Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/08/2024, 01:51

General

  • Target

    93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe

  • Size

    3.3MB

  • MD5

    53327dca23173e9e9bae9d780786ba78

  • SHA1

    1108be5863af8152dce9d7534cd217f44bfa12d3

  • SHA256

    93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0

  • SHA512

    cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed

  • SSDEEP

    49152:9vae821/aQWl8P0lSk3aKA3Z+nbnaJBxZzoGdlTHHB72eh2NTke:9vx821/aQWl8P0lSk3DA3Z+nraDpe

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

napalm

C2

napalmwtf-42785.portmap.host:42785

Drownzy-54034.portmap.host:54034

Mutex

90d42f9c-2535-47cc-9947-9a1a89c43fc4

Attributes
  • encryption_key

    19D2CF4A708769AB5B4B046C13865B4AB48B4C4D

  • install_name

    EAC.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    EasyAntiCheat EOS

  • subdirectory

    EasyAntiCheat

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 8 IoCs
  • Executes dropped EXE 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe
    "C:\Users\Admin\AppData\Local\Temp\93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2092
    • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2444
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\z1ek73I8qObw.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2920
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2180
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2668
          • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
            "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2648
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\oKcUBaRR7a6R.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:1136
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1192
                • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                  "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2848
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2696
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\6fcTfxyFja0K.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1260
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:1252
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:316
                      • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1256
                        • C:\Windows\system32\schtasks.exe
                          "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2404
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\6cwNzDW40Xsi.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:864
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:328
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2612
                            • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                              "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              PID:1592
                              • C:\Windows\system32\schtasks.exe
                                "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                11⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:1048
                              • C:\Windows\system32\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\bgTkdKDevOQP.bat" "
                                11⤵
                                  PID:1140
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    12⤵
                                      PID:2156
                                    • C:\Windows\system32\PING.EXE
                                      ping -n 10 localhost
                                      12⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2320
                                    • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2076
                                      • C:\Windows\system32\schtasks.exe
                                        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                        13⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2256
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7GdsCcbrQXrr.bat" "
                                        13⤵
                                          PID:1704
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            14⤵
                                              PID:2812
                                            • C:\Windows\system32\PING.EXE
                                              ping -n 10 localhost
                                              14⤵
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              • Runs ping.exe
                                              PID:1612
                                            • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                              "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                              14⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2004
                                              • C:\Windows\system32\schtasks.exe
                                                "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                15⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2728
                                              • C:\Windows\system32\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\fGii7GNS9fpL.bat" "
                                                15⤵
                                                  PID:2776
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    16⤵
                                                      PID:2672
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 10 localhost
                                                      16⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:2772
                                                    • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                      16⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2688
                                                      • C:\Windows\system32\schtasks.exe
                                                        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                        17⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2752
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KFIyXcGLOfWj.bat" "
                                                        17⤵
                                                          PID:1960
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            18⤵
                                                              PID:2700
                                                            • C:\Windows\system32\PING.EXE
                                                              ping -n 10 localhost
                                                              18⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:1540
                                                            • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                              "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2260
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                                19⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2044
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\Sw66Jd4TpsIq.bat" "
                                                                19⤵
                                                                  PID:2868
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    20⤵
                                                                      PID:2844
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping -n 10 localhost
                                                                      20⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:2620
                                                                    • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                                      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2288
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                                        21⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:316
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LYIiopCRB9fJ.bat" "
                                                                        21⤵
                                                                          PID:1940
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 65001
                                                                            22⤵
                                                                              PID:1812
                                                                            • C:\Windows\system32\PING.EXE
                                                                              ping -n 10 localhost
                                                                              22⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:2124

