Analysis

  • max time kernel
    165s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 06:49

General

  • Target

    11720d8fce40b7fdd68adbd307fbaa99.exe

  • Size

    264KB

  • MD5

    11720d8fce40b7fdd68adbd307fbaa99

  • SHA1

    2df4acf6a19734a1cdfc78d65f2f22305d45c83e

  • SHA256

    44a127ca39b9d0c4fa44434007423e1ca86c9c35c81cbc98773046538dd04944

  • SHA512

    fdd3bf1c1cad36b385ba610a1d7ee844ed3369042d6b3502ada9861629f46d73fa9a798a401fb909ab2a36e2b16b010866e6fb50d3fc5a6e86b3ea6500643aef

  • SSDEEP

    1536:2df1zwQVgNSMuVe6lhEMGIeqkSg+khEUpJYf1zwQVgvN76x+:2t1zwLNSMuVeHMGMkSgSUpJY1zwLvN

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11720d8fce40b7fdd68adbd307fbaa99.exe
    "C:\Users\Admin\AppData\Local\Temp\11720d8fce40b7fdd68adbd307fbaa99.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Windows\userinit.exe
      C:\Windows\userinit.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:180
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2592
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2520
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2804
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4444
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4164
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2920
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2160
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4868
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:864
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1696
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1240
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4960
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2868
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4708
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4536
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5068
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2296
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2836
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3344
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2620
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1520
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3628
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1148
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1592
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1832
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4040
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4492
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2344
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1972
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4164
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4976
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3624
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4228
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3632
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2156
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4284
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3888
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3468
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1656
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1380
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2080
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3932
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2000
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2668
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4560
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:904
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1760
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1832
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4040
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1868
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3660
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1360
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2464
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4328
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:404
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3492
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4792
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1032
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:5064
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4876
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3288
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4540
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
          PID:3924
        • C:\Windows\SysWOW64\system.exe
          C:\Windows\system32\system.exe
          3⤵
            PID:4168
          • C:\Windows\SysWOW64\system.exe
            C:\Windows\system32\system.exe
            3⤵
              PID:4828
            • C:\Windows\SysWOW64\system.exe
              C:\Windows\system32\system.exe
              3⤵
                PID:4720
              • C:\Windows\SysWOW64\system.exe
                C:\Windows\system32\system.exe
                3⤵
                  PID:5076
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                    PID:1688
                  • C:\Windows\SysWOW64\system.exe
                    C:\Windows\system32\system.exe
                    3⤵
                      PID:4256
                    • C:\Windows\SysWOW64\system.exe
                      C:\Windows\system32\system.exe
                      3⤵
                        PID:3452
                      • C:\Windows\SysWOW64\system.exe
                        C:\Windows\system32\system.exe
                        3⤵
                          PID:4224
                        • C:\Windows\SysWOW64\system.exe
                          C:\Windows\system32\system.exe
                          3⤵
                            PID:4928
                          • C:\Windows\SysWOW64\system.exe
                            C:\Windows\system32\system.exe
                            3⤵
                              PID:2668
                            • C:\Windows\SysWOW64\system.exe
                              C:\Windows\system32\system.exe
                              3⤵
                                PID:2800
                              • C:\Windows\SysWOW64\system.exe
                                C:\Windows\system32\system.exe
                                3⤵
                                  PID:2176
                                • C:\Windows\SysWOW64\system.exe
                                  C:\Windows\system32\system.exe
                                  3⤵
                                    PID:1972
                                  • C:\Windows\SysWOW64\system.exe
                                    C:\Windows\system32\system.exe
                                    3⤵
                                      PID:4228
                                    • C:\Windows\SysWOW64\system.exe
                                      C:\Windows\system32\system.exe
                                      3⤵
                                        PID:2596
                                      • C:\Windows\SysWOW64\system.exe
                                        C:\Windows\system32\system.exe
                                        3⤵
                                          PID:1032
                                        • C:\Windows\SysWOW64\system.exe
                                          C:\Windows\system32\system.exe
                                          3⤵
                                            PID:4396
                                          • C:\Windows\SysWOW64\system.exe
                                            C:\Windows\system32\system.exe
                                            3⤵
                                              PID:2424
                                            • C:\Windows\SysWOW64\system.exe
                                              C:\Windows\system32\system.exe
                                              3⤵
                                                PID:3424
                                              • C:\Windows\SysWOW64\system.exe
                                                C:\Windows\system32\system.exe
                                                3⤵
                                                  PID:228
                                                • C:\Windows\SysWOW64\system.exe
                                                  C:\Windows\system32\system.exe
                                                  3⤵
                                                    PID:1988
                                                  • C:\Windows\SysWOW64\system.exe
                                                    C:\Windows\system32\system.exe
                                                    3⤵
                                                      PID:4248
                                                    • C:\Windows\SysWOW64\system.exe
                                                      C:\Windows\system32\system.exe
                                                      3⤵
                                                        PID:4692
                                                      • C:\Windows\SysWOW64\system.exe
                                                        C:\Windows\system32\system.exe
                                                        3⤵
                                                          PID:4892

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Windows\userinit.exe

                                                      Filesize

                                                      264KB

                                                      MD5

                                                      11720d8fce40b7fdd68adbd307fbaa99

                                                      SHA1

                                                      2df4acf6a19734a1cdfc78d65f2f22305d45c83e

                                                      SHA256

                                                      44a127ca39b9d0c4fa44434007423e1ca86c9c35c81cbc98773046538dd04944

                                                      SHA512

                                                      fdd3bf1c1cad36b385ba610a1d7ee844ed3369042d6b3502ada9861629f46d73fa9a798a401fb909ab2a36e2b16b010866e6fb50d3fc5a6e86b3ea6500643aef

                                                    • memory/180-24-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/404-300-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/864-69-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/904-255-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1032-314-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1148-140-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1240-79-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1360-285-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1380-225-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1520-130-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1592-145-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1656-220-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1696-74-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1760-260-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1832-265-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1832-150-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1868-275-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/1972-170-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2000-240-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2080-230-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2156-200-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2160-59-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2284-0-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2284-14-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2296-110-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2344-165-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2464-290-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2520-34-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2592-29-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2620-125-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2668-245-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2804-39-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2836-115-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2868-90-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2868-86-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/2920-54-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3288-328-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3344-120-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3468-215-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3624-185-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3628-135-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3632-195-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3660-280-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3888-210-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/3932-235-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4040-155-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4040-270-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4164-175-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4164-49-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4228-190-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4284-205-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4328-295-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4444-44-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4492-160-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4536-100-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4560-250-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4708-95-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4792-309-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4868-64-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4876-324-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4960-84-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/4976-180-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/5064-319-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB

                                                    • memory/5068-105-0x0000000000400000-0x000000000043B000-memory.dmp

                                                      Filesize

                                                      236KB