Analysis

  • max time kernel
    65s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 12:09

General

  • Target

    1d22cf354d01fb6e8e820e4ae126a179.exe

  • Size

    435KB

  • MD5

    1d22cf354d01fb6e8e820e4ae126a179

  • SHA1

    b9f9e70cdbbadacff82663824c4b5495b7ca0bce

  • SHA256

    b963d469e902918fdb3a1bd9ddf7043616d6e4829a8a1fba9f6d22fe42e96cd6

  • SHA512

    ccd27d09d6857e1b7f7885570bc84d2d03f7ca5bbd1bb45ce5c9d27bc7b34d48092e3c9fc7b240fe66b9cc3adfea282432e60f6857b7b1908f8d6fc61b6f30b0

  • SSDEEP

    12288:66rKCp7wMWa6950dH/SxzPoHLDeHbekM:d17wMWc1SxMrm1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Drops file in System32 directory 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe
    "C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe"
    1⤵
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\SysWOW64\autostart.exe
      C:\Windows\system32\autostart.exe 684 "C:\Users\Admin\AppData\Local\Temp\1d22cf354d01fb6e8e820e4ae126a179.exe"
      2⤵
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\SysWOW64\autostart.exe
        C:\Windows\system32\autostart.exe 688 "C:\Windows\SysWOW64\autostart.exe"
        3⤵
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Windows\SysWOW64\autostart.exe
          C:\Windows\system32\autostart.exe 692 "C:\Windows\SysWOW64\autostart.exe"
          4⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1532
          • C:\Windows\SysWOW64\autostart.exe
            C:\Windows\system32\autostart.exe 708 "C:\Windows\SysWOW64\autostart.exe"
            5⤵
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1200
            • C:\Windows\SysWOW64\autostart.exe
              C:\Windows\system32\autostart.exe 704 "C:\Windows\SysWOW64\autostart.exe"
              6⤵
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Drops file in System32 directory
              PID:1944
              • C:\Windows\SysWOW64\autostart.exe
                C:\Windows\system32\autostart.exe 700 "C:\Windows\SysWOW64\autostart.exe"
                7⤵
                  PID:2728
                  • C:\Windows\SysWOW64\autostart.exe
                    C:\Windows\system32\autostart.exe 716 "C:\Windows\SysWOW64\autostart.exe"
                    8⤵
                      PID:696
                      • C:\Windows\SysWOW64\autostart.exe
                        C:\Windows\system32\autostart.exe 712 "C:\Windows\SysWOW64\autostart.exe"
                        9⤵
                          PID:1680
                          • C:\Windows\SysWOW64\autostart.exe
                            C:\Windows\system32\autostart.exe 696 "C:\Windows\SysWOW64\autostart.exe"
                            10⤵
                              PID:1620
                              • C:\Windows\SysWOW64\autostart.exe
                                C:\Windows\system32\autostart.exe 720 "C:\Windows\SysWOW64\autostart.exe"
                                11⤵
                                  PID:1852

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              35KB

              MD5

              afb6ff03d850a7548f24ac96b09919c4

              SHA1

              67418c22ae4ed04fbf33aaf8a0e6af5dc05e1b4a

              SHA256

              18576f3fea0ebaed52f2bc7e14d4f938567dde6e6216b37232173cb0b34d7838

              SHA512

              a945b7de929e5127110b00a5a87b05f4161211e985bafbb0d473bf3463da2b7b1e985e12c4d4b3e9cff152f2059e1e5e6fe975f0306b6ee8b98bc2098794ad75

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              256KB

              MD5

              dd6d3712469542942294883211226fd2

              SHA1

              6d222e42e3b2e8e8fe1a8105fb95be1b2e9688f1

              SHA256

              2084e63379fc0221da9eb8455726e216215b58da839833d4bfc538ec4780d6a1

              SHA512

              a47cc0c0ffa5e497b3355e2d65f6a76479af474e76acf59e7f056191eec299858cb203fcab6baeebd2f16d838a9444de04fd6dcaa7c9418683753117d6ddba86

