Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 01:51

General

  • Target

    93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe

  • Size

    3.3MB

  • MD5

    53327dca23173e9e9bae9d780786ba78

  • SHA1

    1108be5863af8152dce9d7534cd217f44bfa12d3

  • SHA256

    93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0

  • SHA512

    cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed

  • SSDEEP

    49152:9vae821/aQWl8P0lSk3aKA3Z+nbnaJBxZzoGdlTHHB72eh2NTke:9vx821/aQWl8P0lSk3DA3Z+nraDpe

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

napalm

C2

napalmwtf-42785.portmap.host:42785

Drownzy-54034.portmap.host:54034

Mutex

90d42f9c-2535-47cc-9947-9a1a89c43fc4

Attributes
  • encryption_key

    19D2CF4A708769AB5B4B046C13865B4AB48B4C4D

  • install_name

    EAC.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    EasyAntiCheat EOS

  • subdirectory

    EasyAntiCheat

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 9 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe
    "C:\Users\Admin\AppData\Local\Temp\93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5520
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3028
    • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5984
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kQTfuP8LZRHl.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:4692
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4784
          • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
            "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5308
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5264
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zjulA3rI3Vk7.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1568
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:540
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:5424
                • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                  "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4480
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2900
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0Ycja3su1ShA.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1116
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:1100
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1260
                      • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1740
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4176
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JrPYVVGKpWPx.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3980
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:5476
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:3428
                            • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                              "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                              10⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:744
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                11⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:4364
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kiVZOcKJ4gKJ.bat" "
                                11⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2088
                                • C:\Windows\system32\chcp.com
                                  chcp 65001
                                  12⤵
                                    PID:2924
                                  • C:\Windows\system32\PING.EXE
                                    ping -n 10 localhost
                                    12⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:3948
                                  • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                    "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                    12⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:5892
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                      13⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5012
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I5s8MxwSxDOw.bat" "
                                      13⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:6092
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        14⤵
                                          PID:1904
                                        • C:\Windows\system32\PING.EXE
                                          ping -n 10 localhost
                                          14⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:1720
                                        • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                          "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                          14⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5108
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                            15⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3344
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QjAICGn6mvlP.bat" "
                                            15⤵
                                              PID:1372
                                              • C:\Windows\system32\chcp.com
                                                chcp 65001
                                                16⤵
                                                  PID:2336
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 10 localhost
                                                  16⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  • Runs ping.exe
                                                  PID:3276
                                                • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                  "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                  16⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:640
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                    17⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:5320
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8k6EMlPN68Zd.bat" "
                                                    17⤵
                                                      PID:1532
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        18⤵
                                                          PID:5648
                                                        • C:\Windows\system32\PING.EXE
                                                          ping -n 10 localhost
                                                          18⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:1056
                                                        • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                          "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                          18⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:976
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                            19⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:1664
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P3ExzvHOkISb.bat" "
                                                            19⤵
                                                              PID:6060
                                                              • C:\Windows\system32\chcp.com
                                                                chcp 65001
                                                                20⤵
                                                                  PID:6064
                                                                • C:\Windows\system32\PING.EXE
                                                                  ping -n 10 localhost
                                                                  20⤵
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:4872
                                                                • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
                                                                  "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
                                                                  20⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2132
                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                    "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
                                                                    21⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3772

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EAC.exe.log

                            Filesize

                            2KB

                            MD5

                            8f0271a63446aef01cf2bfc7b7c7976b

                            SHA1

                            b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

                            SHA256

                            da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

                            SHA512

                            78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

                          • C:\Users\Admin\AppData\Local\Temp\0Ycja3su1ShA.bat

                            Filesize

                            211B

                            MD5

                            d09f76768921af147e72595b7b4d473c

                            SHA1

                            15f3f37c5b38345a62a18d61711f059c3db6bd4e

                            SHA256

                            ba7f082b9e937431e820352b34ece3c30d2d5f72e491488e4a7e37b2b9450770

                            SHA512

                            6f512d5fe7701ca554d310dd4fd70e999091f5216849aa21433a04f81aacc7b2057fa987c8a714d6a54d3cbd979a6c5d6e03899ae8487b85215aaad83a590371

                          • C:\Users\Admin\AppData\Local\Temp\8k6EMlPN68Zd.bat

                            Filesize

                            211B

                            MD5

                            5220c9b4c9f38d69d0ba66b29519318b

                            SHA1

                            4add8883e193ab565fab37e1303a514d226d97ce

                            SHA256

                            aafd6518dd7b55abf9368338ecafab87d92bbd2acd8a8128331bfc4c654b22b6

                            SHA512

                            26271ceb7312bd58d0bacca80247a81825cf7d1fe3f777a75361c152623d378f0bcab095ff6ca0d9abee41641f3abdf5290a713709ff1ed5c4ef935aea1c7969

                          • C:\Users\Admin\AppData\Local\Temp\I5s8MxwSxDOw.bat

                            Filesize

                            211B

                            MD5

                            0f48c9fbc76b9b2d49b557bc624d56df

                            SHA1

                            b83622461b7b9fbdf043b2ed902a7c756974b073

                            SHA256

                            6cef3bc6137e9a36a30670f8aa6bb2e3ffac3e45513a412505cfd27e7a8af301

                            SHA512

                            554d22f7bb60b0dbdd8922c44d05a0b0a918a26f3161b878c94c293eb3430abc8f3941ef33d186e01f1a4e37b229e40fe7599b3b59388a55039dc8c52c29598d

