Resubmissions

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

230824-nda8msdf8z 10

05-08-2023 22:52

230805-2tn2bsfa82 10

24-07-2023 06:25

230724-g6s6laag35 10

22-07-2023 15:57

230722-tee6wabg5w 10

20-07-2023 23:19

230720-3bb5gsbf5v 10

20-07-2023 23:06

230720-23f23sba63 10

03-02-2021 11:43

210203-6bgge2nfan 10

Analysis

  • max time kernel
    150s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 16:25

General

  • Target

    42f972925508a82236e8533567487761.exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

Extracted

Family

babylonrat

C2

sandyclark255.hopto.org

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 2 IoCs
  • Warzone RAT payload 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Users\Admin\AppData\Local\Temp\wQieYR1PtPWNgPP2.exe
      "C:\Users\Admin\AppData\Local\Temp\wQieYR1PtPWNgPP2.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:496
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:3700
    • C:\Users\Admin\AppData\Local\Temp\Lb2tYcnWZGClJfol.exe
      "C:\Users\Admin\AppData\Local\Temp\Lb2tYcnWZGClJfol.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2212
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        3⤵
        • Executes dropped EXE
        PID:4652
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1684
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 1684
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4608
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2820
    • C:\Users\Admin\AppData\Local\Temp\hJEJlbyXYAzGJy0l.exe
      "C:\Users\Admin\AppData\Local\Temp\hJEJlbyXYAzGJy0l.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Drops file in Drivers directory
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
            PID:3932
          • C:\Users\Admin\Documents\excelsl.exe
            "C:\Users\Admin\Documents\excelsl.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5100
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Executes dropped EXE
              PID:448
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1452
              • C:\Windows\SysWOW64\notepad.exe
                notepad
                6⤵
                  PID:4364
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 1144
                5⤵
                • Program crash
                PID:3472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1128
            3⤵
            • Program crash
            PID:4588
        • C:\Users\Admin\AppData\Local\Temp\G54Lzg17MUcxcRu6.exe
          "C:\Users\Admin\AppData\Local\Temp\G54Lzg17MUcxcRu6.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
            3⤵
            • Creates scheduled task(s)
            PID:3592
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmp.bat""
            3⤵
              PID:4068
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                4⤵
                • Delays execution with timeout.exe
                PID:3852
              • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2872
          • C:\Users\Admin\AppData\Local\Temp\MfmPRo8HzArLELho.exe
            "C:\Users\Admin\AppData\Local\Temp\MfmPRo8HzArLELho.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
              "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
              3⤵
              • Executes dropped EXE
              PID:1136
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 1148
              3⤵
              • Program crash
              PID:392
          • C:\Users\Admin\AppData\Local\Temp\6ZJ2ey5PduLFquJX.exe
            "C:\Users\Admin\AppData\Local\Temp\6ZJ2ey5PduLFquJX.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3708
            • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
              "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2628
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1148
              3⤵
              • Program crash
              PID:1192
          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
            "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
            2⤵
            • Executes dropped EXE
            PID:2492
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1340
            2⤵
            • Program crash
            PID:4744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4512 -ip 4512
          1⤵
            PID:3784
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3708 -ip 3708
            1⤵
              PID:752
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1432 -ip 1432
              1⤵
                PID:3488
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2304 -ip 2304
                1⤵
                  PID:2356
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5100 -ip 5100
                  1⤵
                    PID:3484

                  Network

                  MITRE ATT&CK Matrix ATT&CK v13

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Defense Evasion

                  Modify Registry

                  2
                  T1112

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Discovery

                  Query Registry

                  1
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log
                    Filesize

                    400B

                    MD5

                    0a9b4592cd49c3c21f6767c2dabda92f

                    SHA1

                    f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

                    SHA256

                    c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

                    SHA512

                    6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

                  • C:\Users\Admin\AppData\Local\Temp\6ZJ2ey5PduLFquJX.exe
                    Filesize

                    336KB

                    MD5

                    e87459f61fd1f017d4bd6b0a1a1fc86a

                    SHA1

                    30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                    SHA256

                    ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                    SHA512

                    dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                  • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                    Filesize

                    3.6MB

                    MD5

                    e3f29ef222fa7b9585e5cb5421388b49

                    SHA1

                    3143bda750ff88f1bcf0b5b96d29842c69cd5250

                    SHA256

                    f27cd8f8409d74762a5f4de148f9d2720596c6b4a322ede419d22b47876c9387

                    SHA512

                    575727700e704aaf7d0d5771a0306ae3a99729ee3c38245654f034b836921fd62f7faa0b72ba4a5556ebdbe92cce5f1ae8ae71e134725b6cbd493023c7c6c025

                  • C:\Users\Admin\AppData\Local\Temp\G54Lzg17MUcxcRu6.exe
                    Filesize

