Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-06-2024 04:19

General

  • Target

    2024-06-08_5606ac542901f5629cf4ccfb2c948a81_cobalt-strike_cobaltstrike.exe

  • Size

    5.9MB

  • MD5

    5606ac542901f5629cf4ccfb2c948a81

  • SHA1

    c1776a56cc0ed978568da4eca2729cb24ef9b15b

  • SHA256

    13a1afd56709420c6d782487d80580262d5ae8cad8d7c7602e3c186fcb35f41d

  • SHA512

    14a95e700fa050e77f95b766b6b41f0f59e95d73bba7a85c49ce876073c11b6ee0bd1424d70936771566ee8d880aa6ed6f17181fdb696aab3ba29580d0652755

  • SSDEEP

    98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 21 IoCs
  • UPX dump on OEP (original entry point) 64 IoCs
  • XMRig Miner payload 64 IoCs
  • Executes dropped EXE 21 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_5606ac542901f5629cf4ccfb2c948a81_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_5606ac542901f5629cf4ccfb2c948a81_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\System\AtjdExT.exe
      C:\Windows\System\AtjdExT.exe
      2⤵
      • Executes dropped EXE
      PID:4992
    • C:\Windows\System\ahjCcvN.exe
      C:\Windows\System\ahjCcvN.exe
      2⤵
      • Executes dropped EXE
      PID:4028
    • C:\Windows\System\syWRhxc.exe
      C:\Windows\System\syWRhxc.exe
      2⤵
      • Executes dropped EXE
      PID:2472
    • C:\Windows\System\mqJTBXS.exe
      C:\Windows\System\mqJTBXS.exe
      2⤵
      • Executes dropped EXE
      PID:3372
    • C:\Windows\System\oGCEORV.exe
      C:\Windows\System\oGCEORV.exe
      2⤵
      • Executes dropped EXE
      PID:216
    • C:\Windows\System\koGiBie.exe
      C:\Windows\System\koGiBie.exe
      2⤵
      • Executes dropped EXE
      PID:464
    • C:\Windows\System\IUxoBxq.exe
      C:\Windows\System\IUxoBxq.exe
      2⤵
      • Executes dropped EXE
      PID:1176
    • C:\Windows\System\NoOAWtB.exe
      C:\Windows\System\NoOAWtB.exe
      2⤵
      • Executes dropped EXE
      PID:4020
    • C:\Windows\System\tpEpMfr.exe
      C:\Windows\System\tpEpMfr.exe
      2⤵
      • Executes dropped EXE
      PID:2068
    • C:\Windows\System\elxdvVh.exe
      C:\Windows\System\elxdvVh.exe
      2⤵
      • Executes dropped EXE
      PID:2096
    • C:\Windows\System\jIUcokZ.exe
      C:\Windows\System\jIUcokZ.exe
      2⤵
      • Executes dropped EXE
      PID:3780
    • C:\Windows\System\cKUKnZd.exe
      C:\Windows\System\cKUKnZd.exe
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\System\sjJbyDW.exe
      C:\Windows\System\sjJbyDW.exe
      2⤵
      • Executes dropped EXE
      PID:3592
    • C:\Windows\System\dbtzgpB.exe
      C:\Windows\System\dbtzgpB.exe
      2⤵
      • Executes dropped EXE
      PID:1076
    • C:\Windows\System\otutvCZ.exe
      C:\Windows\System\otutvCZ.exe
      2⤵
      • Executes dropped EXE
      PID:3672
    • C:\Windows\System\NzzJqze.exe
      C:\Windows\System\NzzJqze.exe
      2⤵
      • Executes dropped EXE
      PID:4660
    • C:\Windows\System\PjSaLkp.exe
      C:\Windows\System\PjSaLkp.exe
      2⤵
      • Executes dropped EXE
      PID:3084
    • C:\Windows\System\cPcDRAX.exe
      C:\Windows\System\cPcDRAX.exe
      2⤵
      • Executes dropped EXE
      PID:2928
    • C:\Windows\System\nGgciov.exe
      C:\Windows\System\nGgciov.exe
      2⤵
      • Executes dropped EXE
      PID:928
    • C:\Windows\System\BaiNaOX.exe
      C:\Windows\System\BaiNaOX.exe
      2⤵
      • Executes dropped EXE
      PID:4604
    • C:\Windows\System\xvXiGtm.exe
      C:\Windows\System\xvXiGtm.exe
      2⤵
      • Executes dropped EXE
      PID:3740
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3152