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              189KB

              MD5

              788d9fc00a4a917a235f049d5f26312d

              SHA1

              ad22c6d7e331d3b3761eae60002f3504a6865e19

              SHA256

              2ad46210b9886e085d56ca9fb7e6befc6bca72c1bc712884edfbbe8706b388d4

              SHA512

              34894cbc58f39be6cbfce366ca6c682189912efdf1789b51eb2de0c6af4b0379fcb6201f919a745d3fff5bf6cc304b3f495cd3357b2baee34358865f354c574a

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              33KB

              MD5

              b9407bcfcdc45721123a8a875b375fb0

              SHA1

              6b6b7c9fca0f1d41f59bd03095d491ca56feddea

              SHA256

              b23ea3cf8b87bf2cfb484483e90b92b92115f8ac62bd2e723ec3d206f6ba6a09

              SHA512

              d097905887792b8a82d20ad5c898f34460c7a352634689fbe17009a12ae43f9e234338c161e02b97e4feb9f3a1865f4e41918fc6583139f50573feb05ba9c532

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              82KB

              MD5

              b929044af97e55498e06c6c5b86f4783

              SHA1

              213a2cd046d6ac6b52f6ea1d74ecad5076adff45

              SHA256

              a182b6c4628fc1dc8ddf7db774fbc0671d96c28fd5fb6b0fb21239fcb6a7975f

              SHA512

              e23528a21324843f89c1d3e32842c64feac75829b8503ce22f87bcba7cd29ce3e2ef44b00a3abbb0a418779282bdee2b6d78f2515419cf8243c681f14b1cf890

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              100KB

              MD5

              fc718eae35a282812024d6e6aa437720

              SHA1

              5b7548cc19dedff99ede5ddbde470601ef2ae6f7

              SHA256

              9006049ae5cdd95e32ad7e4f1df1307a45282aefa5be1009ce0870f85d3a7af7

              SHA512

              8ad38e859a688bcdf4beeb20c351137ba4086d4bfaca2902076e4adf1674adb4a02f08083d91ad65d28fbab1e9da3433cadab34e304f595e959da7d3478ab1b8

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              130KB

              MD5

              cb1cee9be44ac9c018b1a300905bc068

              SHA1

              58ead99d03944141e9f95e31d68f9b06fc5d910b

              SHA256

              38cb8062c4a7fb89091304267f79f6616eb8a480692c8c83d743b27cc9de3134

              SHA512

              2c9f2a71be26054882d6f049ff9b95779ff07a9bfa69d25a76f7081b7bfba3bddfde7e67df84695a4390fd7e9e483b7ed35cc2be671c24c557e7b89bc35e11b5

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              165KB

              MD5

              b46f273318de9aa1eee9285b080fd698

              SHA1

              5d72cd83abe276bb76da046aa458194744e29401

              SHA256

              20b8aa67b6f793c09f6063fdcc2903c24afe5f2cfd8f13fd0b408e0450561dbd

              SHA512

              5bf509666a9d259998e0ba743cb4bdd415333c4c50b61dc91ea7a9197aec16ba43d8c8c6d9a3dc65922b2edb1669917525f528f261cdc417fad25b70b0bd757b

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              127KB

              MD5

              419954600fd348db1591d22fa30244af

              SHA1

              80567574517f549884bc8df09cf4b635c3a5f1ca

              SHA256

              1e16987aacf23afcfea1e00811988bf749007f9c4ccc6424f3800095a8246be2

              SHA512

              ec6ebe7bcff0ed919835f52a313429b67a006f59154bb23a72cec22796fe5315d2e04296fb8b5bdf48e5a13c2f7bdf8e2b2c9e51625bed621f86fe441f9e3956

