Analysis

  • max time kernel
    52s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 21:47

General

  • Target

    Loader.exe

  • Size

    3.9MB

  • MD5

    47a3da93e56b32634ef75d89326eddfd

  • SHA1

    c713ae03c5ca84d5b9d00c3766976a80ff4870f9

  • SHA256

    9da77aa713f1d8a0c0491326e6b187f57c59a9ac9988765913ad837b59dd0687

  • SHA512

    94a936ed621f8aee938bd9e58827723243519c282591d00713f5825c465d2e68b8598911bba712d1a62795d380e4c19b04449a4333983484b03f051fdad18ad6

  • SSDEEP

    98304:Nk1zJMJNrH1Z236EYzNVGm+xI7jfg/7KlTrzTGnI4A/z1Vre:q1zJSVHD236JXjY/7KFKnCz1Ze

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

193.161.193.99:53757

Mutex

qfufsslmpoqmfov

Attributes
  • delay

    1

  • install

    true

  • install_file

    Runtime Broker.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs
  • Async RAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 10 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:428
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:472
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch
        2⤵
          PID:604
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe
            3⤵
              PID:1660
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:552
              • C:\Windows\system32\wbem\wmiprvse.exe
                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                3⤵
                  PID:1936
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k RPCSS
                2⤵
                  PID:688
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                  2⤵
                    PID:768
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                    2⤵
                      PID:828
                      • C:\Windows\system32\Dwm.exe
                        "C:\Windows\system32\Dwm.exe"
                        3⤵
                          PID:1160
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:856
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        2⤵
                          PID:976
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService
                          2⤵
                            PID:284
                          • C:\Windows\System32\spoolsv.exe
                            C:\Windows\System32\spoolsv.exe
                            2⤵
                              PID:956
                            • C:\Windows\system32\taskhost.exe
                              "taskhost.exe"
                              2⤵
                                PID:1080
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                2⤵
                                  PID:1096
                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                  2⤵
                                    PID:1608
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                    2⤵
                                      PID:2876
                                    • C:\Windows\system32\sppsvc.exe
                                      C:\Windows\system32\sppsvc.exe
                                      2⤵
                                        PID:1524
                                      • C:\Program Files\Google\Chrome\updater.exe
                                        "C:\Program Files\Google\Chrome\updater.exe"
                                        2⤵
                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:2928
                                    • C:\Windows\system32\lsass.exe
                                      C:\Windows\system32\lsass.exe
                                      1⤵
                                        PID:488
                                      • C:\Windows\system32\lsm.exe
                                        C:\Windows\system32\lsm.exe
                                        1⤵
                                          PID:496
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                            PID:1188
                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                              2⤵
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:2064
                                              • C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2804
                                              • C:\Users\Admin\AppData\Local\Temp\1028vcpu.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1028vcpu.exe"
                                                3⤵
                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Program Files directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:2984
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2784
                                            • C:\Windows\System32\cmd.exe
                                              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2716
                                              • C:\Windows\System32\sc.exe
                                                sc stop UsoSvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:2816
                                              • C:\Windows\System32\sc.exe
                                                sc stop WaaSMedicSvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:1036
                                              • C:\Windows\System32\sc.exe
                                                sc stop wuauserv
                                                3⤵
                                                • Launches sc.exe
                                                PID:2588
                                              • C:\Windows\System32\sc.exe
                                                sc stop bits
                                                3⤵
                                                • Launches sc.exe
                                                PID:480
                                              • C:\Windows\System32\sc.exe
                                                sc stop dosvc
                                                3⤵
                                                • Launches sc.exe
                                                PID:2220
                                            • C:\Windows\System32\cmd.exe
                                              C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of WriteProcessMemory
                                              PID:1032
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -hibernate-timeout-ac 0
                                                3⤵
                                                • Power Settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2044
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -hibernate-timeout-dc 0
                                                3⤵
                                                • Power Settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2388
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -standby-timeout-ac 0
                                                3⤵
                                                • Power Settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2964
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -standby-timeout-dc 0
                                                3⤵
                                                • Power Settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1008
                                            • C:\Windows\System32\dialer.exe
                                              C:\Windows\System32\dialer.exe
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:1232
                                            • C:\Windows\System32\schtasks.exe
                                              C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
                                              2⤵
                                                PID:620
                                              • C:\Windows\System32\schtasks.exe
                                                C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xdzcihgbspge.xml"
                                                2⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2576
