Analysis

  • max time kernel
    147s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:21

General

  • Target

    744780692d69f16ef980235e53b061e932e22b83ff254a8bbcff75187f022e89.exe

  • Size

    6.0MB

  • MD5

    c9af383327ee15d8e349eb60a951d00b

  • SHA1

    f2e7426c88eeb89b21739971891164b6524a29f9

  • SHA256

    744780692d69f16ef980235e53b061e932e22b83ff254a8bbcff75187f022e89

  • SHA512

    bbd52871635bdb946aba4131c7420b6006863706527970fc5318f55cbd755e821965a6e5b42b5d589315d0319a9c28c4ec6bb9b6586a27de6f59b23494501a78

  • SSDEEP

    98304:c0G1E13HhStHxV8ItdWEZ3Xy3cB27OgUWZHwuS2JBAUZLC:nGxV8It/JiY2sWpJV+

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\744780692d69f16ef980235e53b061e932e22b83ff254a8bbcff75187f022e89.exe
    "C:\Users\Admin\AppData\Local\Temp\744780692d69f16ef980235e53b061e932e22b83ff254a8bbcff75187f022e89.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://changkongbao.lanzouq.com/ikW9T1cfeg5e
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce5046f8,0x7ffcce504708,0x7ffcce504718
        3⤵
          PID:4320
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
          3⤵
            PID:4600
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4036
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
            3⤵
              PID:3440
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
              3⤵
                PID:1132
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                3⤵
                  PID:4548
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
                  3⤵
                    PID:2444
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                    3⤵
                      PID:3920
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
                      3⤵
                        PID:3136
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                        3⤵
                          PID:3992
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                          3⤵
                            PID:4412
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                            3⤵
                              PID:4836
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4903281103203066139,10791625615678922520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                              3⤵
                                PID:2232
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2216
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3048

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      eaa3db555ab5bc0cb364826204aad3f0

                                      SHA1

                                      a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

                                      SHA256

                                      ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

                                      SHA512

                                      e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      4b4f91fa1b362ba5341ecb2836438dea

                                      SHA1

                                      9561f5aabed742404d455da735259a2c6781fa07

                                      SHA256

                                      d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

                                      SHA512

                                      fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      a981bd591af7a916ff2fb85c2130d189

                                      SHA1

                                      d8190934309ff9b3c9ac90a0155ebb8cec3750c6

                                      SHA256

                                      99e1ce58bae4a415b4ce51deceff1fa9b24eb4b83dfead502d6d17dd02618162

                                      SHA512

                                      50cc29c0f33c040bd06583e8693ef1e977b28090911f66330ca489af28139dc17752136ac4c23764e22e6d043fde25baae1774fd2610d0086f5eb88a4fc2d0d2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      de521e87717301e5f10902953afa5dbc

                                      SHA1

                                      a2ca3df2198ac2765b6859a9a2f821f5ddcec4cb

                                      SHA256

                                      2f80da8d5b2a43e5b5274bab3abe684726f3d7b52935eb50fd5646c990ab23d6

                                      SHA512

                                      181b7a869c5fd210039e4a14ad841b70c442e2eb29171736336947c207b154a1180ae3cf98927e96fda66b0529817af61765f23395bf0e9b5a127cff6a66b287

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      bbdb43b7e3e195ea3c507f9e777797c4

                                      SHA1

                                      422768a5f9045b8700c1ac7615c72cd42310e873

                                      SHA256

                                      296de556eb179e88eb922c70ff8c5df1543a25b759ea94735b9b3de12dba6ee0

                                      SHA512

                                      85dc3a176acb4d365dc95d523dfa8fab5896a8da9fe7938dbeb5681a1721c2593d0fbe06e3f7c44ca2aaa82bc5ebf0c67b44ed6e6c873ce2178f2d23a4a278fe

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      5b5b06bc0fd16d7c8af9846d63f45cca

                                      SHA1

                                      9a995f2c901f03dcfe6367ed8b2e5ef621242b9b

                                      SHA256

                                      2f5fb5aebf995c9398077c37063bea38ea349df08ab131ed5b5479456b8d8ce2

                                      SHA512

                                      dedb1e2e33a10b32655940fce29395aa05b20174502952cd0a03a435f3a4fe6be8f661c12e974d23d6486ec037f2b59ded6e66668cd774b7c7af951b442caf08

