Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 09:32

General

  • Target

    2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    5.9MB

  • MD5

    7afe1a0d6dd1daf9ed8813fea7f617c1

  • SHA1

    59c09d8e2c1e6cfe7776a9fab3fc78e9d56ac7c7

  • SHA256

    f63662c02c281cf3702245c163c3d0855a4bb8151d7225d42949eabd53b70a0d

  • SHA512

    052c581669cbb34c7861745be6cfa0acf131c92bb5b7205b25908ccecd582851d6c2a01824df31704242c7df10a825d7f37c8832f9de74770c6ba981c51d440a

  • SSDEEP

    98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUB:T+o56utgpPF8u/7B

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

C2

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes
  • access_type

    512

  • beacon_type

    256

  • create_remote_thread

    768

  • crypto_scheme

    256

  • host

    ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

  • http_header1

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • http_header2

    AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==

  • http_method1

    GET

  • http_method2

    POST

  • maxdns

    255

  • pipe_name

    \\%s\pipe\msagent_%x

  • polling_time

    5000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /N4215/adj/amzn.us.sr.aps

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

  • watermark

    0

Signatures

  • Cobalt Strike reflective loader 21 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 64 IoCs
  • Executes dropped EXE 21 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\System\ERljoUL.exe
      C:\Windows\System\ERljoUL.exe
      2⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\System\AJMmLmI.exe
      C:\Windows\System\AJMmLmI.exe
      2⤵
      • Executes dropped EXE
      PID:4160
    • C:\Windows\System\qfxNHTT.exe
      C:\Windows\System\qfxNHTT.exe
      2⤵
      • Executes dropped EXE
      PID:1436
    • C:\Windows\System\ARshnRw.exe
      C:\Windows\System\ARshnRw.exe
      2⤵
      • Executes dropped EXE
      PID:64
    • C:\Windows\System\ihKfdDj.exe
      C:\Windows\System\ihKfdDj.exe
      2⤵
      • Executes dropped EXE
      PID:5080
    • C:\Windows\System\QiDMTeV.exe
      C:\Windows\System\QiDMTeV.exe
      2⤵
      • Executes dropped EXE
      PID:2672
    • C:\Windows\System\vrkmpar.exe
      C:\Windows\System\vrkmpar.exe
      2⤵
      • Executes dropped EXE
      PID:1796
    • C:\Windows\System\qywFOaV.exe
      C:\Windows\System\qywFOaV.exe
      2⤵
      • Executes dropped EXE
      PID:1404
    • C:\Windows\System\ZcOHhuM.exe
      C:\Windows\System\ZcOHhuM.exe
      2⤵
      • Executes dropped EXE
      PID:4732
    • C:\Windows\System\pmeCKCE.exe
      C:\Windows\System\pmeCKCE.exe
      2⤵
      • Executes dropped EXE
      PID:2648
    • C:\Windows\System\hPmymiy.exe
      C:\Windows\System\hPmymiy.exe
      2⤵
      • Executes dropped EXE
      PID:1040
    • C:\Windows\System\seGxmei.exe
      C:\Windows\System\seGxmei.exe
      2⤵
      • Executes dropped EXE
      PID:3424
    • C:\Windows\System\IDAYKTV.exe
      C:\Windows\System\IDAYKTV.exe
      2⤵
      • Executes dropped EXE
      PID:3996
    • C:\Windows\System\TACzvNx.exe
      C:\Windows\System\TACzvNx.exe
      2⤵
      • Executes dropped EXE
      PID:1232
    • C:\Windows\System\xYbjKLr.exe
      C:\Windows\System\xYbjKLr.exe
      2⤵
      • Executes dropped EXE
      PID:1996
    • C:\Windows\System\uXatdik.exe
      C:\Windows\System\uXatdik.exe
      2⤵
      • Executes dropped EXE
      PID:3084
    • C:\Windows\System\CRoCYyS.exe
      C:\Windows\System\CRoCYyS.exe
      2⤵
      • Executes dropped EXE
      PID:4620
    • C:\Windows\System\EPdHMIX.exe
      C:\Windows\System\EPdHMIX.exe
      2⤵
      • Executes dropped EXE
      PID:3192
    • C:\Windows\System\KrGPpAf.exe
      C:\Windows\System\KrGPpAf.exe
      2⤵
      • Executes dropped EXE
      PID:2004
    • C:\Windows\System\UrtdGRL.exe
      C:\Windows\System\UrtdGRL.exe
      2⤵
      • Executes dropped EXE
      PID:3440
    • C:\Windows\System\BxAYQUY.exe
      C:\Windows\System\BxAYQUY.exe
      2⤵
      • Executes dropped EXE
      PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System\AJMmLmI.exe

