Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2023 23:20

General

  • Target

    tmp.exe

  • Size

    866KB

  • MD5

    7b1f03fb9936f72548c7d006eabfc310

  • SHA1

    66aef8129896c6e6dd36b2e3abadbbce7b4d51d6

  • SHA256

    e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b

  • SHA512

    f20b8348e0eb82f61fbaa98ce771f260bbbd22e1cf6018a49338d457b0ab5213a853e81cb4e4760c2c167a04279c6772a5076849dc89120fe31e05bb21f8c403

  • SSDEEP

    24576:b2c2oVEmdgUwB4qM742kyxzDL/KHYAmCS:ac2osByEby5DL/Dr

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c md C:\windowss64
      2⤵
        PID:1212
      • C:\windowss64\computer.exe
        "C:\windowss64\computer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe"
          3⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:940
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          3⤵
          • Executes dropped EXE
          PID:1600
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:552
    • C:\Program Files (x86)\Microsoft Qnrddd\Ygkqiuu.exe
      "C:\Program Files (x86)\Microsoft Qnrddd\Ygkqiuu.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c md C:\windowss64
        2⤵
          PID:1000
      • C:\Program Files (x86)\Imsossm.exe
        "C:\Program Files (x86)\Imsossm.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Program Files (x86)\Imsossm.exe
          "C:\Program Files (x86)\Imsossm.exe" Win7
          2⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:1536

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Discovery

      Query Registry

      3
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      4
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Imsossm.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • C:\Program Files (x86)\Imsossm.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • C:\Program Files (x86)\Imsossm.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • C:\Program Files (x86)\Microsoft Qnrddd\Ygkqiuu.exe
        Filesize

        866KB

        MD5

        7b1f03fb9936f72548c7d006eabfc310

        SHA1

        66aef8129896c6e6dd36b2e3abadbbce7b4d51d6

        SHA256

        e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b

        SHA512

        f20b8348e0eb82f61fbaa98ce771f260bbbd22e1cf6018a49338d457b0ab5213a853e81cb4e4760c2c167a04279c6772a5076849dc89120fe31e05bb21f8c403

      • C:\Program Files (x86)\Microsoft Qnrddd\Ygkqiuu.exe
        Filesize

        866KB

        MD5

        7b1f03fb9936f72548c7d006eabfc310

        SHA1

        66aef8129896c6e6dd36b2e3abadbbce7b4d51d6

        SHA256

        e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b

        SHA512

        f20b8348e0eb82f61fbaa98ce771f260bbbd22e1cf6018a49338d457b0ab5213a853e81cb4e4760c2c167a04279c6772a5076849dc89120fe31e05bb21f8c403

      • C:\ProgramData\Synaptics\Synaptics.exe
        Filesize

        754KB

        MD5

        310a7ff41f6633132e6c2bc25e51e567

        SHA1

        5f687df8cc3185ed68d77d0e05502c2eb308c5c8

        SHA256

        d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

        SHA512

        ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

      • C:\ProgramData\Synaptics\Synaptics.exe
        Filesize

        754KB

        MD5

        310a7ff41f6633132e6c2bc25e51e567

        SHA1

        5f687df8cc3185ed68d77d0e05502c2eb308c5c8

        SHA256

        d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

        SHA512

        ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

      • C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • C:\Users\Admin\AppData\Local\Temp\._cache_computer.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • C:\Users\Admin\AppData\Local\Temp\Tiy59i1j.xlsm
        Filesize

        17KB

        MD5

        e566fc53051035e1e6fd0ed1823de0f9

        SHA1

        00bc96c48b98676ecd67e81a6f1d7754e4156044

        SHA256

        8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

        SHA512

        a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

      • C:\windowss64\computer.exe
        Filesize

        1.1MB

        MD5

        be689578752179e22bf915dbcf4f7520

        SHA1

        e798e703bfb90707a2872b51da73f32af566aedb

        SHA256

        de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

        SHA512

        89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

      • C:\windowss64\computer.exe
        Filesize

        1.1MB

        MD5

        be689578752179e22bf915dbcf4f7520

        SHA1

        e798e703bfb90707a2872b51da73f32af566aedb

        SHA256

        de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

        SHA512

        89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

      • \ProgramData\Synaptics\Synaptics.exe
        Filesize

        754KB

        MD5

        310a7ff41f6633132e6c2bc25e51e567

        SHA1

        5f687df8cc3185ed68d77d0e05502c2eb308c5c8

        SHA256

        d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

        SHA512

        ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

      • \ProgramData\Synaptics\Synaptics.exe
        Filesize

        754KB

        MD5

        310a7ff41f6633132e6c2bc25e51e567

        SHA1

        5f687df8cc3185ed68d77d0e05502c2eb308c5c8

        SHA256

        d1425edf482717cb64db2a36357866045b0c6306d919296591ffc9bc45d680ab

        SHA512

        ee9b3114cb37e52793bccdf20a27158f5def67ed9c7d8eb772e1deaf5d5f9a0030e847dea40bb320637f29508f1be2a49c3095460a6fd3afbc3bca196f642980