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\6cwNzDW40Xsi.bat

                                    Filesize

                                    211B

                                    MD5

                                    78130696d41dbb34f2bec637bd650165

                                    SHA1

                                    aad349a4d0f1c126152a4ecec02f732888b4f316

                                    SHA256

                                    5825c2175af83b10c82487a0741c441564195fbbab452226ad9931d6c34363a8

                                    SHA512

                                    19a01100f7c0a35513465168737e4b1e81f3d40b0532898712ae503149c933e415b443abdb7a3a383c3bcfccf67a513b240bcc2e0064a3224e931f848d3494e8

                                  • C:\Users\Admin\AppData\Local\Temp\6fcTfxyFja0K.bat

                                    Filesize

                                    211B

                                    MD5

                                    6c51ee0033599d96a90ca6cba9e904f7

                                    SHA1

                                    2a7a3da3e7d6daa261fef4e52353bf0f3bcb8569

                                    SHA256

                                    f5fa6f2d7d78d7259861a21059f65e8ec3bdfd697e99b03725c81cd87463415e

                                    SHA512

                                    c03ea03201240e479c200836e5d8690b43554dae97b5955b1b05e8287cd2e14049e11e8f8b4cdff56e6a6a1a1ae611150d301b2e3ee5c8f456513ceb7528d74b

                                  • C:\Users\Admin\AppData\Local\Temp\7GdsCcbrQXrr.bat

                                    Filesize

                                    211B

                                    MD5

                                    82b2ac29496d6baae3046791182d4281

                                    SHA1

                                    6856faea91a9bb2e8664503a575259b1c00b7d93

                                    SHA256

                                    3a82d6f2f2ef5b1b770a3c0f43668a727c3b0026f707152233d80ef1d1c35ebb

                                    SHA512

                                    f536b060d7a32091b45cdc28a05dd16cd437c7732b13158691657ef694130706d484f6407668537b9d2247e9c0b72e0a03afc19cfc9ce9c042a11b5c4c0cdac9

                                  • C:\Users\Admin\AppData\Local\Temp\KFIyXcGLOfWj.bat

                                    Filesize

                                    211B

                                    MD5

                                    41b086e4522db102017c2b88cd3af2c6

                                    SHA1

                                    5d56a487528c1005613640a19d7684e9058ce37a

                                    SHA256

                                    7466bffe649e2ed89f98d6c4f95ed801f1cddee2b7518e09fbd20fc8d026ad9e

                                    SHA512

                                    b4856a70f81d648b0deaee8190bb93fa4eacda837f3384526a717b5584716223026e5d6d2378d8f357a5d1537b5ced43ad0c622c29f25fdbf7b7b29ac06388f9

                                  • C:\Users\Admin\AppData\Local\Temp\LYIiopCRB9fJ.bat

                                    Filesize

                                    211B

                                    MD5

                                    81fd76d7748e40062698c68c73e862d6

                                    SHA1

                                    2767494bf9b7b43109dc68e40a6f1929634ef7eb

                                    SHA256

                                    c2b6e2aceaaa9f7d8ed2bba3844e688b593f8ffb2d1b38f25bb216de79d64334

                                    SHA512

                                    76c49b534450635a688e7d5b98197481045d4ae4406b8bd50960309055765799e7f7d31b83afdbdb6b5a6930047afac2d17955c2884077cdb40f60655c100aed

                                  • C:\Users\Admin\AppData\Local\Temp\Sw66Jd4TpsIq.bat

                                    Filesize

                                    211B

                                    MD5

                                    5838d1dd41502070179a8711c33a9a4e

                                    SHA1

                                    7670fb29e9ed702edb6eaa57fc47cf0463b4b0de

                                    SHA256

                                    0f02a155858f9c03e6038c30b124434ae24112728213cbcd12b69443594913b7

                                    SHA512

                                    7432ea4df2a05017e1b6dae60866489e26a7574e22912cd097d1289843673f2505977610f7631bbfb33b64d8d223c715dfceb2928b1247e49c6d6d18475991b4