                                              • C:\Windows\System32\schtasks.exe
                                                C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                2⤵
                                                  PID:2016
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                  2⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Drops file in System32 directory
                                                  • Modifies data under HKEY_USERS
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1892
                                                • C:\Windows\System32\cmd.exe
                                                  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                  2⤵
                                                    PID:1888
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop UsoSvc
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2252
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop WaaSMedicSvc
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:824
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop wuauserv
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:1612
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop bits
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2244
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop dosvc
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2316
                                                  • C:\Windows\System32\cmd.exe
                                                    C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                    2⤵
                                                    • Power Settings
                                                    PID:1072
                                                    • C:\Windows\System32\powercfg.exe
                                                      powercfg /x -hibernate-timeout-ac 0
                                                      3⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2456
                                                    • C:\Windows\System32\powercfg.exe
                                                      powercfg /x -hibernate-timeout-dc 0
                                                      3⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3020
                                                    • C:\Windows\System32\powercfg.exe
                                                      powercfg /x -standby-timeout-ac 0
                                                      3⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2592
                                                    • C:\Windows\System32\powercfg.exe
                                                      powercfg /x -standby-timeout-dc 0
                                                      3⤵
                                                      • Power Settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2124
                                                  • C:\Windows\System32\dialer.exe
                                                    C:\Windows\System32\dialer.exe
                                                    2⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2424
                                                  • C:\Windows\System32\schtasks.exe
                                                    C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\xdzcihgbspge.xml"
                                                    2⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1920
                                                  • C:\Windows\System32\dialer.exe
                                                    C:\Windows\System32\dialer.exe
                                                    2⤵
                                                      PID:940
                                                    • C:\Windows\System32\dialer.exe
                                                      C:\Windows\System32\dialer.exe
                                                      2⤵
                                                        PID:584
                                                    • C:\Windows\system32\conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe "494496191318555972-1738869403-1869498514-12689121811072265180-12174978162029514293"
                                                      1⤵
                                                        PID:1732
                                                      • C:\Windows\system32\conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe "-2084177344-808535898737400982-1722346883-917344898786564855-717977791-1369285479"
                                                        1⤵
                                                          PID:3016
                                                        • C:\Windows\system32\conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe "-769525399-37710208820061186592020407174-169253292514626033-18192214481360851352"
                                                          1⤵
                                                            PID:1144
                                                          • C:\Windows\system32\conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe "1587951643221127978-18434015711051289986-1163394789-1193287312-6766688541835914138"
                                                            1⤵
                                                              PID:2892
                                                            • C:\Windows\system32\conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe "609843865-60587387-1302059031500626100850730787-170157551-1457115141587697297"
                                                              1⤵
                                                                PID:904
                                                              • C:\Windows\system32\conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe "1768143594-482197904-908122162-10868169948681070491950405799768953578523075794"
                                                                1⤵
                                                                  PID:2460
                                                                • C:\Windows\system32\conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe "-13622785671720907004-1667832532815739943-1846038395-966259376-1955261934-231314931"
                                                                  1⤵
                                                                    PID:1364
                                                                  • C:\Windows\system32\conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe "-144064352918495135352143255852-617084331-1353230321-11612669222144278232-264733511"
                                                                    1⤵
                                                                      PID:1620

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe

                                                                      Filesize

                                                                      74KB

                                                                      MD5

                                                                      64c25e40b34077521c03f110c6e94d2c

                                                                      SHA1

                                                                      a4667123f6a1fa9ca8759590efe9bb44bff217a0

                                                                      SHA256

                                                                      f17d6b33fa63c6aecbb4d313a2230359c04e294ccf699a78b3a581abb84b197d

                                                                      SHA512

                                                                      d8c48bc095ccc794d6eb788d13d81d05d02eb7ddd2f9f2f063ffa9db48158da59d3061d9d50182f1007d443e13aae20aa5506daa6cb04565a13de2964657c14b

