Analysis

  • max time kernel
    189s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:01

General

  • Target

    010ab25cc50fd20c42e81f0e9f008c033cce51553634e3b00bcf5be183008180.exe

  • Size

    484KB

  • MD5

    5e14b3f5507e3d056b2db5002ba3dd43

  • SHA1

    91733b4f74aa40de0b67b6249fc103663bf055e9

  • SHA256

    010ab25cc50fd20c42e81f0e9f008c033cce51553634e3b00bcf5be183008180

  • SHA512

    586d9bc00279d8f91ac197038362647368ae0bdb92887e6f718cc402bba7db927f6becfac343de3e73cf12627c65350ebb50c67516bb00c5c252241742f50f72

  • SSDEEP

    12288:zoUld/f2I9JECdYW4/e4Pii15XZSAmKjlafbdDNUQ:792ILECd0R15XZS3QafpDNUQ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 49 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\010ab25cc50fd20c42e81f0e9f008c033cce51553634e3b00bcf5be183008180.exe
      "C:\Users\Admin\AppData\Local\Temp\010ab25cc50fd20c42e81f0e9f008c033cce51553634e3b00bcf5be183008180.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\LB9c4j3K.exe
        C:\Users\Admin\LB9c4j3K.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Users\Admin\docuv.exe
          "C:\Users\Admin\docuv.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2016
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del LB9c4j3K.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1780
      • C:\Users\Admin\aahost.exe
        C:\Users\Admin\aahost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Users\Admin\aahost.exe
          "C:\Users\Admin\aahost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1124
      • C:\Users\Admin\bshost.exe
        C:\Users\Admin\bshost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:1600
        • C:\Users\Admin\dyhost.exe
          C:\Users\Admin\dyhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1508
        • C:\Users\Admin\ekhost.exe
          C:\Users\Admin\ekhost.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del ekhost.exe
            4⤵
              PID:1744
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:1048
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del 010ab25cc50fd20c42e81f0e9f008c033cce51553634e3b00bcf5be183008180.exe
            3⤵
            • Deletes itself
            • Suspicious use of WriteProcessMemory
            PID:680
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:432
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        1⤵
          PID:864
        • C:\Windows\system32\csrss.exe
          %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
          1⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:332
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1736
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            1⤵
              PID:1692
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
              • Loads dropped DLL
              PID:1192

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\LB9c4j3K.exe

              Filesize

              212KB

              MD5

              fa0eb2a8b561ea9afc6a51709ff0d7de

              SHA1

              4ef5265f5b5bb1a4857e7668f132405c799da155

              SHA256

              99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

              SHA512

              0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

            • C:\Users\Admin\LB9c4j3K.exe

              Filesize

              212KB

              MD5

              fa0eb2a8b561ea9afc6a51709ff0d7de

              SHA1

              4ef5265f5b5bb1a4857e7668f132405c799da155

              SHA256

              99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

              SHA512

              0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

            • C:\Users\Admin\aahost.exe

              Filesize

              140KB

              MD5

              93ea44e078cb0477614729636866a84b

              SHA1

              f9752413d48fd98a77cfce8fff04a7a0d72c26d8

              SHA256

              c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

              SHA512

              351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

            • C:\Users\Admin\aahost.exe

              Filesize

              140KB

              MD5

              93ea44e078cb0477614729636866a84b

              SHA1

              f9752413d48fd98a77cfce8fff04a7a0d72c26d8

              SHA256

              c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

              SHA512

              351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

            • C:\Users\Admin\aahost.exe

              Filesize

              140KB

              MD5

              93ea44e078cb0477614729636866a84b

              SHA1

              f9752413d48fd98a77cfce8fff04a7a0d72c26d8

              SHA256

              c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

              SHA512

              351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

            • C:\Users\Admin\bshost.exe

              Filesize

              260KB

              MD5

              bbc0a2fe1284778896b57ffc5701aefa

              SHA1

              6b9a0106b82c63265936ce728a858d258c8f6b14

              SHA256

              92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

              SHA512

              8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

            • C:\Users\Admin\bshost.exe

              Filesize

              260KB

              MD5

              bbc0a2fe1284778896b57ffc5701aefa

              SHA1

              6b9a0106b82c63265936ce728a858d258c8f6b14

              SHA256

              92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

              SHA512

              8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

            • C:\Users\Admin\docuv.exe

              Filesize

              212KB

              MD5

              4bb0e1988a3d76e381cc75dcf4013f2d

              SHA1

              1c259c512ef017e1984dfc68d700780680579c13

              SHA256

              8e7b0d6ca407fc9eb9361f8d3d2780646b8a759430831763a044512321c34dfe

              SHA512

              52d2db534210327c9ba1041b9e2f0e3e7a023e0dc84c55887d904d90bfd013aa28473b01f8f99f991206cea14b860f7729437e929477c7ad8f3a2b1ffafcc53a