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              44KB

              MD5

              3b63acc788a6731ecd78052c7beef291

              SHA1

              170c022b211baca92209e63b0a4058728d6e50e3

              SHA256

              8be7faf78e81c030a399f08dd3c1112602b4e61f7439cc0010a083cff9ad06b5

              SHA512

              6782d05efdcf6160a4e1a26e0c68657f55a3e3f80e41f2f2d018fc35cbce48002cd7dda1c87989e5f2767f5ac7515664f1ec801d1153627c0eb80fbb932d9479

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              49KB

              MD5

              bc90a427954af03ffc346d82446892b0

              SHA1

              05cd609f0237224517bc2ecfa1a1e79cd695fc39

              SHA256

              3c629975cd556068b4df1f096ca48cb6e89ef552067496e760171381f64c3d6c

              SHA512

              5954f759b7872e58f358506aad5ff3a17b91515abd55ab9c7539cbbe41900912050bb688541be3536b4e4f23c9cc314985040627cf11aa11b7ff1d4000c969a1

            • C:\Windows\SysWOW64\autostart.exe

              Filesize

              5KB

              MD5

              7722d5ad1e5e11844541b8b6e54af278

              SHA1

              2825ac53b8615da05a442501c2b318a74e42367d

              SHA256

              9a929bf0bad2ceb16c9f4b0095eff55427139d0b716c206813a0f7768936b2c4

              SHA512

              ac5dabfaaa9e085ae33125b9816c9cab2f99ed09d391b54ca219d175cfd8e9d1d0db8bcd07e77493746d2ea03d3213a5fd2d1bfc10e1bb64b2c523d338299712

            • \Windows\SysWOW64\autostart.exe

              Filesize

              22KB

              MD5

              43a523df443bbc6761b583f8435213bd

              SHA1

              0bfe1c7394e9e7ccb72beb60a15eef207172583e

              SHA256

              606fa9de2eedc70a5050342d8a20ae0ba584ec033d10e1a7ca9ce7cc832f1b4c

              SHA512

              734d23ba884103c44365bd021b55cf565a54a32fd784f26635b1e110ee568a0ae0d1ce46d113b9470d88a81cb1c14e062dc9adc3aad59c1c8356d3e92bbe5d59

            • \Windows\SysWOW64\autostart.exe

              Filesize

              1KB

              MD5

              74f2318ee90f8b6fec92f23a7bbda5b1

              SHA1

              c123dd22c29881c202e97cffc0b68aa09bc1db0f

              SHA256

              f34a461559ee3c38406a3db76b9d5f9496ba390495a2443e32b5e913a1e80204

              SHA512

              bedf14e98601d3aa42b89fd5d9ab869526e72b4495f50de07e39d2014f7037cc48976dd7a64dddaba63c8ce2f75a3ed210028f9ed1036206cde99e5596cfbdb5

            • \Windows\SysWOW64\autostart.exe

              Filesize

              206KB

              MD5

              14f74aee8063290b8bed903b33aca131

              SHA1

              e2abb8cc198514f3b65ad4848274ddf8614ab836

              SHA256

              b258b4b6b4afbcfdff10a41ec013edf03264bd564c95667160bb4a51d1742b11

              SHA512

              ea53ddeae64eae700fcab00f0e3a14069aac652197c1ca5ad732fceb7f3ee380a8282a39c97da9021351608d2e9c521ed0b0f402a0aded4d8e86a0f85ddeb860

            • \Windows\SysWOW64\autostart.exe

              Filesize

              245KB

              MD5

              bb500974aa0ae13bc51c8d92e5a1be39

              SHA1

              33f1afd8aa6053b49bf3d95ac95a94be8cd940bb

              SHA256

              d82ebcf1618ada2d47961ae1de882751342c72d11852d36384ed0dd12872e106

              SHA512

              15b5fa59c1f27854491615fc4db3ec68a3ed52b9d03b70463232e46b064489094e3b8f5351b11a47506d786672e4cdcaf0bed32e731e019b039ca17f153fb2c2