                                  • C:\Users\Admin\AppData\Local\Temp\bgTkdKDevOQP.bat

                                    Filesize

                                    211B

                                    MD5

                                    d4f0051ba58a577561c02e422032e920

                                    SHA1

                                    34313c55c233be05f01b680c1cf61f6fd1d4eb7c

                                    SHA256

                                    05da82d056bab298f8728ce06c1e50385176e963e162bfc8aa85347c41fcee92

                                    SHA512

                                    d8ed6880980993cd248b98599d679d935779e07974a3c2db1d0f9113d605440a779d7142e7c35116bac6125c4c1e6be85882dfea51e8d48990222715cbce9f20

                                  • C:\Users\Admin\AppData\Local\Temp\fGii7GNS9fpL.bat

                                    Filesize

                                    211B

                                    MD5

                                    0fcbb20216db7f35738f1fc02e120e23

                                    SHA1

                                    3d4a5627e0892f26509f2a1dde26530de15fc46d

                                    SHA256

                                    b346eac59e546477086f0dbddae51f9c6b1d63a96afc3f083d2f3b782cb45853

                                    SHA512

                                    71548285165003419e97ac63b00f32fafcde9944c3ce9022c5a4cbe8e81b6f81db6daa44457436c3e487126d793152f10005b3030d7ec09f45b0e903e93e3af4

                                  • C:\Users\Admin\AppData\Local\Temp\oKcUBaRR7a6R.bat

                                    Filesize

                                    211B

                                    MD5

                                    9aea3863d904d48c872bc744dfc377b6

                                    SHA1

                                    db68d1686c55f73b000d481e3e49f5d0c431a33e

                                    SHA256

                                    e71abe3334afb556c050d52adc82677eec54bedcce1e0ed609de546c7bbf1137

                                    SHA512

                                    4f7d84f1a26fea2c3579ab13f8ff889993a7596368035cebf4f24dd332c6e03989d4feaffa8bd6e1eed82ec415ca37dffd8e4bdb481879e513ffecf4da0d6c01

                                  • C:\Users\Admin\AppData\Local\Temp\z1ek73I8qObw.bat

                                    Filesize

                                    211B

                                    MD5

                                    0dc52fd89b3c8a8454e4fccff40f18a3

                                    SHA1

                                    fc8118e515095c8ff0b9012c8bbe499749847bd1

                                    SHA256

                                    7b9372678c9fd3bd6562e43611f461c3258e08359a65033db67a8ed569e24d76

                                    SHA512

                                    e53bf8a6b08cd8a7d23a6801dd9c19215449391ebb4a1f2bc48bc2c28aa0417dfea15bdaa3857a02fffd5aa4cd404b8492e0e61e2f706f20c8d9aa0874ea4c23

                                  • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe

                                    Filesize

                                    3.3MB

                                    MD5

                                    53327dca23173e9e9bae9d780786ba78

                                    SHA1

                                    1108be5863af8152dce9d7534cd217f44bfa12d3

                                    SHA256

                                    93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0

                                    SHA512

                                    cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed

                                  • memory/1256-44-0x00000000000E0000-0x0000000000440000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/1592-55-0x0000000000E30000-0x0000000001190000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/2004-78-0x0000000001130000-0x0000000001490000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/2076-67-0x0000000000150000-0x00000000004B0000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/2600-21-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                    Filesize

                                    9.9MB

                                  • memory/2600-9-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                    Filesize

                                    9.9MB

                                  • memory/2600-11-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                    Filesize

                                    9.9MB

                                  • memory/2600-10-0x0000000000DD0000-0x0000000001130000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/2716-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/2716-8-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                    Filesize

                                    9.9MB

                                  • memory/2716-2-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                    Filesize

                                    9.9MB

                                  • memory/2716-1-0x00000000009C0000-0x0000000000D20000-memory.dmp

                                    Filesize

                                    3.4MB

                                  • memory/2848-33-0x00000000012C0000-0x0000000001620000-memory.dmp

                                    Filesize

                                    3.4MB