    Filesize

    5.9MB

    MD5

    96239c037a08dcebc6bc6b96b7be8c98

    SHA1

    0bcd336afcc79806d8cd700d390323a11ba495ad

    SHA256

    4b31fa55f9d9b58037836ed94bf7ce978f92487afa9beb122d2664605152a1e7

    SHA512

    14368277ac37c331a0b96506fb8cb5642af62fc11694158bd7a12b14290085ab1b576ae23599818f025a0d466dbc79cbb2d092f07806fbf8ec9569efebf4b530

  • C:\Windows\System\ARshnRw.exe

    Filesize

    5.9MB

    MD5

    83eb58ee61fae7431b41d498c26c0874

    SHA1

    e6d1c3904d4c5445249b03014abd40f2edd70dc4

    SHA256

    b4cf8715dedfab42622a1f7d0f45b9d29d38127f7def4abd3f0aea8f65b4f3bd

    SHA512

    951da4c990d66154fbd8824a41435669def16542e5551b4433fd1959dab063a7355e1104bedeec1dd6259b168f9f309ca7a4eb81ae3888e6037792bc905827b8

  • C:\Windows\System\BxAYQUY.exe

    Filesize

    5.9MB

    MD5

    62cfa6c79fc5dd76a175c4c3c8e37552

    SHA1

    9ae7221ade1bcc105789601c6c2d4e0d8a466715

    SHA256

    a96855e21014c6cf669b2e4f7639ac86a56333def138ad4fd5fc055a18895f1b

    SHA512

    a200298c787175b58229d33f4364dd6adca7c54341cfc7163a18dbfb7913644226e8da52411da314aa796783e71365256efdd683ac608d63e4517a92f9bc2f15

  • C:\Windows\System\CRoCYyS.exe

    Filesize

    5.9MB

    MD5

    896e604682816f866198032f59f837bf

    SHA1

    4a425124fc887a3b5533116cb319f45a31155f92

    SHA256

    86e24f7935ed71b1dcee1cf40699fef75f6e33aae33069a0afc4999aaf4eeb2a

    SHA512

    94fbddb5afe168ecbbb2464956e6e843cbf922474a5164e03d2a2c2f274fdd2ebd9975d85616ebdba04822c221cd5c0e90e57d51bfb2b2c893aed044dc044ff4

  • C:\Windows\System\EPdHMIX.exe

    Filesize

    5.9MB

    MD5

    b13e6f6b1c6cf354c78f9d9c1329c27b

    SHA1

    c3b54dfe90f2c18c6ad56f315bc6cc6b27a6d783

    SHA256

    c95eb204e607e34bc6b0fec1d5e594057b9eaf7ade6f08787580192630d8351a

    SHA512

    88e898b4cdf8a039d6eae2dc644a4022fb1611408688e9ae654b98880fcdc49bd3688ff23e73737f4c11aa6629ced8ad2cdd69bd3da6e1650bc7a735a141bbfe