            • \Windows\SysWOW64\autostart.exe

              Filesize

              165KB

              MD5

              d28416a714f4984113c12f9b25a7d8b5

              SHA1

              a233e7b8e4ed97deb07a5a0a94889db7d87ce86f

              SHA256

              945a392cfd593ec6a2034b4dc3acff851b8a251713d4c81df7a4eee56ae4cf3b

              SHA512

              eacf016a194db68553b27cacd49b8b02513bfc84cb0119c22f2c67a6b5673a02c95a7ac7835b4a4fe32e3042264e6310b7c848176d54e1735ff38580439d3554

            • \Windows\SysWOW64\autostart.exe

              Filesize

              117KB

              MD5

              72d2849b1e23469eba52e68a50f1e866

              SHA1

              dc7f1e48699ef007b59f61ea1d9c2dc8ba276084

              SHA256

              874e0e049ee9103cbfe8903c668aefff0047c1837d295c1a54578838c77dd0f3

              SHA512

              5252b324567b3f4e9d01f16fe8ed4c52726fce6789aaf7fbc4fe53c61df4f636ce7e8f2ea5131cc3a62cd19bf4b342e5e97bb85ed09ab9a9688ff6b3e96aa59e

            • \Windows\SysWOW64\autostart.exe

              Filesize

              22KB

              MD5

              a6071ae8aa2b7a80138206ce8698d598

              SHA1

              0ca8e11bbd27bc71ecdb27e9546e16209c0f9e15

              SHA256

              ec79d3afcc92e323d4c42d2edd10871fbc0f8459c80583a73aa1acedecff26b1

              SHA512

              e62f4cfdff82f28736ab7f7946d79aa58b3ac32db72ac52553872ad8aa9b0eb60537262bb30b34a8e843bd7754d3e9c7638abbbdb21fbb90f67a4e39d2f2e8d6

            • \Windows\SysWOW64\autostart.exe

              Filesize

              74KB

              MD5

              c54fb10b74b47efede99ed3cb229dd6d

              SHA1

              8ad86ce639e63f019df4412bd9f08552860c3a2e

              SHA256

              8a42176e7211a3a2585762284abbc6ec2bd7e83c781ba212f39c7509341e0adf

              SHA512

              e0b920f7be6c8be5d8c65eff1d6bbce67bc630e3e6c974d4d39f45a9da003247a649d1422e11b341e384611b2e6d3c17894da60579db66bbcbfda14ecb2f332d

            • \Windows\SysWOW64\autostart.exe

              Filesize

              6KB

              MD5

              80cc899c6a0bfcd586719ad95660a2cf

              SHA1

              a99c966b00a837c57e6d16155289a0bb4d5cca2b

              SHA256

              8392892aa885a156737be17594f3a98795428a0eeedcf7af277cc8e7bf96cc73

              SHA512

              3e25072507c8ef849ea86ce1d004133cee4bd467834d4edbaf0ad014c25927de72fd4d6024369b8d99b16d02c5d95f8fb59befd7e14c994d26ae51c301e3a98c

            • \Windows\SysWOW64\autostart.exe

              Filesize

              67KB

              MD5

              baa26e127d390bad2ba3ab7bf593baa9

              SHA1

              3f22aa44e3a1f9bb6c9072acedb23daacfa9c0cb

              SHA256

              6c48fa2df57571133c7b4878c9678568cf0bca07570d925a88c9f2f30d853085

              SHA512

              c6a10a62fd3b6d1b818cdf33b3557b3b6bdde9c8f4c6d8baaea610f32ed4864aa4f580ce85982a6b7aa77f28076efcfd59967145cdac8bd5575013ca916fc4d5

