Resubmissions

25-08-2024 14:11

240825-rhfkpsybnb 10

25-08-2024 14:06

240825-ret9pazcpr 10

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-08-2024 14:06

General

  • Target

    SeroXen-main.zip

  • Size

    14.7MB

  • MD5

    0a682639d15acff9fa26d868b718a70e

  • SHA1

    a87722f3d2454383bb53d63845290d065551104a

  • SHA256

    424691c17ca850f4b9d390a795b5c416f3df3c37f223c90fcc8544344ae86b5d

  • SHA512

    479163fde3bc8fe972cda20f4b0d092c51cc511ee9b3f614f62c8a87cbc21e2d6dd71e0fe62d3932122e1706fe528bc52689ad81b5bbf270afa70164f55917d9

  • SSDEEP

    393216:ob5vzXcRjp+Chy8a8ZUvNKz5QMBYkdDBV4Xfdaup6E94D:ob1rm4Chy8avvwvBJBveQup6E9e

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 6 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SeroXen-main.zip
    1⤵
      PID:4304
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:948
      • C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe
        "C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe
          "C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4360
      • C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe
        "C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe"
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe
          "C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:3900
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\SeroXen-main\SeroXen Documentation and TOS.pdf"
        1⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=54B07E10C477DDEAC3A1CD14159B7142 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3440
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=930790554A64E5711C344E9F459ECEEE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=930790554A64E5711C344E9F459ECEEE --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3992
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7519B0057CF0D03DD2995A52191C2F3A --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4804
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DB797DA970E54ADF24BA5B1128A018DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DB797DA970E54ADF24BA5B1128A018DD --renderer-client-id=5 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job /prefetch:1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2200
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=863F0AC970532E76F440BAA3BCF7AE59 --mojo-platform-channel-handle=2708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1504
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1AE4FD7ADCE26323124034A001550B7F --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4772
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SeroXen-main\README.txt
        1⤵
          PID:2524
        • C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe
          "C:\Users\Admin\Desktop\SeroXen-main\bin\hwidreset_sdk\SeroXen HWID Reset.exe"
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4572
        • C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe
          "C:\Users\Admin\Desktop\SeroXen-main\SeroXen.exe"
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2596

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          64KB

          MD5

          c8ee91f052eb0a5c2d1b8060a2a0e155

          SHA1

          3eb0a1cfbcf6a5840917d75dad774e79eb36cfb9

          SHA256

          cdcdfcd8b5140cc6b4c2238eeecba5a80290cccd273f90f829fc918feb56268b

          SHA512

          4478e521b733f2302318f81238b42b4ff50fa1a791a6d7e37f2e7bd7019fa55fe70e7b74b93ca0a0f3790af2ae4897bba037a10732f9372a732ed3be9b3d275d

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          36KB

          MD5

          b30d3becc8731792523d599d949e63f5

          SHA1

          19350257e42d7aee17fb3bf139a9d3adb330fad4

          SHA256

          b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

          SHA512

          523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

        • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

          Filesize

          56KB

          MD5

          752a1f26b18748311b691c7d8fc20633

          SHA1

          c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

          SHA256

          111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

          SHA512

          a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SeroXen.exe.log

          Filesize

          1KB

          MD5

          b4e91d2e5f40d5e2586a86cf3bb4df24

          SHA1

          31920b3a41aa4400d4a0230a7622848789b38672

          SHA256

          5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

          SHA512

          968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

        • C:\Users\Admin\AppData\Local\Temp\49979061-04bb-41a9-8625-de2d15652f02\AgileDotNetRT64.dll

          Filesize

          3.0MB

          MD5

          e3bd88b3c3e9b33dfa72c814f8826cff

          SHA1

          6d220c9eb7ee695f2b9dec261941bed59cac15e4

          SHA256

          28e9458a43e5d86a341590eaa83d0da18c29fce81f2383d84bda484e049a1796

          SHA512

          fcb7e384b5bda0f810c4b6190a991bd066eedfc8fc97af9837cda1ba480385c8bc09bd703c1029f9d8d8a3eea3dbc03af97b014b4713a4ceea6ad6ae85b3b6e9

        • memory/748-37-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/748-40-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/748-38-0x00007FF92A0E0000-0x00007FF92A22F000-memory.dmp

          Filesize

          1.3MB

        • memory/748-36-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/1564-173-0x0000000009600000-0x000000000974D000-memory.dmp

          Filesize

          1.3MB

        • memory/1564-171-0x0000000009AD0000-0x0000000009D7B000-memory.dmp

          Filesize

          2.7MB

        • memory/1956-13-0x00000183886C0000-0x00000183886FE000-memory.dmp

          Filesize

          248KB

        • memory/1956-19-0x00007FF928E10000-0x00007FF9298D2000-memory.dmp

          Filesize

          10.8MB

        • memory/1956-18-0x00007FF926120000-0x00007FF92697F000-memory.dmp

          Filesize

          8.4MB

        • memory/1956-11-0x00007FF927600000-0x00007FF92774F000-memory.dmp

          Filesize

          1.3MB

        • memory/1956-1-0x0000018386310000-0x0000018386892000-memory.dmp

          Filesize

          5.5MB

        • memory/1956-9-0x00007FF926120000-0x00007FF92697F000-memory.dmp

          Filesize

          8.4MB

        • memory/1956-10-0x00007FF928E10000-0x00007FF9298D2000-memory.dmp

          Filesize

          10.8MB

        • memory/1956-0-0x00007FF928E13000-0x00007FF928E15000-memory.dmp

          Filesize

          8KB

        • memory/1956-15-0x00007FF926120000-0x00007FF92697F000-memory.dmp

          Filesize

          8.4MB

        • memory/1956-14-0x00007FF928E10000-0x00007FF9298D2000-memory.dmp

          Filesize

          10.8MB

        • memory/1956-12-0x0000018388680000-0x00000183886BC000-memory.dmp

          Filesize

          240KB

        • memory/2596-217-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/2596-214-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/2596-215-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/2596-216-0x00007FF929D40000-0x00007FF929E8F000-memory.dmp

          Filesize

          1.3MB

        • memory/3900-45-0x00007FF92A0E0000-0x00007FF92A22F000-memory.dmp

          Filesize

          1.3MB

        • memory/3900-46-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/3900-44-0x00007FF926290000-0x00007FF926AEF000-memory.dmp

          Filesize

          8.4MB

        • memory/4360-29-0x00007FF926DA0000-0x00007FF9275FF000-memory.dmp

          Filesize

          8.4MB

        • memory/4360-32-0x00007FF926DA0000-0x00007FF9275FF000-memory.dmp

          Filesize

          8.4MB

        • memory/4360-30-0x00007FF927600000-0x00007FF92774F000-memory.dmp

          Filesize

          1.3MB

        • memory/4360-28-0x00007FF926DA0000-0x00007FF9275FF000-memory.dmp

          Filesize

          8.4MB

        • memory/4360-20-0x000001F2DB140000-0x000001F2DB756000-memory.dmp

          Filesize

          6.1MB

        • memory/4572-208-0x00007FF925610000-0x00007FF925E6F000-memory.dmp

          Filesize

          8.4MB

        • memory/4572-209-0x00007FF925610000-0x00007FF925E6F000-memory.dmp

          Filesize

          8.4MB

        • memory/4572-210-0x00007FF929F30000-0x00007FF92A07F000-memory.dmp

          Filesize

          1.3MB

        • memory/4572-212-0x00007FF925610000-0x00007FF925E6F000-memory.dmp

          Filesize

          8.4MB