  • C:\Windows\System\ERljoUL.exe

    Filesize

    5.9MB

    MD5

    df8e391a0fbdd01d2f59990c52f1ab51

    SHA1

    5e5cb872faba1e64c91b31db7529b9d55875c24f

    SHA256

    d78f64b9adae8ea9740512892818bcf823413650e7bf4d99d64b7789800bc097

    SHA512

    61868762ac8676eaae7fc82b9f099c55f90d7b5a950e142d6ce77cdb35aa9ca4889e30e78b947c0a7592b7ec1f7012047e7d7f0188b21ab8ee7ca9c1d3805e53

  • C:\Windows\System\IDAYKTV.exe

    Filesize

    5.9MB

    MD5

    b25a5265269bd0b4b74b16de42ca054f

    SHA1

    6df44764ab62a267ac2c568e9a55a3760bfb9ffe

    SHA256

    09fa7dfcdc4407451220ed8b9fb4f85e3d112242db20532e66792c53dc16a3de

    SHA512

    0364dd4b6ddacd07ea854242fbcfd0e5a549609a1b35aad1390762e93da5f0454b81eebcfe718d3c3a11a397d2825c295db6ef3e79f8c7f581327f50584f2d1e

  • C:\Windows\System\KrGPpAf.exe

    Filesize

    5.9MB

    MD5

    51c762e28bb583589ff87530f0d5a0e8

    SHA1

    57cf87b0d6425a0ff473ad2758a722d80eddaa2f

    SHA256

    e61e3eddc0e9b4c9fca2e1693c4183545fdc75bb858e01feed04382670b38e10

    SHA512

    51fa08d0c7222bbfc35a9d5b4fdd833ef287d349ffc29d034f14a8333db409ba299096e0e8176ca1c86f8247cdb54a024c046dcda72bfcc2936ee80fe90631cc

  • C:\Windows\System\QiDMTeV.exe

    Filesize

    5.9MB

    MD5

    ee6fbc1d016ce249900d245d59c3c0cc

    SHA1

    0625f9aaddefb613e274a20c9ed9ab9828f19bcf

    SHA256

    0f63594e237c72257f7108d474ebb3d80a9c0bef08e7dd5f0edca7ea61a3b75c

    SHA512

    a42601d8c3223e38ea262149288b19da3d2dec1185e1bb0f305a7f69a755cd15a0b68e924f5a8dafb702bc65a717208af8673a8ac9dcf4d03eba25f5c453df84

  • C:\Windows\System\TACzvNx.exe

    Filesize

    5.9MB

    MD5

    02989f6953ddd853fbfebbab651af0e2

    SHA1

    d02cfe08c0beced1673eac3c01c98dfaf2cad44a

    SHA256

    f5b881c79e86cd7c2c98f03a46e416f9f2b1ae7f5be18de5986a8e2acf6d7dda

    SHA512

    b251906fe78b1cd08c286be77c3ae60dd24b6b69a9ada32219bed5be5dc4715c997c9458cbf2aadcaf9b492b32138fb1666f690215d99e91fc8c6e5601ebc5fd

  • C:\Windows\System\UrtdGRL.exe

    Filesize

    5.9MB

    MD5

    2226691e5b312ebc9964521d9450caee

    SHA1

    bbc27b846fb12907f63969addc5170949205a510

    SHA256

    2584b88da987a707ef56e8e44834336d950741a12c9503619d502e2c68b40f89

    SHA512

    e12cdf6d2eec6254ecedeff979a6bdcbcaf720dfd1da65b1580c9552a9261d749037a701e833aaa097f08bb3d61d8e14245fed624acf5c51eb13378c831b8433

  • C:\Windows\System\ZcOHhuM.exe

    Filesize

    5.9MB

    MD5

    d2321d6ad827f84c0e25a0355205c341

    SHA1

    ea16b2f68cee8f5fcbcc42628a09e6e6e277f33b

    SHA256

    61c2a5c13429ca91cd7aeccf234f4bfeee946774ca24bcebb5f0178fe91815e7

    SHA512

    35432de8506a6cb3ea7403e2fd4f07306e04efd2bf88048b2ffb1ffcf3f8d0558368e208524d2b1ed1a5d03bf7de826acbb21776a359f293970460a61a5ca031