            • \Windows\SysWOW64\autostart.exe

              Filesize

              84KB

              MD5

              d8bb877f992742d49b7c671c3d9ed232

              SHA1

              12bad97c03aeb25c0d9492b53990a47b8f6cee71

              SHA256

              29db8307093d934ffdd8d1fea3c4089c732b360ebd33c31622808136cb200bb7

              SHA512

              738186ffc63f696c2e024d6f32010e904c188ed4979529ec33334385db1a98396388c1481de98986c6a0b63be765168a1aae44f4c034f078dfd14923bdbacb34

            • \Windows\SysWOW64\autostart.exe

              Filesize

              136KB

              MD5

              ebd7b13901530119d6edf8d38e437e1f

              SHA1

              29f7c4edec10f4dc63892753a4908e9a17f52251

              SHA256

              a26aea08e26de967492e465c2710661819a30d64be34857455222d4c9e496a56

              SHA512

              54d513c8f71a267aaaa05a03da5d9d0d374c51a9576a195920ffdafb8f174a2c5d3b7e85796d639722b7e34d5ab19758e2f40d363d5105ab58c49c4d714075d1

            • \Windows\SysWOW64\autostart.exe

              Filesize

              99KB

              MD5

              cc26f1746cba6ea3bb91f9d9c7553ff0

              SHA1

              65edb479f1790abf82cd5b5664a1e53d26c27d3a

              SHA256

              83447018dd20bc592bb37551f1c17b87afb942e71baf56a7f2451ac06d35e5ac

              SHA512

              5c98294a21d5b6fd882a2a257fbe158b8c29d1e3f025e4333e23de3fe85e282ed18608f7f303896b326748d9a0e00e36d398bb10c68e197282a10e835ebe7883

            • \Windows\SysWOW64\autostart.exe

              Filesize

              41KB

              MD5

              80029f58526b0ff1abed82f9bcf9d7a2

              SHA1

              77a7275d1fd45add29da214386d3b5c1eefc7aff

              SHA256

              7414247b4d489f438019e9c2a77fbaaa2e4f12fe7d46a2e8f04c6da0ded5e14a

              SHA512

              983dcd17a6a99c47c05dd97749e54ee15af35271ca4382560bd8c2e4674f59758282b313f6301a7ce82d1a1ee3df0575eee4d87aa4315baa4de400828a441b9b

            • \Windows\SysWOW64\autostart.exe

              Filesize

              128KB

              MD5

              15812f7044d5adaae0b20eafdcba9948

              SHA1

              45ae211a531c79f32ccccfae65ee8dd6fee75d33

              SHA256

              4916335f64d7d37255004f1675a6e9cebf15d08a63cfb125027e1e4f35cb5c4c

              SHA512

              a8082c3f3df60e8ebaff60e54a464aec7829fc40960921586d82c864c141de45a97218e9ea6322d70e898f7a2ad628628dfbde2201c14ab8f7ff73b662b772ce

            • \Windows\SysWOW64\autostart.exe

              Filesize

              158KB

              MD5

              4944be974d27408e189e67ec4e1b2f58

              SHA1

              f79dc648e615d70ecfe662622442f5e2fd6ecf44

              SHA256

              feda96dd093b374061daffcb8a01adeaf7012dc0bda8cb6c36791ec05e127743

              SHA512

              7ee4d281363f781c8a445daec22ed3f0f58afb1433a192050cac83bed9a0ae9dd87d9d6d70b2b2e680e4e5f64703137093d45410d72afeade7914fe2a51b1bb3

            • \Windows\SysWOW64\autostart.exe

              Filesize

              63KB

              MD5

              4a7f8b1c33f0172741c7af893c00cbd7

              SHA1

              b669ab64cbc38586e985bdb2e840097445b3af75

              SHA256

              eff67f3f83cb5e9020144da088e7a1d18107e1cce55c9e03d79acc99492cf6a7

              SHA512

              d4fdf308ca3b48c8e06c14c8a53472d65e90b5c6164a40542dc4ec270798ffbb735b3cfbfcd2bfd91409f6da12c59a0d4ded822a8bc1786139a9e756f93c178b