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\System\AtjdExT.exe

      Filesize

      5.9MB

      MD5

      f1c68204511f30eaaafc44d5bdf0e498

      SHA1

      f84d3847e0a6f340c1b6bfbf246a7f326f064769

      SHA256

      b776c441f893621878df4defd078315e61a9b7b415b35e246ea918ff46c0a7cd

      SHA512

      eaec09e04c75d51f0e09b0f57501642e0b69a6a9b76dde662820d1a0baafc5f0d9b8838dee46eda4e1a6bc93556a8dc97a84be47872afb48f75530e11486904c

    • C:\Windows\System\BaiNaOX.exe

      Filesize

      5.9MB

      MD5

      9f920a634f9fead3e550b41e284a69a3

      SHA1

      75db05920c69b9160bd436cafc9b514b2e0456d5

      SHA256

      959220d53f4b81e1c44e17f86d1ce469ee81915ec3b0f3af2294093bf45f6545

      SHA512

      8b84fe7b3b87e1eb96f4564bfba764bed2154efdc18fea5193950574a45937dd2a16ace64036d630aec9ac8973953b50ad96ea950a60f0a8a88d5e130e8fd6c5

    • C:\Windows\System\IUxoBxq.exe

      Filesize

      5.9MB

      MD5

      604e87b9513a48da5fd593994a7971ac

      SHA1

      f73de05d482fcfd7076e2c2cea3564cbef8dd97a

      SHA256

      009ace16426ebd6d3bb1650edc50382e46e577d9d593aaeb4fa4cc3eff3c2986

      SHA512

      105b9a8b37ad07bf787cc5fef24110af92f8bc4c21af28a2cd34a02b007bc7d8ef38325527ff15b45a5b065107bd87cc6e718aa43fd18021487363e2a749f735

    • C:\Windows\System\NoOAWtB.exe

      Filesize

      5.9MB

      MD5

      a5a4cceb385000d40330d6dc14b9193f

      SHA1

      ebf82c03438782348c90241772bee7e0bc98451d

      SHA256

      e8c35bf03ad95d899768311d0e3297a5a05f8192f92e2a8522388ca21e5ea171

      SHA512

      9c8d0402580f0d1936e0d955aa726cb58f5932a53d5131a200bee3d0998defd8ab0bc08c6a4e213576c729b2e99fea8f2cf0030fd168379122d9e3c531320b58

    • C:\Windows\System\NzzJqze.exe

      Filesize

      5.9MB

      MD5

      ec7d279391f2e74c9248defbb153fa6a

      SHA1

      119eefd6a9f99d4b7f59eb1121e1ecc6a3eada66

      SHA256

      f29dfb9309eb501b9cc5b66e8e44451d48d18274d93a37e5a8bd17f64de60ae5

      SHA512

      92cea30cedbf90f377bb6da5f217056597a3dab3464d51ddfa0956ccbcc8e5f71206448e07818a752b2a5fe9d27311e53dc695526821d08e6e682c53956d5d43