  • C:\Windows\System\hPmymiy.exe

    Filesize

    5.9MB

    MD5

    7a8a406cea7d728fdbef1dc176210af4

    SHA1

    65a9d40e6c3d9ec1f201f854757d32ba1d6c072a

    SHA256

    1fd90f29cb3891c8ae08017ca2c5a6cf7aad6d4f2a704cb2b42149c74b861398

    SHA512

    61d4154db89b0da73914842fa82153cfd8f400c85c5a50e367bd5549c0e05b8f429b5a372ea92a802e507bec043138f338531cfa95f29616598df09d79b4d559

  • C:\Windows\System\ihKfdDj.exe

    Filesize

    5.9MB

    MD5

    7112e9db146f8597737feefd00a5cca5

    SHA1

    f801d13c8eec2e389e4dd284ac897048bc133290

    SHA256

    88c163d52f61c65852d7d6d09dc8b3bbf5a67ee5a7abdb7c7dd22bdc8e674d13

    SHA512

    63e0558df208314177835d6320b95e6d023afcf1c4e07bdf951ac62d6de471e2f165bb54d8fb695e44bc889e74af4fcc04e4fd3cc5e5e4e77d6e9c22a9cdfa1a

  • C:\Windows\System\pmeCKCE.exe

    Filesize

    5.9MB

    MD5

    c9c100f88c441d7c55ef2d99583dd93a

    SHA1

    291f55ccb87a583ae03d92a56587f1dd46631096

    SHA256

    2b4c602b6fd2ce19e9a15cd8a84a0bc4b3c6b8a0aaf0c44a4e8a83208f6720e2

    SHA512

    68ad62ed955369b4bbc6245d2ecc4db1d7bccf2cc840d65bdaed1a6f1277fa436b7b41954e7a0be4caea41eda42abceafb0e896e6af6eb666d2e8b2c35514329

  • C:\Windows\System\qfxNHTT.exe

    Filesize

    5.9MB

    MD5

    5cd79630eaf5efbb761c3792ac8083d7

    SHA1

    49417db1f0063ee5b4c6bfa9fcbbec360c062f39

    SHA256

    6f3575b3b7bec234a627317a48d643ac1fcf40a3c96889f972c880cf39a55cd9

    SHA512

    7b12ba18a12f6f2eed3b51b011efa8c3c1ca2db97075eb91148c8214cb13a42d2bb5c06772fb32045d6bdea735792c4aa1678fc694f3fdf0cb974696b95b0edd

  • C:\Windows\System\qywFOaV.exe

    Filesize

    5.9MB

    MD5

    0674639156f6f360f78f229d27ffb959

    SHA1

    115427ffc97e4f17fa9c5a3a2484de30c9e8f13f

    SHA256

    782166ed587084260148b39afb8806375f9a8c1f04ab7c0a666138cb3a903ff7

    SHA512

    8d07348e13ba84e2c73140bbc1ffd5d132242dffffa4b5062f9b32d25110d799a31a7b31aef266c9691f7d5bce7f7bcd4e437c8e17db663987bfd1fab28962b1

  • C:\Windows\System\seGxmei.exe

    Filesize

    5.9MB

    MD5

    bb5c37d288c14d46d5e1c36391edf134

    SHA1

    c719f1b161101edab685da0e08908a5b335ff1fb

    SHA256

    034d07f8c9f5640fa89ecb198f66618f32057d67e64a878b0ceb71621484e4af

    SHA512

    f0cec7f5a8f9bf16db0c041e0cb254931319123266a3e5e4f95551704d9c485e07035ef35ad758d5530d3e4af535f0d1d3695e6514a49207ca723b027eb01d13

