Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    42f972925508a82236e8533567487761(1).exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

babylonrat

C2

sandyclark255.hopto.org

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 1 IoCs
  • Warzone RAT payload 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 17 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 5 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\AppData\Local\Temp\GnjFkLV01gdq4XfP.exe
      "C:\Users\Admin\AppData\Local\Temp\GnjFkLV01gdq4XfP.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:636
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3724
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1536
    • C:\Users\Admin\AppData\Local\Temp\0gGtxVS8fS6kh7H7.exe
      "C:\Users\Admin\AppData\Local\Temp\0gGtxVS8fS6kh7H7.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1552
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4320
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 4320
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          PID:5040
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            5⤵
            • Executes dropped EXE
            PID:3876
    • C:\Users\Admin\AppData\Local\Temp\DmvVxaLhVsww0GxU.exe
      "C:\Users\Admin\AppData\Local\Temp\DmvVxaLhVsww0GxU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Drops file in Drivers directory
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
            PID:1660
          • C:\Users\Admin\Documents\excelsl.exe
            "C:\Users\Admin\Documents\excelsl.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4932
            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
              5⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:4884
              • C:\Windows\SysWOW64\notepad.exe
                notepad
                6⤵
                  PID:2964
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1160
                5⤵
                • Program crash
                PID:3052
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 1156
            3⤵
            • Program crash
            PID:1268
        • C:\Users\Admin\AppData\Local\Temp\ZT6vCZVjUmjR0ZBT.exe
          "C:\Users\Admin\AppData\Local\Temp\ZT6vCZVjUmjR0ZBT.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1140
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3256
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF8E7.tmp.bat""
            3⤵
              PID:1096
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                4⤵
                • Delays execution with timeout.exe
                PID:2124
              • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:1580
          • C:\Users\Admin\AppData\Local\Temp\xfSABkIpAePqdpZC.exe
            "C:\Users\Admin\AppData\Local\Temp\xfSABkIpAePqdpZC.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4956
            • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
              "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
              3⤵
              • Executes dropped EXE
              PID:5032
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 1152
              3⤵
              • Program crash
              PID:3220
          • C:\Users\Admin\AppData\Local\Temp\VSJCOpLPyy1XwHTY.exe
            "C:\Users\Admin\AppData\Local\Temp\VSJCOpLPyy1XwHTY.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
              "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: GetForegroundWindowSpam
              PID:1992
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1128
              3⤵
              • Program crash
              PID:4740
          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
            "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
            2⤵
            • Executes dropped EXE
            PID:568
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1644
            2⤵
            • Program crash
            PID:2480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2588 -ip 2588
          1⤵
            PID:2024
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4956 -ip 4956
            1⤵
              PID:1876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4916 -ip 4916
              1⤵
                PID:4656
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2720 -ip 2720
                1⤵
                  PID:3132
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4932 -ip 4932
                  1⤵
                    PID:2436

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\excelsl.exe.log
                    Filesize

                    400B

                    MD5

                    0a9b4592cd49c3c21f6767c2dabda92f

                    SHA1

                    f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

                    SHA256

                    c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

                    SHA512

                    6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

                  • C:\Users\Admin\AppData\Local\Temp\0gGtxVS8fS6kh7H7.exe
                    Filesize

                    801KB

                    MD5

                    9133c2a5ebf3e25aceae5a001ca6f279

                    SHA1

                    319f911282f3cded94de3730fa0abd5dec8f14be

                    SHA256

                    7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                    SHA512

                    1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                  • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                    Filesize

                    3.7MB

                    MD5

                    9d2a888ca79e1ff3820882ea1d88d574

                    SHA1

                    112c38d80bf2c0d48256249bbabe906b834b1f66

                    SHA256

                    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                    SHA512

                    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                  • C:\Users\Admin\AppData\Local\Temp\DmvVxaLhVsww0GxU.exe
                    Filesize

                    742KB

                    MD5

                    3e804917c454ca31c1cbd602682542b7

                    SHA1

                    1df3e81b9d879e21af299f5478051b98f3cb7739

                    SHA256

                    f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                    SHA512

                    28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                  • C:\Users\Admin\AppData\Local\Temp\GnjFkLV01gdq4XfP.exe
                    Filesize

                    472KB

                    MD5

                    2819e45588024ba76f248a39d3e232ba

                    SHA1

                    08a797b87ecfbee682ce14d872177dae1a5a46a2

                    SHA256

                    b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                    SHA512

                    a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                  • C:\Users\Admin\AppData\Local\Temp\VSJCOpLPyy1XwHTY.exe
                    Filesize

                    336KB

                    MD5

                    e87459f61fd1f017d4bd6b0a1a1fc86a

                    SHA1

                    30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                    SHA256