                    376KB

                    MD5

                    590acb5fa6b5c3001ebce3d67242aac4

                    SHA1

                    5df39906dc4e60f01b95783fc55af6128402d611

                    SHA256

                    7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                    SHA512

                    4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                  • C:\Users\Admin\AppData\Local\Temp\Lb2tYcnWZGClJfol.exe
                    Filesize

                    801KB

                    MD5

                    9133c2a5ebf3e25aceae5a001ca6f279

                    SHA1

                    319f911282f3cded94de3730fa0abd5dec8f14be

                    SHA256

                    7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                    SHA512

                    1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                  • C:\Users\Admin\AppData\Local\Temp\MfmPRo8HzArLELho.exe
                    Filesize

                    366KB

                    MD5

                    f07d2c33e4afe36ec6f6f14f9a56e84a

                    SHA1

                    3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                    SHA256

                    309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                    SHA512

                    b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                  • C:\Users\Admin\AppData\Local\Temp\hJEJlbyXYAzGJy0l.exe
                    Filesize

                    742KB

                    MD5

                    3e804917c454ca31c1cbd602682542b7

                    SHA1

                    1df3e81b9d879e21af299f5478051b98f3cb7739

                    SHA256

                    f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                    SHA512

                    28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                  • C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmp.bat
                    Filesize

                    153B

                    MD5

                    85baf87cac06edd195943a2960367972

                    SHA1

                    e846a4724b233873142eceb0f2878cd6767a64df

                    SHA256

                    70cb527c1090ed15e005c45f3d8263c009e407f17fc297cbb00129932e5d1670

                    SHA512

                    436c99b6c9f82c953ccc862de580603466e3b46d0507afb9803beea122921d568a597ccbc8293ea98e515a2ef3b272cf5f0a7bb2f62a28c7bca989d50cc66011

                  • C:\Users\Admin\AppData\Local\Temp\wQieYR1PtPWNgPP2.exe
                    Filesize

                    472KB

                    MD5

                    2819e45588024ba76f248a39d3e232ba

                    SHA1

                    08a797b87ecfbee682ce14d872177dae1a5a46a2

                    SHA256

                    b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                    SHA512

                    a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                  • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    Filesize

                    39.7MB

                    MD5

                    87e882e75107d8d77806c25fe3d784cd

                    SHA1

                    4b3a09b2ac0ad4d3a0c103959c4ea0ba37821875

                    SHA256

                    4f71a241d742f88bdb67b38a9688e91ef025942d5bc7fc8da64fe84c1ded665d

                    SHA512

                    e63a790d8ed89bd5c880ceae862fa1ccaa231e55c09dfb514a91feb4b85fed2216b143666b7b76f090b04e64aa7640a7860f739939bfc537102bffbd77c81382

                  • memory/496-33-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/496-44-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/496-55-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/496-188-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/1136-99-0x0000000000400000-0x0000000000554000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/1136-96-0x0000000000400000-0x0000000000554000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/1452-224-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1452-229-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1452-228-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1452-226-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1684-195-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-197-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-232-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-216-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-200-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-202-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-204-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-205-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1684-199-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/1724-109-0x000000000A240000-0x000000000A252000-memory.dmp
                    Filesize

                    72KB

                  • memory/1724-209-0x000000000A830000-0x000000000A8CC000-memory.dmp
                    Filesize

                    624KB

                  • memory/1724-80-0x0000000000380000-0x00000000003E4000-memory.dmp
                    Filesize

                    400KB

                  • memory/1724-81-0x0000000005170000-0x0000000005714000-memory.dmp
                    Filesize

                    5.6MB

                  • memory/1724-82-0x0000000004C60000-0x0000000004CF2000-memory.dmp
                    Filesize

                    584KB

                  • memory/1724-86-0x0000000005140000-0x0000000005164000-memory.dmp
                    Filesize

                    144KB

                  • memory/1724-83-0x0000000004E20000-0x0000000004E2A000-memory.dmp
                    Filesize

                    40KB

                  • memory/1724-208-0x0000000005EA0000-0x0000000005F06000-memory.dmp
                    Filesize

                    408KB

                  • memory/1724-108-0x0000000005160000-0x0000000005172000-memory.dmp
                    Filesize

                    72KB

                  • memory/2212-247-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2212-57-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2212-70-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2212-56-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2304-164-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2304-71-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2492-78-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/2628-92-0x0000000000400000-0x000000000040F000-memory.dmp
                    Filesize

                    60KB

                  • memory/2628-89-0x0000000000400000-0x000000000040F000-memory.dmp
                    Filesize

                    60KB

                  • memory/2820-214-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/2872-244-0x00000000055D0000-0x00000000055F4000-memory.dmp
                    Filesize

                    144KB

                  • memory/3684-102-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/3684-105-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/3684-107-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/3932-113-0x00000000008F0000-0x00000000008F1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4364-227-0x00000000005A0000-0x00000000005A1000-memory.dmp
                    Filesize

                    4KB

                  • memory/4512-85-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/4512-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/4512-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/4512-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp
                    Filesize

                    4KB