            • C:\Users\Admin\docuv.exe

              Filesize

              212KB

              MD5

              4bb0e1988a3d76e381cc75dcf4013f2d

              SHA1

              1c259c512ef017e1984dfc68d700780680579c13

              SHA256

              8e7b0d6ca407fc9eb9361f8d3d2780646b8a759430831763a044512321c34dfe

              SHA512

              52d2db534210327c9ba1041b9e2f0e3e7a023e0dc84c55887d904d90bfd013aa28473b01f8f99f991206cea14b860f7729437e929477c7ad8f3a2b1ffafcc53a

            • C:\Users\Admin\dyhost.exe

              Filesize

              48KB

              MD5

              d46eb4bf816ed9978636de7955245323

              SHA1

              c474df60a83302e0d010d11dcebd7cdb3cc22866

              SHA256

              2ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd

              SHA512

              e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef

            • C:\Users\Admin\ekhost.exe

              Filesize

              24KB

              MD5

              9fe0e5252dc24fc1788b0d8b26026807

              SHA1

              21e3063a0fac1157b9707861048c5f7fbd070ceb

              SHA256

              9c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40

              SHA512

              613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c

            • C:\Windows\system32\consrv.dll

              Filesize

              53KB

              MD5

              4d7cde615a0f534bd5e359951829554b

              SHA1

              c885d00d9000f2a5dbc78f6193a052b36f4fe968

              SHA256

              414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

              SHA512

              33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

            • \??\globalroot\systemroot\assembly\temp\@

              Filesize

              2KB

              MD5

              4622c8529e4838f988561a124eb31885

              SHA1

              bfc5f6a67296b91c9b774b884913a40f7868adb3

              SHA256

              6d06fe5ef35d4557d26a1d7da61c2286c214d84f9d52b0969266b03171486825

              SHA512

              53c1517bfb4cd03bbb3d115191d0b88f04309dad825790f3437fb178ad0ec4cf318a02cc671d397a9ae4dfd61450bb5d2dae80bc8ff8e3ef9224bfa2a8014343

            • \Users\Admin\LB9c4j3K.exe

              Filesize

              212KB

              MD5

              fa0eb2a8b561ea9afc6a51709ff0d7de

              SHA1

              4ef5265f5b5bb1a4857e7668f132405c799da155

              SHA256

              99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

              SHA512

              0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

            • \Users\Admin\LB9c4j3K.exe

              Filesize

              212KB

              MD5

              fa0eb2a8b561ea9afc6a51709ff0d7de

              SHA1

              4ef5265f5b5bb1a4857e7668f132405c799da155

              SHA256

              99ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f

              SHA512

              0e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6

            • \Users\Admin\aahost.exe

              Filesize

              140KB

              MD5

              93ea44e078cb0477614729636866a84b

              SHA1

              f9752413d48fd98a77cfce8fff04a7a0d72c26d8

              SHA256

              c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

              SHA512

              351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

            • \Users\Admin\aahost.exe

              Filesize

              140KB

              MD5

              93ea44e078cb0477614729636866a84b

              SHA1

              f9752413d48fd98a77cfce8fff04a7a0d72c26d8

              SHA256

              c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27

              SHA512

              351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113

            • \Users\Admin\bshost.exe

              Filesize

              260KB

              MD5

              bbc0a2fe1284778896b57ffc5701aefa

              SHA1

              6b9a0106b82c63265936ce728a858d258c8f6b14

              SHA256

              92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

              SHA512

              8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

            • \Users\Admin\bshost.exe

              Filesize

              260KB

              MD5

              bbc0a2fe1284778896b57ffc5701aefa

              SHA1

              6b9a0106b82c63265936ce728a858d258c8f6b14

              SHA256

              92fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0

              SHA512

              8a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930

            • \Users\Admin\docuv.exe

              Filesize

              212KB

              MD5

              4bb0e1988a3d76e381cc75dcf4013f2d

              SHA1

              1c259c512ef017e1984dfc68d700780680579c13

              SHA256

              8e7b0d6ca407fc9eb9361f8d3d2780646b8a759430831763a044512321c34dfe

              SHA512

              52d2db534210327c9ba1041b9e2f0e3e7a023e0dc84c55887d904d90bfd013aa28473b01f8f99f991206cea14b860f7729437e929477c7ad8f3a2b1ffafcc53a

            • \Users\Admin\docuv.exe

              Filesize

              212KB

              MD5

              4bb0e1988a3d76e381cc75dcf4013f2d

              SHA1

              1c259c512ef017e1984dfc68d700780680579c13

              SHA256

              8e7b0d6ca407fc9eb9361f8d3d2780646b8a759430831763a044512321c34dfe

              SHA512

              52d2db534210327c9ba1041b9e2f0e3e7a023e0dc84c55887d904d90bfd013aa28473b01f8f99f991206cea14b860f7729437e929477c7ad8f3a2b1ffafcc53a