            • \Windows\SysWOW64\autostart.exe

              Filesize

              42KB

              MD5

              acd5a9c3d531391892434224329b19a5

              SHA1

              34f7491ac2083df3596b9a1227ca5bb6ea387f47

              SHA256

              59414f3fb1de0c9cac4ce1dfb7e95bf72509dbf779062d65abd06a69217d0a60

              SHA512

              60d6fe3062c358d453a1a61a209606b04b9b0f5dfc827912d558de0e1e733c98eca23952597fe6f46ba5bef2a48d24f1004ffc99f4bb5c9f32f568920cf32177

            • \Windows\SysWOW64\autostart.exe

              Filesize

              120KB

              MD5

              77ff1b63b0ded265f1f34b9cd3b7d6b2

              SHA1

              0575aaf61aea85f80242923f30190d429a641525

              SHA256

              4e146d859c9907f002f02e24724b521217dbd8436794c422981fc6130ad35dd1

              SHA512

              14af83eeb49c835dbfa954fe55986313687db5361dbb3ef66c90c04457710a6a63d80525c726e4d541730289e78459a57bbd2c977457d7da74f388701d8debce

            • \Windows\SysWOW64\autostart.exe

              Filesize

              97KB

              MD5

              10abeb771ba45ec7adcdb48bbee4f5cc

              SHA1

              9a233adb009e2d14c13b8667cee856185142a813

              SHA256

              43cbf8cd73274e16bdfd99471001c5f887d470232248daf4c5d4a885f12704ee

              SHA512

              ac33e0879e5bd59555b6cb155f028da0d651c0b16af8a7793e0b4594ed7e7a3ec5717ebaf063e1dbf0334ced3636777fda6675798ac6351511002723d59683ec

            • memory/696-187-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1200-117-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1532-80-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

              Filesize

              4KB

            • memory/1532-83-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

              Filesize

              4KB

            • memory/1532-82-0x0000000003D00000-0x0000000003D01000-memory.dmp

              Filesize

              4KB

            • memory/1532-76-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1532-81-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

              Filesize

              4KB

            • memory/1532-79-0x0000000003C60000-0x0000000003C61000-memory.dmp

              Filesize

              4KB

            • memory/1532-77-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1532-94-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1532-84-0x0000000003C00000-0x0000000003C01000-memory.dmp

              Filesize

              4KB

            • memory/1532-78-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

              Filesize

              8KB

            • memory/1620-233-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1680-210-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/1944-142-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2164-19-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

              Filesize

              4KB

            • memory/2164-12-0x0000000003C50000-0x0000000003C51000-memory.dmp

              Filesize

              4KB

            • memory/2164-6-0x0000000003D50000-0x0000000003D51000-memory.dmp

              Filesize

              4KB

            • memory/2164-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

              Filesize

              4KB

            • memory/2164-4-0x0000000003D10000-0x0000000003D11000-memory.dmp

              Filesize

              4KB

            • memory/2164-3-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

              Filesize

              4KB

            • memory/2164-2-0x0000000003D20000-0x0000000003D22000-memory.dmp

              Filesize

              8KB

            • memory/2164-8-0x0000000002000000-0x0000000002001000-memory.dmp

              Filesize

              4KB

            • memory/2164-1-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2164-9-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

              Filesize

              4KB

            • memory/2164-10-0x0000000000660000-0x0000000000661000-memory.dmp

              Filesize

              4KB

            • memory/2164-45-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2164-21-0x00000000046B0000-0x00000000047FE000-memory.dmp

              Filesize

              1.3MB

            • memory/2164-18-0x0000000003C60000-0x0000000003C61000-memory.dmp

              Filesize

              4KB

            • memory/2164-0-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2164-11-0x0000000003C20000-0x0000000003C21000-memory.dmp

