Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    35s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    42f972925508a82236e8533567487761.exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

babylonrat

C2

sandyclark255.hopto.org

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Async RAT payload 3 IoCs
  • Warzone RAT payload 2 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exe
      "C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exe"
      2⤵
        PID:2160
        • C:\Windows\svehosts.exe
          "C:\Windows\svehosts.exe"
          3⤵
            PID:1820
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
              4⤵
              • Modifies Windows Firewall
              PID:3700
        • C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exe
          "C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exe"
          2⤵
            PID:3272
            • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
              "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
              3⤵
                PID:2272
                • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 2272
                  4⤵
                    PID:4116
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                      "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
                      5⤵
                        PID:4352
                      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
                        5⤵
                          PID:2304
                  • C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exe
                    "C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exe"
                    2⤵
                      PID:5032
                      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                        3⤵
                          PID:4500
                          • C:\Windows\SysWOW64\notepad.exe
                            notepad
                            4⤵
                              PID:4292
                            • C:\Users\Admin\Documents\excelsl.exe
                              "C:\Users\Admin\Documents\excelsl.exe"
                              4⤵
                                PID:2984
                                • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                                  "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                                  5⤵
                                    PID:4956
                                    • C:\Windows\SysWOW64\notepad.exe
                                      notepad
                                      6⤵
                                        PID:3712
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1128
                                      5⤵
                                      • Program crash
                                      PID:3040
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1156
                                  3⤵
                                  • Program crash
                                  PID:1136
                              • C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exe
                                "C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exe"
                                2⤵
                                  PID:1720
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:440
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF75B.tmp.bat""
                                    3⤵
                                      PID:3204
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout 3
                                        4⤵
                                        • Delays execution with timeout.exe
                                        PID:2684
                                      • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                        "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                                        4⤵
                                          PID:4212
                                    • C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exe
                                      "C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exe"
                                      2⤵
                                        PID:232
                                        • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                                          "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
                                          3⤵
                                            PID:216
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 1160
                                            3⤵
                                            • Program crash
                                            PID:4540
                                        • C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exe
                                          "C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exe"
                                          2⤵
                                            PID:1188
                                            • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                                              "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
                                              3⤵
                                                PID:2008
                                              • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
                                                3⤵
                                                  PID:2476
                                                • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
                                                  3⤵
                                                    PID:3312
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 1164
                                                    3⤵
                                                    • Program crash
                                                    PID:3960
                                                • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                                  2⤵
                                                    PID:1008
                                                  • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                                    2⤵
                                                      PID:3300
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1636
                                                      2⤵
                                                      • Program crash
                                                      PID:2136
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
                                                    1⤵
                                                      PID:1276
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 232 -ip 232
                                                      1⤵
                                                        PID:2468
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1188 -ip 1188
                                                        1⤵
                                                          PID:2456
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5032 -ip 5032
                                                          1⤵
                                                            PID:1276
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2984 -ip 2984
                                                            1⤵
                                                              PID:4324

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                                              Filesize

                                                              3.7MB

                                                              MD5

                                                              9d2a888ca79e1ff3820882ea1d88d574

                                                              SHA1

                                                              112c38d80bf2c0d48256249bbabe906b834b1f66

                                                              SHA256

                                                              8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                                                              SHA512

                                                              17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                                                            • C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exe
                                                              Filesize

                                                              742KB

                                                              MD5

                                                              3e804917c454ca31c1cbd602682542b7

                                                              SHA1

                                                              1df3e81b9d879e21af299f5478051b98f3cb7739

                                                              SHA256

                                                              f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                                                              SHA512

                                                              28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                                                            • C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exe
                                                              Filesize

                                                              376KB

                                                              MD5

                                                              590acb5fa6b5c3001ebce3d67242aac4

                                                              SHA1

                                                              5df39906dc4e60f01b95783fc55af6128402d611

                                                              SHA256

                                                              7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                                                              SHA512

                                                              4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                                                            • C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exe
                                                              Filesize

                                                              801KB

                                                              MD5

                                                              9133c2a5ebf3e25aceae5a001ca6f279

                                                              SHA1

                                                              319f911282f3cded94de3730fa0abd5dec8f14be

                                                              SHA256

                                                              7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                                                              SHA512

                                                              1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                                                            • C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exe
                                                              Filesize

                                                              336KB

                                                              MD5

                                                              e87459f61fd1f017d4bd6b0a1a1fc86a

                                                              SHA1

                                                              30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                                                              SHA256

                                                              ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                                                              SHA512

                                                              dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                                                            • C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exe
                                                              Filesize

                                                              366KB

                                                              MD5

                                                              f07d2c33e4afe36ec6f6f14f9a56e84a

                                                              SHA1

                                                              3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                                                              SHA256

                                                              309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                                                              SHA512

                                                              b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                                                            • C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exe
                                                              Filesize

                                                              472KB

                                                              MD5

                                                              2819e45588024ba76f248a39d3e232ba

                                                              SHA1

                                                              08a797b87ecfbee682ce14d872177dae1a5a46a2

                                                              SHA256

                                                              b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                                                              SHA512