            • \Users\Admin\dyhost.exe

              Filesize

              48KB

              MD5

              d46eb4bf816ed9978636de7955245323

              SHA1

              c474df60a83302e0d010d11dcebd7cdb3cc22866

              SHA256

              2ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd

              SHA512

              e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef

            • \Users\Admin\dyhost.exe

              Filesize

              48KB

              MD5

              d46eb4bf816ed9978636de7955245323

              SHA1

              c474df60a83302e0d010d11dcebd7cdb3cc22866

              SHA256

              2ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd

              SHA512

              e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef

            • \Users\Admin\ekhost.exe

              Filesize

              24KB

              MD5

              9fe0e5252dc24fc1788b0d8b26026807

              SHA1

              21e3063a0fac1157b9707861048c5f7fbd070ceb

              SHA256

              9c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40

              SHA512

              613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c

            • \Users\Admin\ekhost.exe

              Filesize

              24KB

              MD5

              9fe0e5252dc24fc1788b0d8b26026807

              SHA1

              21e3063a0fac1157b9707861048c5f7fbd070ceb

              SHA256

              9c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40

              SHA512

              613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c

            • \Windows\System32\consrv.dll

              Filesize

              53KB

              MD5

              4d7cde615a0f534bd5e359951829554b

              SHA1

              c885d00d9000f2a5dbc78f6193a052b36f4fe968

              SHA256

              414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

              SHA512

              33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

            • \Windows\assembly\GAC_32\Desktop.ini

              Filesize

              4KB

              MD5

              878f9b6da85cb98fcbdf6abd1730a32f

              SHA1

              343007e658ea541f4680b4edf4513e69e1cc18a6

              SHA256

              75b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d

              SHA512

              5425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293

            • \Windows\assembly\GAC_64\Desktop.ini

              Filesize

              5KB

              MD5

              9d7ec1e355ac35cbe6991721ef5ae3b8

              SHA1

              c35a00bd35c6e4a7516b93947be08ead966347e8

              SHA256

              68a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98

              SHA512

              b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0

            • memory/332-141-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

              Filesize

              72KB

            • memory/432-151-0x0000000000000000-mapping.dmp

            • memory/680-150-0x0000000000000000-mapping.dmp

            • memory/864-166-0x0000000000880000-0x0000000000888000-memory.dmp

              Filesize

              32KB

            • memory/864-162-0x0000000000890000-0x000000000089B000-memory.dmp

              Filesize

              44KB

            • memory/864-158-0x0000000000890000-0x000000000089B000-memory.dmp

              Filesize

              44KB

            • memory/864-154-0x0000000000890000-0x000000000089B000-memory.dmp

              Filesize

              44KB

            • memory/864-164-0x0000000000880000-0x0000000000888000-memory.dmp

              Filesize

              32KB

            • memory/864-165-0x00000000008A0000-0x00000000008AB000-memory.dmp

              Filesize

              44KB

            • memory/864-167-0x00000000008A0000-0x00000000008AB000-memory.dmp

              Filesize

              44KB

            • memory/944-118-0x0000000000480000-0x00000000004C4000-memory.dmp

              Filesize

              272KB

            • memory/944-119-0x0000000000480000-0x00000000004C4000-memory.dmp

              Filesize

              272KB

            • memory/944-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

              Filesize

              8KB

            • memory/1092-77-0x0000000000000000-mapping.dmp

            • memory/1124-87-0x000000000040C520-mapping.dmp

            • memory/1124-85-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-83-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-82-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-92-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-86-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-90-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1124-91-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

            • memory/1176-59-0x0000000000000000-mapping.dmp

            • memory/1180-73-0x0000000000000000-mapping.dmp

            • memory/1284-117-0x00000000029B0000-0x00000000029B6000-memory.dmp

              Filesize

              24KB

            • memory/1284-109-0x00000000029B0000-0x00000000029B6000-memory.dmp

              Filesize

              24KB

            • memory/1284-113-0x00000000029B0000-0x00000000029B6000-memory.dmp

              Filesize

              24KB

            • memory/1508-129-0x0000000000000000-mapping.dmp

            • memory/1600-137-0x0000000000000000-mapping.dmp

            • memory/1744-153-0x0000000000000000-mapping.dmp

            • memory/1780-74-0x0000000000000000-mapping.dmp

            • memory/1984-108-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-120-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/1984-125-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/1984-126-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-106-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-121-0x0000000000280000-0x00000000002C4000-memory.dmp

              Filesize

              272KB

            • memory/1984-124-0x0000000002170000-0x00000000021AE000-memory.dmp

              Filesize

              248KB

            • memory/1984-122-0x000000000213C000-0x0000000002140000-memory.dmp

              Filesize

              16KB

            • memory/1984-107-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-138-0x0000000000400000-0x0000000000444000-memory.dmp

              Filesize

              272KB

            • memory/1984-140-0x0000000002170000-0x00000000021AE000-memory.dmp

              Filesize

              248KB

            • memory/1984-139-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-123-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-105-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-104-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-103-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-101-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-99-0x0000000002130000-0x000000000216E000-memory.dmp

              Filesize

              248KB

            • memory/1984-96-0x0000000000000000-mapping.dmp

            • memory/2016-67-0x0000000000000000-mapping.dmp

            • memory/2036-144-0x0000000000000000-mapping.dmp