    • C:\Windows\System\PjSaLkp.exe

      Filesize

      5.9MB

      MD5

      937b2d75dacc826cebf0092a7277a660

      SHA1

      80fafe48cfa8361f91f7cef1925c97c4d97f1a31

      SHA256

      9d65c026113c2aa0395e669d02c1042feb595f5b970932f57c3d94e7d99f8d83

      SHA512

      8c6b818ecc29114e0b7e16fdff741be279863d5eedb562b33b1dc45b2a811328dea9f479eb8b43654b8df7fd49328bd31974d7ca8077af5738499feca13c7b6a

    • C:\Windows\System\ahjCcvN.exe

      Filesize

      5.9MB

      MD5

      e0053fc9a37182ef29d9bf84e30c24bc

      SHA1

      c806645a611365c6cdbcd59b9cd9302220a353f2

      SHA256

      89346802e27be485f78a524a30df124c42782bbc36ebded7b095b4431263400a

      SHA512

      76513bb84516ad983709a8f4013719cce546c5b9538849532b4a4a1171f5e4b968740dfb6499b84079dad57dd39937d17e86c38c348ee572518242a362f29b3f

    • C:\Windows\System\cKUKnZd.exe

      Filesize

      5.9MB

      MD5

      8908fc6efff3bc910786122d7f9d63ab

      SHA1

      0cc97943c7947e94eacc22cc710582a81cbe6f1d

      SHA256

      a7212c2dabd1ba6b153498001e8de21fcd1822a84db1651c99a75657f5f77200

      SHA512

      02a0dfc0ed7432c1231922ef9e9e5099947a17517eaa1fdae3e8d902f60e11de5444b76510d7fefe466c10499d042fc71cd174ef7b097530c869d74bd5ac9c13

    • C:\Windows\System\cPcDRAX.exe

      Filesize

      5.9MB

      MD5

      79869fcad0710304b8e23074095fea16

      SHA1

      e6c89cff18824ee4bb12fbe32f2061ebd4cb0028

      SHA256

      11f003cf06c1689a352e9de16b234f6cea0f9c69be12285aa2491b1f8ddab55e

      SHA512

      fca41531df52aaf7e5c932bba5e38d7e781bd5d05b1c2fdf505e92c5406bdd191aa8f1ebc64104930387375bb95282ff528bd4afedb7abc97cbd593af90ed041

    • C:\Windows\System\dbtzgpB.exe

      Filesize

      5.9MB

      MD5

      af188886983e3270969a61212cd817c7

      SHA1

      48028a84748f73fae976480bf8157fa6d9acd05d

      SHA256

      342916ca541e16753da7238fbbeae1154bf0ebe4acb5cc04d3eeb9827e3519ee

      SHA512

      e9c5c28fcec2326419d8eaace53d7fb39443fee9168d5165c85146c6f678854c30a2db9df6d3b806bb5a2d307be2e1a59cf0c38546377c7bcbead308e82e9b5e

    • C:\Windows\System\elxdvVh.exe

      Filesize

      5.9MB

      MD5

      e1752c96e36b638a515c86627017c100

      SHA1

      5b28769ede6de8da3b7b25b2c7eb694bb617fa37

      SHA256

      dff8fbdc01a337b27e1a3e46634561bd98782871f315e162453b3666f82b5e84

      SHA512

      6d363ada344f4d8173c3a45277c1fd1134840fad55bc96490c5fdff79d1d1e1d152c769d6113471dbec654795cec1ffa4c4262877df62dd9ad084f31132651f1

    • C:\Windows\System\jIUcokZ.exe

      Filesize

      5.9MB

      MD5

      6f289cca8f2857312551fc01c359177f

      SHA1

      bd2b3095d6d97689da1d244030531fe5ec554967

      SHA256

      05ef33d8af64c7139db3dc172026259088ba95f56feccada94cfe6b89f75aaca

      SHA512

      03904239faed8f2d0ba8c17a549aef002827d62f55c51948f05b712175e32914262e2f4d729698765504bde54b81f590210d6d10254a2de892b82070478fb147

