Analysis

  • max time kernel
    152s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 17:55

General

  • Target

    8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a.exe

  • Size

    100KB

  • MD5

    40aeda25090fe30fecce295689bbe2d0

  • SHA1

    6b44c9a3637ea08b1f6c550940481be23d9598ae

  • SHA256

    8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

  • SHA512

    b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

  • SSDEEP

    768:N8t/grRTARvWagDWTrjMaoyFlAl5XVmdGTbjgoKkFYnv35BMCv:UgNATgDUrjYSALXVm6/FY5r

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 12 IoCs
  • Disables cmd.exe use via registry modification 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a.exe
    "C:\Users\Admin\AppData\Local\Temp\8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Modifies registry class
      PID:632
    • C:\Users\Admin\AppData\Local\smss.exe
      C:\Users\Admin\AppData\Local\smss.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Drops startup file
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Users\Admin\AppData\Local\winlogon.exe
        C:\Users\Admin\AppData\Local\winlogon.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:824
      • C:\Windows\SysWOW64\at.exe
        at /delete /y
        3⤵
          PID:2064
        • C:\Windows\SysWOW64\at.exe
          at 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\WowTumpeh.com"
          3⤵
            PID:944
          • C:\Users\Admin\AppData\Local\services.exe
            C:\Users\Admin\AppData\Local\services.exe
            3⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:3116
          • C:\Users\Admin\AppData\Local\lsass.exe
            C:\Users\Admin\AppData\Local\lsass.exe
            3⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:1848
          • C:\Users\Admin\AppData\Local\inetinfo.exe
            C:\Users\Admin\AppData\Local\inetinfo.exe
            3⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:3864

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\csrss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\csrss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\csrss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\csrss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\csrss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\inetinfo.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\inetinfo.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\inetinfo.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\inetinfo.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\inetinfo.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\lsass.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\lsass.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\lsass.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\lsass.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\services.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\services.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\services.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\smss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\smss.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\winlogon.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Users\Admin\AppData\Local\winlogon.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\ShellNew\bronstab.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\ShellNew\bronstab.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\ShellNew\bronstab.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\ShellNew\bronstab.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\ShellNew\bronstab.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\eksplorasi.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\eksplorasi.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\eksplorasi.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\eksplorasi.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • C:\Windows\eksplorasi.exe

        Filesize

        100KB

        MD5

        40aeda25090fe30fecce295689bbe2d0

        SHA1

        6b44c9a3637ea08b1f6c550940481be23d9598ae

        SHA256

        8928b5c31c747de0a33cf7696c63ffc1b9f50e6684d901a2c99c878f0e50777a

        SHA512

        b6591fb7fc8321c687e025c62a7e32aa555c6be277f4d1d6b1d481ac386073a3f22a139e102749b1d47df369b77b2108f572ff1bf44de145b87ee2cbab5b89ab

      • memory/824-163-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/824-161-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/1848-181-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/1848-196-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3116-166-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3116-171-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3748-148-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3748-195-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3864-191-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3864-197-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3912-132-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3912-135-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3912-167-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB