memory/2792-210-0x00000000059B0000-0x00000000059D2000-memory.dmp

    Filesize

    136KB

  • memory/2792-299-0x0000000005720000-0x000000000575C000-memory.dmp

    Filesize

    240KB

  • memory/2792-302-0x0000000007C50000-0x0000000007E12000-memory.dmp

    Filesize

    1.8MB

  • memory/2792-196-0x0000000005AC0000-0x0000000005B10000-memory.dmp

    Filesize

    320KB

  • memory/2792-193-0x0000000005E80000-0x0000000005F12000-memory.dmp

    Filesize

    584KB

  • memory/2792-134-0x0000000005880000-0x0000000005912000-memory.dmp

    Filesize

    584KB

  • memory/2792-57-0x0000000000B30000-0x0000000000B7A000-memory.dmp

    Filesize

    296KB

  • memory/2792-217-0x0000000006660000-0x00000000069B4000-memory.dmp

    Filesize

    3.3MB

  • memory/2792-688-0x0000000007E20000-0x0000000007E96000-memory.dmp

    Filesize

    472KB

  • memory/2792-686-0x0000000007B80000-0x0000000007BE6000-memory.dmp

    Filesize

    408KB

  • memory/2792-300-0x00000000056A0000-0x00000000056C1000-memory.dmp

    Filesize

    132KB

  • memory/2792-596-0x00000000083D0000-0x0000000008974000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-218-0x0000000006580000-0x00000000065CC000-memory.dmp

    Filesize

    304KB

  • memory/2792-216-0x00000000065F0000-0x0000000006658000-memory.dmp

    Filesize

    416KB

  • memory/2944-0-0x00007FFB68A50000-0x00007FFB693F1000-memory.dmp

    Filesize

    9.6MB

  • memory/2944-1-0x00007FFB68A50000-0x00007FFB693F1000-memory.dmp

    Filesize

    9.6MB

  • memory/2944-2-0x0000000003070000-0x0000000003080000-memory.dmp

    Filesize

    64KB

  • memory/2944-38-0x00007FFB68A50000-0x00007FFB693F1000-memory.dmp

    Filesize

    9.6MB