    • C:\Windows\System\koGiBie.exe

      Filesize

      5.9MB

      MD5

      6a44e17e5704102d8d66161cafb3ea3c

      SHA1

      608752fc80460902ce9948f4cb9a7872d170e217

      SHA256

      7b0cd5d975b977561d60effd18a0e0ed9bc2ff7f682bd779302521c069d65140

      SHA512

      5b60982e1e28751f0a123f8ba4033ec02bdfdc2be76e295e4ed7fafe987139c0ecaa184be5aa033c164cfe34458f6e5b2c6df53c6c6d49f9ba3e90b40b33e316

    • C:\Windows\System\mqJTBXS.exe

      Filesize

      5.9MB

      MD5

      fba3e3583458a782440762b33a176311

      SHA1

      0aff62602559baba7b7c4623ab871c49e6045838

      SHA256

      772d8edbc9028f38072880722508e1b4cf4166566029fa5c29cd438bc5e2e78c

      SHA512

      d0369c818862e64f6fa0590af368866f72b8a11cfcb3bd02583169df696aae09460f37c930220100eebc867a8506b229fe95113563fb1449be69f664b2648a5b

    • C:\Windows\System\nGgciov.exe

      Filesize

      5.9MB

      MD5

      3caba44eb4ef3c15af2d511bc09eb5bb

      SHA1

      584f065ba3f536ad9afd158a7396da3e8efb92c5

      SHA256

      bbb3d6242ee6644bf6ad3f081c98089314c1e9ee175913e039da4bae84fc9e42

      SHA512

      d35112f95ebb7471cc8da684da52f6530bdff349db2e12da47f818b6378a5d521e5479e4b4f9a40292ce891131a4dd745d16848258781fc846cd7a87fe5aa0cc

    • C:\Windows\System\oGCEORV.exe

      Filesize

      5.9MB

      MD5

      63034bee832a6a33415889b48543b732

      SHA1

      0c4de24d189cec5650b77a690879d4f68173e8e1

      SHA256

      c006c68739a8823f6d95c39d24ebe24549dbd6fba4b7817c7d32cea0d8a7d0aa

      SHA512

      047d4cef37c3702ee450d45935ae73071bcc0d03650cc89c836422979101550ec93a003a573746b87f220c046cb55ef2d811b382a9e7bd22f8406644ab4e214f

    • C:\Windows\System\otutvCZ.exe

      Filesize

      5.9MB

      MD5

      4ae3de9c97d81d1ea2a5eacfbbfb8e02

      SHA1

      1c91779ec40ff3e7a5314121fb3d6185f3add744

      SHA256

      33fb3b4b4fe076c40b07f5717cc2c151e51d9502ae5e77f9e139bf31266a95fe

      SHA512

      d8f78d6e366fe90c138ddf71685d340b9dca29abf8152bdc7636639304ad1173b3387bc9cf5e648a100ccf16621af471d1a36ca6661597697d983f448f343d22

    • C:\Windows\System\sjJbyDW.exe

      Filesize

      5.9MB

      MD5

      e0828ae8b235551927e08571b398abe4

      SHA1

      bf633f96870cf114b4f45c803c9dc42ef2ea8438

      SHA256

      02b3b4646ff64959a0b1203932869b085e6144ceb48be5e8bcc5713c3de70193

      SHA512

      f0785edf137fb41563a75b7cb8951ba752d0add33b303b819950207cf7fa2d898921d7d1d0830142a00c74d76fb72fe79f9171e5641b1fefb11a68e8041fc50b

    • C:\Windows\System\syWRhxc.exe

      Filesize

      5.9MB

      MD5

      6cee01d8e8c57c0608adba7e18a9ccb0

      SHA1

      7551c4d82a55fa2b4c19749c2bfe6b02a6e7e1a8

      SHA256

      77d8718eaa8667de014d8f3813f3445d27d869658fb643139d5891db430cc12a

      SHA512

      29d699ecbaf3cfb492f0d1957f64aa0aff5721fa3750ee8b5e2d620fbdac9ed1ce675e8e9fe199cd2074b938f4df9fe9090f298052e6c3e691069035357064af