                          • C:\Users\Admin\AppData\Local\Temp\JrPYVVGKpWPx.bat

                            Filesize

                            211B

                            MD5

                            314c0810a21efa6efadf107f236bc3c7

                            SHA1

                            fbad1c1188aef41331a5f39ac3e9d765cfad1e61

                            SHA256

                            16344d9a6f5f34532b13f8905e0afefe645735d7a947a582d911e64459a98145

                            SHA512

                            49de975e7514b6aae0b2559215ffe11be342ff71873d3e197c64dc23e307782389fbdd88734aafc3819e77c22c505b2b54cb704b1a3bf723b8d6f536463cb973

                          • C:\Users\Admin\AppData\Local\Temp\P3ExzvHOkISb.bat

                            Filesize

                            211B

                            MD5

                            057a91e164ad62d7b241853de3a14bfd

                            SHA1

                            417d7170ddc194dc3a6378329d030f62a660d615

                            SHA256

                            e0f10cfde328064ed7f49cf983956b44bfa056f65277e893ad3470d4c20e3859

                            SHA512

                            88a0f83f507564bce4588a5dee10b0e5c712a234c8b88fcab417d16a840c91765b2ddfcef39a76539979bd66902c19411ac54bc6bfab66f057dd55ddf008ea07

                          • C:\Users\Admin\AppData\Local\Temp\QjAICGn6mvlP.bat

                            Filesize

                            211B

                            MD5

                            65e135b2a9df2d16ba2c0e9261c860a6

                            SHA1

                            83ae90e4d1c7174e123318eedabbf90b2e484879

                            SHA256

                            bf5122ae181e09dc1ec9a6507a00a3e754e9ecf64f9ef40a6551b97c47b9fec8

                            SHA512

                            fb53c0f4e069507ad50ff3253c99fe59e2bcada33da852a4b6f3009db9f61e478542e31f9f220f8880e4751b898b3fb3a878d7c0d9b6dec1c1c5afdbe6f4c382

                          • C:\Users\Admin\AppData\Local\Temp\kQTfuP8LZRHl.bat

                            Filesize

                            211B

                            MD5

                            829fb3e5862c84e02225299ff999c683

                            SHA1

                            e8c6d5e835aecc61d323535542eca92590d3515f

                            SHA256

                            b424f4ba86a0488c952db9f5885b4fb2fbd1b6d74a17e4d33487a098dd379b25

                            SHA512

                            0b76190b852f6853774bfa1ead56f043363f5d161a84a0d7f58e3824d955511756171749730b1ed37389de52171f0f30409bc7548bf76e50059b31625fa9d5e3

                          • C:\Users\Admin\AppData\Local\Temp\kiVZOcKJ4gKJ.bat

                            Filesize

                            211B

                            MD5

                            8a33d7b72f30679e351264754bd74b4a

                            SHA1

                            225b126dbfc0a4a5fcf3bde7cf37fd6a2e6e09ff

                            SHA256

                            145e6ddef668ed3da1461b49d0f0e6a44aa42d74e9126dbfa48999d2abec7189

                            SHA512

                            3f5144ba7218c5e712ed150f9c5b5bfc05737c359a5bc64312cc2dc7cadf1ae11e9bf0c964d95a99c595e883f8bc6ec3b4b4a969f5210147a1bd450831574d0f

                          • C:\Users\Admin\AppData\Local\Temp\zjulA3rI3Vk7.bat

                            Filesize

                            211B

                            MD5

                            59537e54967622f8e8da2161b2d205ae

                            SHA1

                            2e3e45cc2b7190097c2faaafecc855f9214b381e

                            SHA256

                            6fa70d9dbc790fd63fb9c9a6a4abe356e0912d1756c59506097957af999218b6

                            SHA512

                            eb46bbf132b1665ddaf26c38f8369f7f8089c8071d4e873937300eb7050a4294d5dd1fee9e14ef9c45bddd5c205a70d64153c295c07abe4fa492f188d252c2cc

                          • C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe

                            Filesize

                            3.3MB

                            MD5

                            53327dca23173e9e9bae9d780786ba78

                            SHA1

                            1108be5863af8152dce9d7534cd217f44bfa12d3

                            SHA256

                            93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0

                            SHA512

                            cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed

                          • memory/5520-1-0x0000000000DC0000-0x0000000001120000-memory.dmp

                            Filesize

                            3.4MB

                          • memory/5520-10-0x00007FF899560000-0x00007FF89A021000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5520-2-0x00007FF899560000-0x00007FF89A021000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5520-0-0x00007FF899563000-0x00007FF899565000-memory.dmp

                            Filesize

                            8KB

                          • memory/5984-19-0x00007FF899560000-0x00007FF89A021000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5984-13-0x000000001C100000-0x000000001C1B2000-memory.dmp

                            Filesize

                            712KB

                          • memory/5984-12-0x000000001BFF0000-0x000000001C040000-memory.dmp

                            Filesize

                            320KB

                          • memory/5984-11-0x00007FF899560000-0x00007FF89A021000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5984-9-0x00007FF899560000-0x00007FF89A021000-memory.dmp

                            Filesize

                            10.8MB