  • C:\Windows\System\uXatdik.exe

    Filesize

    5.9MB

    MD5

    50baaa22cda1d2c5fa4a763809864b88

    SHA1

    ad33ba5e3bba14cfab717bd47c834116141b2120

    SHA256

    eaf965c5bf162742b5f7f5c60119db2044f6f2e242d6bbfc1a0b89c50284b0f8

    SHA512

    7938031a5af05623342150528a535f67212ab184380a4708062fdfd0b4e70f3e0381890a037ea46276a9ab9ed4b7930dbf803b6756fec58ee6849607e19a7963

  • C:\Windows\System\vrkmpar.exe

    Filesize

    5.9MB

    MD5

    6358d03daf882b463af2c2bdebdba80b

    SHA1

    8c07bb0f100c08af08a7be56ebb55b24108d4471

    SHA256

    9b5500872dde8bcf0407bd149ef5279945ac55de832c3827111fbf18ae736b56

    SHA512

    ce7516a4ece1b152df3934325a53973c52e5cc7c1294659254fb1316ddf92e215ea8738bcbaf8a551010442ed1e5ab562d7461da42520b0bbf68ec9f37b0609c

  • C:\Windows\System\xYbjKLr.exe

    Filesize

    5.9MB

    MD5

    807c7a9e6aa691482a8ee19fce008ff8

    SHA1

    5153a15937eec48e35cd64ead626d8e447859064

    SHA256

    1fdbf31144803688b31fd068287af8e5f9ed67b4796f1b08987a23dd0575804e

    SHA512

    fbda428ae02c506dcd00032eceeaf969872b4ff426d62d37670042fbae3ba7a7634644f2edfceb632d269ce6a6d64bdd909e39c93cd9b97187336f103ed3f847

  • memory/64-24-0x00007FF691D40000-0x00007FF692094000-memory.dmp

    Filesize

    3.3MB

  • memory/64-102-0x00007FF691D40000-0x00007FF692094000-memory.dmp

    Filesize

    3.3MB

  • memory/64-149-0x00007FF691D40000-0x00007FF692094000-memory.dmp

    Filesize

    3.3MB

  • memory/1040-157-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp

    Filesize

    3.3MB

  • memory/1040-66-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp

    Filesize

    3.3MB

  • memory/1040-133-0x00007FF7BC3F0000-0x00007FF7BC744000-memory.dmp

    Filesize

    3.3MB

  • memory/1232-86-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp

    Filesize

    3.3MB

  • memory/1232-140-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp

    Filesize

    3.3MB

  • memory/1232-158-0x00007FF7E6E10000-0x00007FF7E7164000-memory.dmp

    Filesize

    3.3MB

  • memory/1404-124-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1404-153-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1404-51-0x00007FF60FFA0000-0x00007FF6102F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1436-101-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1436-21-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1436-148-0x00007FF6344A0000-0x00007FF6347F4000-memory.dmp