    • C:\Windows\System\tpEpMfr.exe

      Filesize

      5.9MB

      MD5

      a0ec793d5f0ddc62f96d051d06810f5b

      SHA1

      343872acf3a6f7cf1b1436235dfdc5f56d9e3e11

      SHA256

      bdff727029c6bfbc03579fa62ed96a0a40268f4a1fdcea97e4ef418dc6a8d67a

      SHA512

      5b05c97f0446899405eef64f5e745dace9ae835e83aec5752365f5bcdc431b76ad6953fe15b2f64f379744717b28e1da0cfed9d1b0990b74fa4c486576ffc303

    • C:\Windows\System\xvXiGtm.exe

      Filesize

      5.9MB

      MD5

      cfdc2b653db939f3137047d4f89ed28b

      SHA1

      b9d1fbff77f3a4522980fec1ea3d74923913927f

      SHA256

      6a97b6c53c17f5ba6ceddc6bb3a5d50b543ca70314259a9129c3264bf98db2f9

      SHA512

      6d738ea3b91ebf1517aa4b753e551b6c7ad8e896e8e65384f08e7d3c30fface71245bc81348039a0ca8df9c1f827d7c2764268de0624ad8f9a42bd9ff7c225cb

    • memory/216-52-0x00007FF6DF480000-0x00007FF6DF7D4000-memory.dmp

      Filesize

      3.3MB

    • memory/216-138-0x00007FF6DF480000-0x00007FF6DF7D4000-memory.dmp

      Filesize

      3.3MB

    • memory/464-139-0x00007FF667190000-0x00007FF6674E4000-memory.dmp

      Filesize

      3.3MB

    • memory/464-53-0x00007FF667190000-0x00007FF6674E4000-memory.dmp

      Filesize

      3.3MB

    • memory/928-118-0x00007FF7DEF80000-0x00007FF7DF2D4000-memory.dmp

      Filesize

      3.3MB

    • memory/928-152-0x00007FF7DEF80000-0x00007FF7DF2D4000-memory.dmp

      Filesize

      3.3MB

    • memory/1076-87-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp

      Filesize

      3.3MB

    • memory/1076-147-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp

      Filesize

      3.3MB

    • memory/1176-54-0x00007FF748390000-0x00007FF7486E4000-memory.dmp

      Filesize

      3.3MB

    • memory/1176-140-0x00007FF748390000-0x00007FF7486E4000-memory.dmp

      Filesize

      3.3MB

    • memory/2068-56-0x00007FF62BA00000-0x00007FF62BD54000-memory.dmp

      Filesize

      3.3MB

    • memory/2068-142-0x00007FF62BA00000-0x00007FF62BD54000-memory.dmp

      Filesize

      3.3MB

    • memory/2096-143-0x00007FF7CB3A0000-0x00007FF7CB6F4000-memory.dmp

      Filesize

      3.3MB

    • memory/2096-61-0x00007FF7CB3A0000-0x00007FF7CB6F4000-memory.dmp

      Filesize

      3.3MB

    • memory/2096-133-0x00007FF7CB3A0000-0x00007FF7CB6F4000-memory.dmp

      Filesize

      3.3MB

    • memory/2168-74-0x00007FF6342D0000-0x00007FF634624000-memory.dmp

      Filesize

      3.3MB

    • memory/2168-145-0x00007FF6342D0000-0x00007FF634624000-memory.dmp

      Filesize

      3.3MB

    • memory/2332-1-0x0000022936570000-0x0000022936580000-memory.dmp

      Filesize

      64KB

    • memory/2332-80-0x00007FF785CB0000-0x00007FF786004000-memory.dmp

      Filesize

      3.3MB

    • memory/2332-0-0x00007FF785CB0000-0x00007FF786004000-memory.dmp

      Filesize

      3.3MB

    • memory/2472-18-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp

      Filesize

