Resubmissions

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

230824-nda8msdf8z 10

05-08-2023 22:52

230805-2tn2bsfa82 10

24-07-2023 06:25

230724-g6s6laag35 10

22-07-2023 15:57

230722-tee6wabg5w 10

20-07-2023 23:19

230720-3bb5gsbf5v 10

20-07-2023 23:06

230720-23f23sba63 10

03-02-2021 11:43

210203-6bgge2nfan 10

Analysis

  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 16:25

General

  • Target

    42f972925508a82236e8533567487761.exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 3 IoCs
  • Warzone RAT payload 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 23 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\LMOZ3bgQY7UB7UVx.exe
      "C:\Users\Admin\AppData\Local\Temp\LMOZ3bgQY7UB7UVx.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2980
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:332
    • C:\Users\Admin\AppData\Local\Temp\5FuDIldYDtx4k35f.exe
      "C:\Users\Admin\AppData\Local\Temp\5FuDIldYDtx4k35f.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2212
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 2212
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            5⤵
            • Executes dropped EXE
            PID:2908
    • C:\Users\Admin\AppData\Local\Temp\gXu3H2JDiCTggSCk.exe
      "C:\Users\Admin\AppData\Local\Temp\gXu3H2JDiCTggSCk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1304
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
            PID:2812
          • C:\Users\Admin\Documents\excelsl.exe
            "C:\Users\Admin\Documents\excelsl.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1140
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Executes dropped EXE
              PID:3028
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Executes dropped EXE
              PID:1544
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1352
              • C:\Windows\SysWOW64\notepad.exe
                notepad
                6⤵
                  PID:2852
        • C:\Users\Admin\AppData\Local\Temp\j5oOvRG2p21AF3IW.exe
          "C:\Users\Admin\AppData\Local\Temp\j5oOvRG2p21AF3IW.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2708
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
            3⤵
            • Creates scheduled task(s)
            PID:2204
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD96E.tmp.bat""
            3⤵
            • Loads dropped DLL
            PID:1164
            • C:\Windows\SysWOW64\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:1740
            • C:\Users\Admin\AppData\Roaming\prndrvest.exe
              "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2824
        • C:\Users\Admin\AppData\Local\Temp\5mzn8QQ4owoeFOUW.exe
          "C:\Users\Admin\AppData\Local\Temp\5mzn8QQ4owoeFOUW.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
            "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
            3⤵
            • Executes dropped EXE
            PID:1512
        • C:\Users\Admin\AppData\Local\Temp\vCT0uX8bfTrNYCys.exe
          "C:\Users\Admin\AppData\Local\Temp\vCT0uX8bfTrNYCys.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2464
          • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
            "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            PID:2236
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:2516
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:1268
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:356
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:1608
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:1200
        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
          2⤵
          • Executes dropped EXE
          PID:2540

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Execution

      Scheduled Task/Job

      1
      T1053

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Defense Evasion

      Modify Registry

      2
      T1112

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\5FuDIldYDtx4k35f.exe
        Filesize