                                                              a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                                                            • C:\Users\Admin\AppData\Local\Temp\tmpF75B.tmp.bat
                                                              Filesize

                                                              153B

                                                              MD5

                                                              ce30b65b2e171da01319f17fec45c4dc

                                                              SHA1

                                                              993d16733411ad8367cd43a44a9173cb00be3add

                                                              SHA256

                                                              c9a81361fd838ffd4ec6ed795bacf90d4f01902d129ab41588c6816be402be31

                                                              SHA512

                                                              8b9b35ef3ca8f38a8bee4d41b6bc4ec1b284a61fdd59271ebad38741e2d696fc797e85a714d3a5fe3a138599a238899c890ac9c512ee2514fdc3c3be17830b96

                                                            • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                                              Filesize

                                                              5.1MB

                                                              MD5

                                                              7055873b38227fb96c25d8d5c94d5931

                                                              SHA1

                                                              99908c321b07717c07eb596281fcce6fe253270d

                                                              SHA256

                                                              2041fcbe46a10a3391901c6f66d653ad6d54c67132114282f7dfc37b18788257

                                                              SHA512

                                                              448ed610c10bef0e8f5e2168f9857707062db6ab437816e1176a1c2504b62a5ef1fc3e52fdeb5bc6012828463268e68e2dfb6c9d127989615ed16d2a56c472fb

                                                            • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                                              Filesize

                                                              4.6MB

                                                              MD5

                                                              b60cd441e3f25fac395cacdcc06ac4d7

                                                              SHA1

                                                              8c59d8a2926886903b1d9a46c98605219b0994a1

                                                              SHA256

                                                              bea7dbe66cd6dc6daedd484da1b2b41b687ceaaef4989a499e393f4b707dbe5b

                                                              SHA512

                                                              3e95d8b30223131358197e40cff9abb861734e418a91222bb494ab1da38d39d559c398a00755ad6922c2497192efeb5e9cc3d976a1ded6716ceeb586fc433fea

                                                            • memory/216-107-0x0000000000400000-0x0000000000554000-memory.dmp
                                                              Filesize

                                                              1.3MB

                                                            • memory/216-103-0x0000000000400000-0x0000000000554000-memory.dmp
                                                              Filesize

                                                              1.3MB

                                                            • memory/1720-222-0x000000000ADA0000-0x000000000AE06000-memory.dmp
                                                              Filesize

                                                              408KB

                                                            • memory/1720-78-0x0000000000E20000-0x0000000000E84000-memory.dmp
                                                              Filesize

                                                              400KB

                                                            • memory/1720-130-0x0000000005AB0000-0x0000000005AC2000-memory.dmp
                                                              Filesize

                                                              72KB

                                                            • memory/1720-85-0x00000000057A0000-0x00000000057AA000-memory.dmp
                                                              Filesize

                                                              40KB

                                                            • memory/1720-83-0x00000000056E0000-0x0000000005772000-memory.dmp
                                                              Filesize

                                                              584KB

                                                            • memory/1720-82-0x0000000005D70000-0x0000000006314000-memory.dmp
                                                              Filesize

                                                              5.6MB

                                                            • memory/1720-223-0x000000000B110000-0x000000000B1AC000-memory.dmp
                                                              Filesize

                                                              624KB

                                                            • memory/1720-88-0x0000000009910000-0x0000000009934000-memory.dmp
                                                              Filesize

                                                              144KB

                                                            • memory/1720-135-0x0000000005AD0000-0x0000000005AE2000-memory.dmp
                                                              Filesize

                                                              72KB

                                                            • memory/2160-35-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/2160-56-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/2160-68-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/2160-207-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/2272-108-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-124-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-220-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-111-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-102-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-98-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-106-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-96-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-93-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2272-110-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/2304-201-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Filesize

                                                              776KB

                                                            • memory/3272-76-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/3272-245-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/3300-80-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/3312-119-0x0000000000400000-0x000000000040F000-memory.dmp
                                                              Filesize

                                                              60KB

                                                            • memory/3312-121-0x0000000000400000-0x000000000040F000-memory.dmp
                                                              Filesize

                                                              60KB

                                                            • memory/3712-227-0x0000000000D40000-0x0000000000D41000-memory.dmp
                                                              Filesize

                                                              4KB

                                                            • memory/4212-248-0x0000000004450000-0x0000000004462000-memory.dmp
                                                              Filesize

                                                              72KB

                                                            • memory/4292-139-0x0000000000540000-0x0000000000541000-memory.dmp
                                                              Filesize

                                                              4KB

                                                            • memory/4500-132-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4500-134-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4500-128-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4956-229-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4956-228-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4956-226-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4956-224-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                              Filesize

                                                              744KB

                                                            • memory/4968-3-0x0000000074622000-0x0000000074623000-memory.dmp
                                                              Filesize

                                                              4KB

                                                            • memory/4968-4-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/4968-2-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/4968-1-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/4968-87-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/4968-0-0x0000000074622000-0x0000000074623000-memory.dmp
                                                              Filesize

                                                              4KB

                                                            • memory/5032-84-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB

                                                            • memory/5032-209-0x0000000074620000-0x0000000074BD1000-memory.dmp
                                                              Filesize

                                                              5.7MB