c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394

Analysis

max time kernel
151s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Size

2.7MB
MD5

146f01cf45bb55604675d90e4d0343f0
SHA1

b795751b3db481886e56a517b3cef465f8056074
SHA256

c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394
SHA512

16ad090cf62a235ef7b5a796f3b402e726003be13481a654ba0b844bfe24cf736d524654ef93d15b7c333030f8e752c296ef03a6e71eb3ccb1901ab82af934f0
SSDEEP

49152:WjS1c85QZuTtS0rQMYOQ+q8CE1jSn6ri+jStG9KFeMS:97WsM0r1QnAOdG0Fen

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\44ZiIT.sys	DWWIN.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	DWWIN.EXE

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2064-0-0x00000000009B0000-0x0000000000A1E000-memory.dmp	upx
behavioral2/memory/2064-10-0x00000000009B0000-0x0000000000A1E000-memory.dmp	upx
behavioral2/memory/2064-25-0x00000000009B0000-0x0000000000A1E000-memory.dmp	upx
behavioral2/memory/2064-44-0x00000000009B0000-0x0000000000A1E000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\ \Windows\System32\SNichoEKe.sys	DWWIN.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\DWWIN.EXE	Explorer.EXE
File opened for modification	C:\Windows\Fonts\DWWIN.EXE	Explorer.EXE
File created	C:\Windows\zbOzo2.sys	DWWIN.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DWWIN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DWWIN.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	DWWIN.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1660	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Software\Microsoft\Internet Explorer\New Windows\Allow	DWWIN.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.hao774.com	DWWIN.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
3140	Explorer.EXE
3140	Explorer.EXE
3140	Explorer.EXE
3140	Explorer.EXE
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	Explorer.EXE

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Token: SeTcbPrivilege	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Token: SeDebugPrivilege	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Token: SeDebugPrivilege	3140	Explorer.EXE
Token: SeDebugPrivilege	3140	Explorer.EXE
Token: SeDebugPrivilege	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Token: SeDebugPrivilege	1220	DWWIN.EXE
Token: SeDebugPrivilege	1220	DWWIN.EXE
Token: SeDebugPrivilege	1220	DWWIN.EXE
Token: SeIncBasePriorityPrivilege	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
Token: SeShutdownPrivilege	3140	Explorer.EXE
Token: SeCreatePagefilePrivilege	3140	Explorer.EXE
Token: SeDebugPrivilege	1220	DWWIN.EXE
Token: SeShutdownPrivilege	3140	Explorer.EXE
Token: SeCreatePagefilePrivilege	3140	Explorer.EXE
Token: SeShutdownPrivilege	3140	Explorer.EXE
Token: SeCreatePagefilePrivilege	3140	Explorer.EXE
Token: SeShutdownPrivilege	3140	Explorer.EXE
Token: SeCreatePagefilePrivilege	3140	Explorer.EXE
Token: SeShutdownPrivilege	3140	Explorer.EXE
Token: SeCreatePagefilePrivilege	3140	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
3140	Explorer.EXE
3140	Explorer.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE
1220	DWWIN.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	DWWIN.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3140	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	38
PID 2064 wrote to memory of 3140	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	38
PID 2064 wrote to memory of 3140	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	38
PID 2064 wrote to memory of 3140	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	38
PID 2064 wrote to memory of 3140	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	38
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 3140 wrote to memory of 1220	3140	Explorer.EXE	89
PID 2064 wrote to memory of 624	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	3
PID 2064 wrote to memory of 624	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	3
PID 2064 wrote to memory of 624	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	3
PID 2064 wrote to memory of 624	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	3
PID 2064 wrote to memory of 624	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	3
PID 2064 wrote to memory of 1164	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	94
PID 2064 wrote to memory of 1164	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	94
PID 2064 wrote to memory of 1164	2064	c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe	94
PID 1164 wrote to memory of 1660	1164	cmd.exe	96
PID 1164 wrote to memory of 1660	1164	cmd.exe	96
PID 1164 wrote to memory of 1660	1164	cmd.exe	96
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38
PID 1220 wrote to memory of 3140	1220	DWWIN.EXE	38

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe
  "C:\Users\Admin\AppData\Local\Temp\c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\c6610e62bf945df372ca7939370140e967a9b40142e287a3581fca6bdc08d394.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1660
- C:\Windows\Fonts\DWWIN.EXE
  "C:\Windows\Fonts\DWWIN.EXE"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\DWWIN.EXE