        801KB

        MD5

        9133c2a5ebf3e25aceae5a001ca6f279

        SHA1

        319f911282f3cded94de3730fa0abd5dec8f14be

        SHA256

        7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

        SHA512

        1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

      • C:\Users\Admin\AppData\Local\Temp\5mzn8QQ4owoeFOUW.exe
        Filesize

        366KB

        MD5

        f07d2c33e4afe36ec6f6f14f9a56e84a

        SHA1

        3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

        SHA256

        309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

        SHA512

        b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

      • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
        Filesize

        3.7MB

        MD5

        9d2a888ca79e1ff3820882ea1d88d574

        SHA1

        112c38d80bf2c0d48256249bbabe906b834b1f66

        SHA256

        8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

        SHA512

        17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

      • C:\Users\Admin\AppData\Local\Temp\LMOZ3bgQY7UB7UVx.exe
        Filesize

        472KB

        MD5

        2819e45588024ba76f248a39d3e232ba

        SHA1

        08a797b87ecfbee682ce14d872177dae1a5a46a2

        SHA256

        b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

        SHA512

        a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

      • C:\Users\Admin\AppData\Local\Temp\gXu3H2JDiCTggSCk.exe
        Filesize

        742KB

        MD5

        3e804917c454ca31c1cbd602682542b7

        SHA1

        1df3e81b9d879e21af299f5478051b98f3cb7739

        SHA256

        f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

        SHA512

        28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

      • C:\Users\Admin\AppData\Local\Temp\j5oOvRG2p21AF3IW.exe
        Filesize

        376KB

        MD5

        590acb5fa6b5c3001ebce3d67242aac4

        SHA1

        5df39906dc4e60f01b95783fc55af6128402d611

        SHA256

        7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

        SHA512

        4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

      • C:\Users\Admin\AppData\Local\Temp\tmpD96E.tmp.bat
        Filesize

        153B

        MD5

        759a9ed87e481dac06e16f4e29513ffb

        SHA1

        3dc3246f2e3fca5c53416a0e4aa7e7c45dcbca58

        SHA256

        0efc30da3aad1d9efbcdf1495ecf47dbf482ead1490a1a3fab6baf27146b7332

        SHA512

        64fa9d89366b36ef85bc99e20e79495b02649595d19bee446130ee6743c263752a67f8a97c0bed3930d522d8c77437361c3a2a5e4842466baf7f739c462322fb

      • C:\Users\Admin\AppData\Local\Temp\vCT0uX8bfTrNYCys.exe
        Filesize

        336KB

        MD5

        e87459f61fd1f017d4bd6b0a1a1fc86a

        SHA1

        30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

        SHA256

        ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

        SHA512

        dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

      • C:\Users\Admin\AppData\Roaming\prndrvest.exe
        Filesize

        49.0MB

        MD5

        06c60e3fb4aa501fe749fdcbd8082e0b

        SHA1

        a063008ba377fe7c30b4aea2e7f6fcc90a36d2ba

        SHA256

        ef04b0ed429617fe4c868061316b4f8b1347be2e1d493e8875d0fd1f48553d7e

        SHA512

        87c2d4ccb56b807a5e796f0f3d93b9b39f18f91dc5a379faeee37bdf521641f0330cf3cd1e3ba6a6ae6d763f2f4e2492bf7ba2ea9667266c21cfe87a83bb0f45

      • memory/1304-126-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-141-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-122-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-124-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-128-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-130-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-132-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-134-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-136-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1304-138-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/1304-139-0x0000000000400000-0x00000000004BA000-memory.dmp
        Filesize

        744KB

      • memory/1512-88-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-97-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-92-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-94-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-115-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-90-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-82-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-84-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-86-0x0000000000400000-0x0000000000554000-memory.dmp
        Filesize

        1.3MB

      • memory/1512-96-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/2076-2-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2076-1-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2076-0-0x0000000074121000-0x0000000074122000-memory.dmp
        Filesize

        4KB

      • memory/2076-73-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2236-99-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-101-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-103-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-105-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-107-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-114-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-109-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2236-111-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
        Filesize

        4KB

      • memory/2236-112-0x0000000000400000-0x000000000040F000-memory.dmp
        Filesize

        60KB

      • memory/2708-116-0x00000000005A0000-0x00000000005C4000-memory.dmp
        Filesize

        144KB

      • memory/2708-175-0x00000000008C0000-0x00000000008D2000-memory.dmp
        Filesize

        72KB

      • memory/2708-72-0x00000000008E0000-0x0000000000944000-memory.dmp
        Filesize

        400KB

      • memory/2708-117-0x0000000000860000-0x0000000000884000-memory.dmp
        Filesize

        144KB

      • memory/2708-176-0x0000000001D50000-0x0000000001D62000-memory.dmp
        Filesize

        72KB

      • memory/2792-19-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2792-335-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2812-146-0x0000000000080000-0x0000000000081000-memory.dmp
        Filesize

        4KB

      • memory/2824-342-0x00000000009C0000-0x00000000009E4000-memory.dmp
        Filesize

        144KB

      • memory/2824-339-0x0000000000BE0000-0x0000000000C44000-memory.dmp
        Filesize

        400KB

      • memory/2824-340-0x00000000004A0000-0x00000000004C4000-memory.dmp
        Filesize

        144KB

      • memory/2824-341-0x0000000000960000-0x0000000000984000-memory.dmp
        Filesize

        144KB

      • memory/2824-345-0x0000000000A70000-0x0000000000A94000-memory.dmp
        Filesize

        144KB

      • memory/2824-346-0x0000000000BC0000-0x0000000000BE4000-memory.dmp
        Filesize

        144KB

      • memory/2824-347-0x0000000004340000-0x0000000004352000-memory.dmp
        Filesize

        72KB

      • memory/2980-298-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB

      • memory/2980-18-0x0000000074120000-0x00000000746CB000-memory.dmp
        Filesize

        5.7MB