      • \Users\Admin\AppData\Local\Temp\._cache_computer.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • \Users\Admin\AppData\Local\Temp\._cache_computer.exe
        Filesize

        400KB

        MD5

        20beeb0a82adcce3a58372804acc46be

        SHA1

        c579d9017d2c8298fe075ff5c05963901330e72a

        SHA256

        d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e

        SHA512

        7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd

      • \windowss64\computer.exe
        Filesize

        1.1MB

        MD5

        be689578752179e22bf915dbcf4f7520

        SHA1

        e798e703bfb90707a2872b51da73f32af566aedb

        SHA256

        de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

        SHA512

        89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

      • \windowss64\computer.exe
        Filesize

        1.1MB

        MD5

        be689578752179e22bf915dbcf4f7520

        SHA1

        e798e703bfb90707a2872b51da73f32af566aedb

        SHA256

        de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

        SHA512

        89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

      • \windowss64\computer.exe
        Filesize

        1.1MB

        MD5

        be689578752179e22bf915dbcf4f7520

        SHA1

        e798e703bfb90707a2872b51da73f32af566aedb

        SHA256

        de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e

        SHA512

        89c95b387e566dfaf3f6a4ab60ee6e24d2574dd3802458e4d8f15e4c44136ac54c5b3a53addc1d28748656320050ee735fa2e8e5c57cdfb53fbdddc6eb586da8

      • memory/552-4607-0x0000000072CFD000-0x0000000072D08000-memory.dmp
        Filesize

        44KB

      • memory/552-8083-0x0000000072CFD000-0x0000000072D08000-memory.dmp
        Filesize

        44KB

      • memory/880-487-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-523-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-483-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-485-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-486-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-54-0x0000000076871000-0x0000000076873000-memory.dmp
        Filesize

        8KB

      • memory/880-488-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-489-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-490-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-491-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-492-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-493-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-495-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-494-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-496-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-497-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-498-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-499-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-500-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-502-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-501-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-503-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-504-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-505-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-506-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-507-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-508-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-510-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-509-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-511-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-513-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-512-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-514-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-516-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-515-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-517-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-518-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-519-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-520-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-521-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-522-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-484-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-524-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-525-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-1344-0x0000000000260000-0x0000000000360000-memory.dmp
        Filesize

        1024KB

      • memory/880-1346-0x0000000001FA0000-0x0000000002121000-memory.dmp
        Filesize

        1.5MB

      • memory/880-9401-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/880-4575-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-4576-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/880-4577-0x0000000000260000-0x0000000000360000-memory.dmp
        Filesize

        1024KB

      • memory/880-482-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-56-0x0000000075D40000-0x0000000075D87000-memory.dmp
        Filesize

        284KB

      • memory/880-481-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-480-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-479-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-478-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-477-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-476-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-463-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-475-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-464-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-474-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-472-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-473-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-4601-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/880-471-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/880-470-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-469-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-468-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-465-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-466-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/880-467-0x0000000002130000-0x0000000002241000-memory.dmp
        Filesize

        1.1MB

      • memory/940-4587-0x0000000000000000-mapping.dmp
      • memory/1000-9386-0x0000000000000000-mapping.dmp
      • memory/1212-4574-0x0000000000000000-mapping.dmp
      • memory/1536-9395-0x0000000000000000-mapping.dmp
      • memory/1600-4591-0x0000000000000000-mapping.dmp
      • memory/1752-4580-0x0000000000000000-mapping.dmp
      • memory/1928-6064-0x00000000020A0000-0x0000000002221000-memory.dmp
        Filesize

        1.5MB

      • memory/1928-6063-0x0000000001E10000-0x0000000001F10000-memory.dmp
        Filesize

        1024KB

      • memory/1928-5006-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/1928-9385-0x0000000002230000-0x0000000002341000-memory.dmp
        Filesize

        1.1MB

      • memory/1928-9387-0x0000000000400000-0x0000000000525000-memory.dmp
        Filesize

        1.1MB

      • memory/1928-9388-0x0000000001E10000-0x0000000001F10000-memory.dmp
        Filesize

        1024KB