Filesize
229KB

MD5
444cc4d3422a0fdd45c1b78070026c60

SHA1
97162ff341fff1ec54b827ec02f8b86fd2d41a97

SHA256
4b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0

SHA512
21742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553

Download Submit
memory/624-58-0x00000174417E0000-0x00000174417E1000-memory.dmp

Filesize
4KB

Download
memory/624-20-0x00000174417B0000-0x00000174417D8000-memory.dmp

Filesize
160KB

Download
memory/624-19-0x00000174417E0000-0x00000174417E1000-memory.dmp

Filesize
4KB

Download
memory/624-17-0x00000174413F0000-0x00000174413F3000-memory.dmp

Filesize
12KB

Download
memory/1220-60-0x0000016B840C0000-0x0000016B840C1000-memory.dmp

Filesize
4KB

Download
memory/1220-75-0x0000016B840B0000-0x0000016B840B2000-memory.dmp

Filesize
8KB

Download
memory/1220-86-0x0000016B83E90000-0x0000016B83E91000-memory.dmp

Filesize
4KB

Download
memory/1220-12-0x0000016B83730000-0x0000016B837FB000-memory.dmp

Filesize
812KB

Download
memory/1220-14-0x0000016B83730000-0x0000016B837FB000-memory.dmp

Filesize
812KB

Download
memory/1220-15-0x00007FF8282B0000-0x00007FF8282C0000-memory.dmp

Filesize
64KB

Download
memory/1220-13-0x0000016B81E20000-0x0000016B81E21000-memory.dmp

Filesize
4KB

Download
memory/1220-85-0x0000016B83E90000-0x0000016B83E91000-memory.dmp

Filesize
4KB

Download
memory/1220-84-0x0000016B83E90000-0x0000016B83E91000-memory.dmp

Filesize
4KB

Download
memory/1220-83-0x0000016B83E90000-0x0000016B83E91000-memory.dmp

Filesize
4KB

Download
memory/1220-82-0x0000016B83E90000-0x0000016B83E91000-memory.dmp

Filesize
4KB

Download
memory/1220-81-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-80-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-65-0x0000016B840B0000-0x0000016B840B1000-memory.dmp

Filesize
4KB

Download
memory/1220-55-0x0000016B81E20000-0x0000016B81E21000-memory.dmp

Filesize
4KB

Download
memory/1220-64-0x0000016B84110000-0x0000016B841B0000-memory.dmp

Filesize
640KB

Download
memory/1220-57-0x0000016B83730000-0x0000016B837FB000-memory.dmp

Filesize
812KB

Download
memory/1220-78-0x0000016B84270000-0x0000016B8427D000-memory.dmp

Filesize
52KB

Download
memory/1220-59-0x0000016B840B0000-0x0000016B840B1000-memory.dmp

Filesize
4KB

Download
memory/1220-77-0x0000016B84280000-0x0000016B84281000-memory.dmp

Filesize
4KB

Download
memory/1220-61-0x0000016B83EA0000-0x0000016B83EA1000-memory.dmp

Filesize
4KB

Download
memory/1220-62-0x0000016B840C0000-0x0000016B840CF000-memory.dmp

Filesize
60KB

Download
memory/1220-76-0x0000016B841B0000-0x0000016B841B1000-memory.dmp

Filesize
4KB

Download
memory/1220-56-0x00007FF8282B0000-0x00007FF8282C0000-memory.dmp

Filesize
64KB

Download
memory/1220-79-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-66-0x0000016B840B0000-0x0000016B840B2000-memory.dmp

Filesize
8KB

Download
memory/1220-67-0x0000016B840B0000-0x0000016B840B1000-memory.dmp

Filesize
4KB

Download
memory/1220-68-0x0000016B840B0000-0x0000016B840B1000-memory.dmp

Filesize
4KB

Download
memory/1220-69-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-70-0x0000016B840B0000-0x0000016B840B1000-memory.dmp

Filesize
4KB

Download
memory/1220-71-0x0000016B84270000-0x0000016B8427D000-memory.dmp

Filesize
52KB

Download
memory/1220-72-0x0000016B84110000-0x0000016B841B0000-memory.dmp

Filesize
640KB

Download
memory/1220-74-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-73-0x0000016B84270000-0x0000016B84271000-memory.dmp

Filesize
4KB

Download
memory/1220-63-0x0000016B840C0000-0x0000016B840C1000-memory.dmp

Filesize
4KB

Download
memory/2064-0-0x00000000009B0000-0x0000000000A1E000-memory.dmp

Filesize
440KB

Download
memory/2064-44-0x00000000009B0000-0x0000000000A1E000-memory.dmp

Filesize
440KB

Download
memory/2064-25-0x00000000009B0000-0x0000000000A1E000-memory.dmp

Filesize
440KB

Download
memory/2064-10-0x00000000009B0000-0x0000000000A1E000-memory.dmp

Filesize
440KB

Download
memory/3140-6-0x0000000008020000-0x0000000008117000-memory.dmp

Filesize
988KB

Download
memory/3140-1-0x0000000000AB0000-0x0000000000AB3000-memory.dmp

Filesize
12KB

Download
memory/3140-45-0x0000000008020000-0x0000000008117000-memory.dmp

Filesize
988KB

Download
memory/3140-43-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3140-2-0x0000000000AB0000-0x0000000000AB3000-memory.dmp

Filesize
12KB

Download
memory/3140-3-0x0000000000AB0000-0x0000000000AB3000-memory.dmp

Filesize
12KB

Download
memory/3140-5-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download