              Filesize

              4KB

            • memory/2164-5-0x0000000003D40000-0x0000000003D41000-memory.dmp

              Filesize

              4KB

            • memory/2164-17-0x0000000003D00000-0x0000000003D01000-memory.dmp

              Filesize

              4KB

            • memory/2164-13-0x0000000003C30000-0x0000000003C31000-memory.dmp

              Filesize

              4KB

            • memory/2164-28-0x00000000046B0000-0x00000000047FE000-memory.dmp

              Filesize

              1.3MB

            • memory/2728-184-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2728-165-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2848-43-0x0000000003D00000-0x0000000003D01000-memory.dmp

              Filesize

              4KB

            • memory/2848-38-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

              Filesize

              4KB

            • memory/2848-29-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2848-30-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2848-42-0x0000000003C30000-0x0000000003C31000-memory.dmp

              Filesize

              4KB

            • memory/2848-48-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

              Filesize

              4KB

            • memory/2848-47-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

              Filesize

              4KB

            • memory/2848-46-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

              Filesize

              4KB

            • memory/2848-41-0x0000000003D40000-0x0000000003D41000-memory.dmp

              Filesize

              4KB

            • memory/2848-40-0x0000000003C90000-0x0000000003C91000-memory.dmp

              Filesize

              4KB

            • memory/2848-39-0x0000000003C20000-0x0000000003C21000-memory.dmp

              Filesize

              4KB

            • memory/2848-37-0x0000000003C00000-0x0000000003C01000-memory.dmp

              Filesize

              4KB

            • memory/2848-36-0x0000000003C10000-0x0000000003C11000-memory.dmp

              Filesize

              4KB

            • memory/2848-35-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

              Filesize

              4KB

            • memory/2848-34-0x0000000003D50000-0x0000000003D51000-memory.dmp

              Filesize

              4KB

            • memory/2848-33-0x0000000003D10000-0x0000000003D11000-memory.dmp

              Filesize

              4KB

            • memory/2848-32-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

              Filesize

              4KB

            • memory/2848-31-0x0000000003D20000-0x0000000003D22000-memory.dmp

              Filesize

              8KB

            • memory/2848-49-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2848-53-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2964-54-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2964-55-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2964-70-0x0000000003C70000-0x0000000003C71000-memory.dmp

              Filesize

              4KB

            • memory/2964-68-0x0000000003CF0000-0x0000000003CF2000-memory.dmp

              Filesize

              8KB

            • memory/2964-67-0x0000000003C40000-0x0000000003C41000-memory.dmp

              Filesize

              4KB

            • memory/2964-66-0x0000000003D40000-0x0000000003D41000-memory.dmp

              Filesize

              4KB

            • memory/2964-65-0x0000000003C60000-0x0000000003C61000-memory.dmp

              Filesize

              4KB

            • memory/2964-64-0x0000000003C30000-0x0000000003C31000-memory.dmp

              Filesize

              4KB

            • memory/2964-75-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB

            • memory/2964-63-0x0000000001E90000-0x0000000001E91000-memory.dmp

              Filesize

              4KB

            • memory/2964-62-0x0000000003C10000-0x0000000003C11000-memory.dmp

              Filesize

              4KB

            • memory/2964-61-0x0000000003C20000-0x0000000003C21000-memory.dmp

              Filesize

              4KB

            • memory/2964-60-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

              Filesize

              4KB

            • memory/2964-59-0x0000000003D50000-0x0000000003D51000-memory.dmp

              Filesize

              4KB

            • memory/2964-58-0x0000000003D00000-0x0000000003D01000-memory.dmp

              Filesize

              4KB

            • memory/2964-57-0x0000000003C80000-0x0000000003C81000-memory.dmp

              Filesize

              4KB

            • memory/2964-56-0x0000000003D20000-0x0000000003D22000-memory.dmp

              Filesize

              8KB

            • memory/2964-71-0x0000000000400000-0x000000000054E000-memory.dmp

              Filesize

              1.3MB