    Filesize

    3.3MB

  • memory/1796-45-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp

    Filesize

    3.3MB

  • memory/1796-152-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp

    Filesize

    3.3MB

  • memory/1796-115-0x00007FF7B32B0000-0x00007FF7B3604000-memory.dmp

    Filesize

    3.3MB

  • memory/1960-166-0x00007FF73C570000-0x00007FF73C8C4000-memory.dmp

    Filesize

    3.3MB

  • memory/1960-138-0x00007FF73C570000-0x00007FF73C8C4000-memory.dmp

    Filesize

    3.3MB

  • memory/1996-141-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp

    Filesize

    3.3MB

  • memory/1996-160-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp

    Filesize

    3.3MB

  • memory/1996-93-0x00007FF74CDC0000-0x00007FF74D114000-memory.dmp

    Filesize

    3.3MB

  • memory/2004-144-0x00007FF782820000-0x00007FF782B74000-memory.dmp

    Filesize

    3.3MB

  • memory/2004-164-0x00007FF782820000-0x00007FF782B74000-memory.dmp

    Filesize

    3.3MB

  • memory/2004-125-0x00007FF782820000-0x00007FF782B74000-memory.dmp

    Filesize

    3.3MB

  • memory/2648-139-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp

    Filesize

    3.3MB

  • memory/2648-156-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp

    Filesize

    3.3MB

  • memory/2648-79-0x00007FF7E9DF0000-0x00007FF7EA144000-memory.dmp

    Filesize

    3.3MB

  • memory/2672-114-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp

    Filesize

    3.3MB

  • memory/2672-36-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp

    Filesize

    3.3MB

  • memory/2672-151-0x00007FF794B90000-0x00007FF794EE4000-memory.dmp

    Filesize

    3.3MB

  • memory/2872-9-0x00007FF602450000-0x00007FF6027A4000-memory.dmp

    Filesize

    3.3MB

  • memory/2872-72-0x00007FF602450000-0x00007FF6027A4000-memory.dmp

    Filesize

    3.3MB

  • memory/2872-146-0x00007FF602450000-0x00007FF6027A4000-memory.dmp

    Filesize

    3.3MB

  • memory/3084-161-0x00007FF638520000-0x00007FF638874000-memory.dmp

    Filesize

    3.3MB

  • memory/3084-105-0x00007FF638520000-0x00007FF638874000-memory.dmp

    Filesize

    3.3MB

  • memory/3192-116-0x00007FF606670000-0x00007FF6069C4000-memory.dmp

    Filesize

    3.3MB

  • memory/3192-143-0x00007FF606670000-0x00007FF6069C4000-memory.dmp

    Filesize

    3.3MB

  • memory/3192-163-0x00007FF606670000-0x00007FF6069C4000-memory.dmp

    Filesize

    3.3MB

  • memory/3424-155-0x00007FF76C030000-0x00007FF76C384000-memory.dmp

    Filesize

    3.3MB

  • memory/3424-85-0x00007FF76C030000-0x00007FF76C384000-memory.dmp

    Filesize

    3.3MB

  • memory/3440-145-0x00007FF639060000-0x00007FF6393B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3440-137-0x00007FF639060000-0x00007FF6393B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3440-165-0x00007FF639060000-0x00007FF6393B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3996-94-0x00007FF7FBC50000-0x00007FF7FBFA4000-memory.dmp

    Filesize

    3.3MB

  • memory/3996-159-0x00007FF7FBC50000-0x00007FF7FBFA4000-memory.dmp

    Filesize

    3.3MB

  • memory/4160-95-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp

    Filesize

    3.3MB

  • memory/4160-147-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp

    Filesize

    3.3MB

  • memory/4160-16-0x00007FF69FF90000-0x00007FF6A02E4000-memory.dmp

    Filesize

    3.3MB

  • memory/4620-142-0x00007FF67B130000-0x00007FF67B484000-memory.dmp

    Filesize

    3.3MB

  • memory/4620-162-0x00007FF67B130000-0x00007FF67B484000-memory.dmp

    Filesize

    3.3MB

  • memory/4620-107-0x00007FF67B130000-0x00007FF67B484000-memory.dmp

    Filesize

    3.3MB

  • memory/4732-154-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp

    Filesize

    3.3MB

  • memory/4732-63-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp

    Filesize

    3.3MB

  • memory/4732-129-0x00007FF6E1570000-0x00007FF6E18C4000-memory.dmp

    Filesize

    3.3MB

  • memory/4788-1-0x0000027707840000-0x0000027707850000-memory.dmp

    Filesize

    64KB

  • memory/4788-67-0x00007FF676920000-0x00007FF676C74000-memory.dmp

    Filesize

    3.3MB

  • memory/4788-0-0x00007FF676920000-0x00007FF676C74000-memory.dmp

    Filesize

    3.3MB

  • memory/5080-150-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp

    Filesize

    3.3MB

  • memory/5080-112-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp

    Filesize

    3.3MB

  • memory/5080-31-0x00007FF77B3C0000-0x00007FF77B714000-memory.dmp

    Filesize

    3.3MB