                                                                    • C:\Users\Admin\AppData\Local\Temp\xdzcihgbspge.xml

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      546d67a48ff2bf7682cea9fac07b942e

                                                                      SHA1

                                                                      a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

                                                                      SHA256

                                                                      eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

                                                                      SHA512

                                                                      10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

                                                                    • C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC

                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      358e489c69a8521a66a403c7ad542b9c

                                                                      SHA1

                                                                      1377e6114996ec394de1045e6807f297e0879358

                                                                      SHA256

                                                                      a15b2504490e51391c99243904d37c299cb5aeab207b41c5463195ad4321dc75

                                                                      SHA512

                                                                      ac86aea08341604c8d9b9f0361b41dcae8c24aaef512b48e0ec9834a7c18ca8a21a885040c5ff397c015c8b74948fdc6771c10c807238a4947bdddae8daaa5bc

                                                                    • \Users\Admin\AppData\Local\Temp\1028vcpu.exe

                                                                      Filesize

                                                                      5.4MB

                                                                      MD5

                                                                      87ac8e9f1ea0e0117272a7f77354bdfd

                                                                      SHA1

                                                                      65803c76e14f7a18a9e633885fa52fc6f68c19e0

                                                                      SHA256

                                                                      8b65c3e8a8c9ba6d705ff09b0149fe9fa1b6160e891cb5aefc9d10839fdf1bfb

                                                                      SHA512

                                                                      8faff8921a6e46782a285bb50334021ab51e168346e40b38606957a43f9ffb9a6749a4f19fe088576c043b2c8f4adc9de9e575f99a5d51bbcc70a044e3b5bad3

                                                                    • memory/428-36-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/428-34-0x0000000000CC0000-0x0000000000CEB000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/428-31-0x0000000000B70000-0x0000000000B94000-memory.dmp

                                                                      Filesize

                                                                      144KB

                                                                    • memory/428-33-0x0000000000B70000-0x0000000000B94000-memory.dmp

                                                                      Filesize

                                                                      144KB

                                                                    • memory/428-35-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/472-49-0x0000000000080000-0x00000000000AB000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/472-52-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/472-53-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/488-70-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/488-71-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/488-69-0x0000000000060000-0x000000000008B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/496-64-0x0000000000350000-0x000000000037B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/496-85-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/496-86-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/604-75-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/604-74-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/604-73-0x0000000000210000-0x000000000023B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/688-66-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/688-67-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/688-65-0x0000000000520000-0x000000000054B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/768-77-0x0000000000C10000-0x0000000000C3B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/768-78-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/768-79-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/828-81-0x0000000000D20000-0x0000000000D4B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/828-82-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/828-83-0x0000000037080000-0x0000000037090000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/856-180-0x000007FEBD8A0000-0x000007FEBD8B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/856-179-0x0000000000C60000-0x0000000000C8B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/1232-29-0x0000000077040000-0x00000000771E9000-memory.dmp

                                                                      Filesize

                                                                      1.7MB

                                                                    • memory/1232-30-0x0000000076E20000-0x0000000076F3F000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/1892-345-0x0000000001150000-0x0000000001158000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                    • memory/1892-340-0x000000001A0A0000-0x000000001A382000-memory.dmp

                                                                      Filesize

                                                                      2.9MB

                                                                    • memory/2064-2-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2064-3-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2064-19-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2064-0-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2064-4-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2064-1-0x0000000000F10000-0x00000000012F0000-memory.dmp

                                                                      Filesize

                                                                      3.9MB

                                                                    • memory/2784-26-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                                                                      Filesize

                                                                      2.9MB

                                                                    • memory/2784-27-0x0000000002300000-0x0000000002308000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                    • memory/2804-17-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2804-18-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2804-20-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2804-10-0x0000000000EE0000-0x0000000000EF8000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                    • memory/2984-21-0x000000013F270000-0x000000013F7D5000-memory.dmp

                                                                      Filesize

                                                                      5.4MB