                                    • C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.lib

                                      Filesize

                                      1.5MB

                                      MD5

                                      ef48d7cc52338513cc0ce843c5e3916b

                                      SHA1

                                      20965d86b7b358edf8b5d819302fa7e0e6159c18

                                      SHA256

                                      835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8

                                      SHA512

                                      fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9

                                    • C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

                                      Filesize

                                      10KB

                                      MD5

                                      b6bffed88dc920f4daccf1a83dbf7f8b

                                      SHA1

                                      9d6e4a7b272cb725a143a588e1fe7b0ca6374b0b

                                      SHA256

                                      88e93194d4660d8c6f3f70591eef2e73ee460bbca08932cd7bec4393a6c7a36b

                                      SHA512

                                      d603a3aca6149b8dba1a1c3ca84d09d39459c21e10d4ef25ea88807cd0901f5a749dd7f97d4d49a9211f099e689156bc9724a73ad1e73aa580d8680d6cf25d3e

                                    • C:\Users\Admin\AppData\Local\Temp\·½°¸.ini

                                      Filesize

                                      8KB

                                      MD5

                                      1d67dafae0fcabbdc7ffaa3095ca3b61

                                      SHA1

                                      6ea71d27c8bf64ff601585c961a65c1adc9d7775

                                      SHA256

                                      51037184b477771ebe0558bed508315e05de95cb170a40a975d2326e97bfe88e

                                      SHA512

                                      b1ebb5d6d68fd2c5372114494dca30eff6107e263313b8889c4ef9b3f2311d3fc0b557bbcefa6911547727eac0b345df904993561c5a6feb87426158a4684d71

                                    • C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txt

                                      Filesize

                                      204B

                                      MD5

                                      1f176fd422d932b3f73c59cd0e8a4d0b

                                      SHA1

                                      e944c5a2805bb8809ddef9402304a12e6d3a3751

                                      SHA256

                                      f96f94e2c2d39b65dd9ca21a66abf75ed7b4c2d03bc703c5afc71fa1ea12669e

                                      SHA512

                                      7b0b29b2e9f0e6730541d206fde7cd2a5318a227f67b25c56b3005acd30201d11cbec7ddcdd9ad2149981ae681adffa2b161e2588375447b4add74eaea7db225

                                    • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                                      Filesize

                                      64B

                                      MD5

                                      49f36aa007f23eb6c74c4a2a1a3a33b1

                                      SHA1

                                      24bc012bf366135ed5b87fa1fae78d5a2995536f

                                      SHA256

                                      2454bb119c52184d858ad28c30a7178102ede54731a482b7168f1528516dd4cb

                                      SHA512

                                      6788124e3da25d19c0acc3f188d6e25c1eee4aaa3df0ba1aeac17a64eca3b487e6de745ad38d47aa9fa03ce1d55c7172cfd872831034da3d7aea86e88a449474

                                    • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                                      Filesize

                                      211B

                                      MD5

                                      be1ed890b76305de558c92cdec4ac2bb

                                      SHA1

                                      f9886e1bcb55dcfcb06294141496d8ac9eb7e014

                                      SHA256

                                      bad4ee5b9b63fd12da271a13eb1a7120a58ee3c5a4f95daef51fab68b87ba6cb

                                      SHA512

                                      0060156b4a7fb18c5a1fd2018fe69d3a533e5c3b8d1f14920bfd6ab88ffedb799901a635a186e35f2aa605d3bcc502142363b63aad202b3928e77180e6d56dec

                                    • C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.ini

                                      Filesize

                                      225B

                                      MD5

                                      0e66900340fc19323c256461904893d9

                                      SHA1

                                      daf382f14a93f5cc7a839f0d2914a7fe699cbbee

                                      SHA256

                                      3c0466e79066d63e524f4b8f5423409a9fcfa769334cde7b1628d5f86265be10

                                      SHA512

                                      2c446d717530e6e73c59f965b034ca9cd92409d5eeb2f60c9d001ef0f905e09864ab0448b929deea46a25bdab707ae61d45ab78c23cb37a6dc6c0eb85300b2b8

                                    • memory/1476-38-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-32-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-28-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-24-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-22-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-20-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-18-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-16-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-14-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-12-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-10-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-8-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-6-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-5-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-52-0x0000000001180000-0x0000000001181000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-55-0x0000000001190000-0x0000000001191000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-54-0x00000000029F0000-0x00000000029F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-30-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-103-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-102-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-34-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-36-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-0-0x0000000000400000-0x0000000000A5D000-memory.dmp

                                      Filesize

                                      6.4MB

                                    • memory/1476-40-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-42-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-49-0x0000000001170000-0x0000000001171000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/1476-48-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-47-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-44-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-26-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-4-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-3-0x0000000010000000-0x000000001003E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/1476-2-0x0000000001150000-0x000000000115B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1476-1-0x0000000001150000-0x000000000115B000-memory.dmp

                                      Filesize

                                      44KB