                    ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                    SHA512

                    dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                  • C:\Users\Admin\AppData\Local\Temp\ZT6vCZVjUmjR0ZBT.exe
                    Filesize

                    376KB

                    MD5

                    590acb5fa6b5c3001ebce3d67242aac4

                    SHA1

                    5df39906dc4e60f01b95783fc55af6128402d611

                    SHA256

                    7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                    SHA512

                    4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                  • C:\Users\Admin\AppData\Local\Temp\tmpF8E7.tmp.bat
                    Filesize

                    153B

                    MD5

                    a7a765ae3837b139ba427851fa848590

                    SHA1

                    a6f104c26b80d1b34895cfa810c4502bb92b74f0

                    SHA256

                    7857fb889899efc87455da3af7b6db649c3bb2af6211f146bbb2e4b5cbe988ac

                    SHA512

                    86a413f2504ac461d26ac65a9ffb3019c3cf07227bbe8a9f24f8966d65190a6827062502b5c47f343f8c8cc11143a9f31aa72d9057f01d6832ec1d74bd794399

                  • C:\Users\Admin\AppData\Local\Temp\xfSABkIpAePqdpZC.exe
                    Filesize

                    366KB

                    MD5

                    f07d2c33e4afe36ec6f6f14f9a56e84a

                    SHA1

                    3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                    SHA256

                    309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                    SHA512

                    b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                  • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    Filesize

                    47.9MB

                    MD5

                    3d83e90845db3a15419962ab308be4b8

                    SHA1

                    27eef6a795c9c4a52706b24a3c38c81ab4ab195b

                    SHA256

                    b4dbb426c680ae21e2132b2854374e88ea45aae89013077f55578c0f22e495d4

                    SHA512

                    d090915c269b9073543e9c4cfe5ffc1bbcb4f5b2712adab76a33b086df7287e3181aad3eeb1df6549daf3f2cad55eb360f98e3c22cb0ea5e0cad81acbbad4b1c

                  • memory/568-76-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/636-186-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/636-43-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/636-56-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/636-53-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/1140-81-0x0000000004EC0000-0x0000000004F52000-memory.dmp
                    Filesize

                    584KB

                  • memory/1140-82-0x0000000004DA0000-0x0000000004DAA000-memory.dmp
                    Filesize

                    40KB

                  • memory/1140-79-0x00000000005B0000-0x0000000000614000-memory.dmp
                    Filesize

                    400KB

                  • memory/1140-85-0x0000000009090000-0x00000000090B4000-memory.dmp
                    Filesize

                    144KB

                  • memory/1140-201-0x00000000096A0000-0x000000000973C000-memory.dmp
                    Filesize

                    624KB

                  • memory/1140-200-0x0000000009370000-0x00000000093D6000-memory.dmp
                    Filesize

                    408KB

                  • memory/1140-80-0x0000000005470000-0x0000000005A14000-memory.dmp
                    Filesize

                    5.6MB

                  • memory/1140-161-0x0000000006020000-0x0000000006032000-memory.dmp
                    Filesize

                    72KB

                  • memory/1140-99-0x0000000002860000-0x0000000002884000-memory.dmp
                    Filesize

                    144KB

                  • memory/1552-75-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/1552-74-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/1552-236-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/1660-112-0x0000000000D90000-0x0000000000D91000-memory.dmp
                    Filesize

                    4KB

                  • memory/1768-108-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1768-103-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1768-106-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/1992-94-0x0000000000400000-0x000000000040F000-memory.dmp
                    Filesize

                    60KB

                  • memory/1992-97-0x0000000000400000-0x000000000040F000-memory.dmp
                    Filesize

                    60KB

                  • memory/2588-0-0x0000000074682000-0x0000000074683000-memory.dmp
                    Filesize

                    4KB

                  • memory/2588-1-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2588-2-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2588-84-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2720-163-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2720-78-0x0000000074680000-0x0000000074C31000-memory.dmp
                    Filesize

                    5.7MB

                  • memory/2964-209-0x0000000000570000-0x0000000000571000-memory.dmp
                    Filesize

                    4KB

                  • memory/3876-230-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-214-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-192-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-237-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-195-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-199-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-231-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-218-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-217-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-215-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4320-197-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Filesize

                    776KB

                  • memory/4884-211-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/4884-206-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/4884-208-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/4884-210-0x0000000000400000-0x00000000004BA000-memory.dmp
                    Filesize

                    744KB

                  • memory/5032-88-0x0000000000400000-0x0000000000554000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/5032-91-0x0000000000400000-0x0000000000554000-memory.dmp
                    Filesize

                    1.3MB