      3.3MB

    • memory/2472-120-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp

      Filesize

      3.3MB

    • memory/2472-136-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp

      Filesize

      3.3MB

    • memory/2928-117-0x00007FF6700B0000-0x00007FF670404000-memory.dmp

      Filesize

      3.3MB

    • memory/2928-151-0x00007FF6700B0000-0x00007FF670404000-memory.dmp

      Filesize

      3.3MB

    • memory/3084-150-0x00007FF6FF7D0000-0x00007FF6FFB24000-memory.dmp

      Filesize

      3.3MB

    • memory/3084-119-0x00007FF6FF7D0000-0x00007FF6FFB24000-memory.dmp

      Filesize

      3.3MB

    • memory/3372-130-0x00007FF7C72D0000-0x00007FF7C7624000-memory.dmp

      Filesize

      3.3MB

    • memory/3372-137-0x00007FF7C72D0000-0x00007FF7C7624000-memory.dmp

      Filesize

      3.3MB

    • memory/3372-25-0x00007FF7C72D0000-0x00007FF7C7624000-memory.dmp

      Filesize

      3.3MB

    • memory/3592-146-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp

      Filesize

      3.3MB

    • memory/3592-81-0x00007FF6DF550000-0x00007FF6DF8A4000-memory.dmp

      Filesize

      3.3MB

    • memory/3672-148-0x00007FF60DC40000-0x00007FF60DF94000-memory.dmp

      Filesize

      3.3MB

    • memory/3672-94-0x00007FF60DC40000-0x00007FF60DF94000-memory.dmp

      Filesize

      3.3MB

    • memory/3740-154-0x00007FF76AB30000-0x00007FF76AE84000-memory.dmp

      Filesize

      3.3MB

    • memory/3740-132-0x00007FF76AB30000-0x00007FF76AE84000-memory.dmp

      Filesize

      3.3MB

    • memory/3780-68-0x00007FF6CD960000-0x00007FF6CDCB4000-memory.dmp

      Filesize

      3.3MB

    • memory/3780-144-0x00007FF6CD960000-0x00007FF6CDCB4000-memory.dmp

      Filesize

      3.3MB

    • memory/4020-141-0x00007FF665250000-0x00007FF6655A4000-memory.dmp

      Filesize

      3.3MB

    • memory/4020-55-0x00007FF665250000-0x00007FF6655A4000-memory.dmp

      Filesize

      3.3MB

    • memory/4028-112-0x00007FF60A3D0000-0x00007FF60A724000-memory.dmp

      Filesize

      3.3MB

    • memory/4028-14-0x00007FF60A3D0000-0x00007FF60A724000-memory.dmp

      Filesize

      3.3MB

    • memory/4028-135-0x00007FF60A3D0000-0x00007FF60A724000-memory.dmp

      Filesize

      3.3MB

    • memory/4604-153-0x00007FF7BD390000-0x00007FF7BD6E4000-memory.dmp

      Filesize

      3.3MB

    • memory/4604-131-0x00007FF7BD390000-0x00007FF7BD6E4000-memory.dmp

      Filesize

      3.3MB

    • memory/4660-149-0x00007FF77A880000-0x00007FF77ABD4000-memory.dmp

      Filesize

      3.3MB

    • memory/4660-116-0x00007FF77A880000-0x00007FF77ABD4000-memory.dmp

      Filesize

      3.3MB

    • memory/4992-8-0x00007FF7B32A0000-0x00007FF7B35F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4992-93-0x00007FF7B32A0000-0x00007FF7B35F4000-memory.dmp

      Filesize

      3.3MB

    • memory/4992-134-0x00007FF7B32A0000-0x00007FF7B35F4000-memory.dmp

      Filesize

      3.3MB