Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 21:05

General

  • Target

    f609255239103210afd42d9f3bc3f530N.exe

  • Size

    2.0MB

  • MD5

    f609255239103210afd42d9f3bc3f530

  • SHA1

    57f8c0d4beecbc157a274a8fbfba3c59e326bcc5

  • SHA256

    132c73cbf38ad49574d97500cdd3342721e4bbbe41d9a6b152c8619b95e145ac

  • SHA512

    e766814191285485b3c6ba71a1b378e8963ab07914bee6ce4519a13eabd04614c0b53709078fcbae4af66c43b6e497925047a58982335956c55d0e10be521c13

  • SSDEEP

    49152:MS0z9Z3sd42vq2gcDsUHKyeTGSOmDLT1aw55zGbBieER4s6CCNfes:/0z3w42C5OscTBtuLRaKJ2AB4s3CNfes

Malware Config

Signatures

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f609255239103210afd42d9f3bc3f530N.exe
    "C:\Users\Admin\AppData\Local\Temp\f609255239103210afd42d9f3bc3f530N.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\f609255239103210afd42d9f3bc3f530N.exe
      "C:\Users\Admin\AppData\Local\Temp\f609255239103210afd42d9f3bc3f530N.exe" -sfxwaitall:0 "EasyBCD.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EasyBCD.exe
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EasyBCD.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bootgrabber.exe
          "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bootgrabber.exe" /tlist
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3564
        • C:\Windows\System32\msfeedssync.exe
          "C:\Windows\System32\msfeedssync.exe" forcesync
          4⤵
          • Modifies Internet Explorer settings
          PID:2832
        • C:\Windows\system32\msfeedssync.exe
          msfeedssync.exe sync
          4⤵
          • Modifies Internet Explorer settings
          PID:796
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\UtfRedirect.exe
          "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\UtfRedirect.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bcdedit.exe
            "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bcdedit.exe" /enum all
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1884
        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\UtfRedirect.exe
          "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\UtfRedirect.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bcdedit.exe
            "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bcdedit.exe" /export "C:\Users\Admin\Documents\EasyBCD 백업 (2024-08-15).bcd"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\symsrv.dll

    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

  • C:\Program Files\Common Files\System\symsrv.dll.000

    Filesize

    175B

    MD5

    1130c911bf5db4b8f7cf9b6f4b457623

    SHA1

    48e734c4bc1a8b5399bff4954e54b268bde9d54c

    SHA256

    eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

    SHA512

    94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

    Filesize

    4KB

    MD5

    0ed2c3c11fce80392dc4512ca32c231e

    SHA1

    c3d5bd09d1d91d5138583067fdb38588227706ee

    SHA256

    228def8d2cec66202626d3b1d84b3987946c8e84ebc2672a9bb235be9d1727a5

    SHA512

    ed6e40546388c899a29cd690a4db338958f2961617d208cd57f27d11af802fa141c63aefde2b6ba3f6eecd57008e418ca21aff3094affbcd47698c824e55040d

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

    Filesize

    5KB

    MD5

    0d1e37696eb05598cda87b11ea1cefd1

    SHA1

    cd4e34b129f3c42c5de29511e0dbd13da5889d7d

    SHA256

    6fcb4a04d079fe33dfbbcc3bbbe2a72bc5e714944cb1a7545eaa15f37688e7d6

    SHA512

    e23773d059bec157c22edc9e571e4ba828ef047463324c2b8e2855c76c78533b95c1bb5b54379de93641a7d234eba7504bef2c206af0f60105e154abd3689dfc

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\The NeoSmart Files~.feed-ms

    Filesize

    32KB

    MD5

    5994bbf9ebd5de5752ada025fea2da5b

    SHA1

    ec214ca41de4ca85cb9b491dc3ae89a3d1204f3b

    SHA256

    c31a90b6760ae602b58cf7dd666643e0b2ebced6585dbd9a11f7535a11e4cfb9

    SHA512

    29e485e9c3be955f2929840c4d845f2fa1fca2a84f1e342cd3c9d2a8d831ccf183ca6c9949207db4cd037c1860f5f3c72b83bf773af499f999b35b1c39864b73

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\The NeoSmart Files~.feed-ms

    Filesize

    368KB

    MD5

    de714e975c77ac283dabbffd1cad2ede

    SHA1

    8208101d4980a4e5bf0b53ad53379b214a87e0dd

    SHA256

    19a9fcdb9bd3ef139efa2eaaa76996234ce5248386faec5e0592beb42dc5074a

    SHA512

    dfb8277dac184e502daf0b494f0275b8e8b44794ab61ddeb218b9b93037f3bcc4e86b253648dc66db8c67cd6783e5da5d311bd6d840c02e4a2cef9d6c7e8a4cc

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\The NeoSmart Files~.feed-ms

    Filesize

    368KB

    MD5

    9ee93f369f840b313e656aff58fe43b2

    SHA1

    cd698187748821f98538f36c49e55acb2f5e602e

    SHA256

    17b099098f436417629f0cebeb445f0fdcea82bc570d3e5ba8c0829189a7e9cd

    SHA512

    439bd46c50800ae4740779c147817fef2c1bb42e7d1bd5587083a0c042e771e7d833cc489289cf24cab0c56be85e98f8b9271db4b2bcde9cfcb2d29d546aaadc

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EasyBCD.exe

    Filesize

    965KB

    MD5

    e478c92160a3c73c77cdc9f515dfd8b0

    SHA1

    f0fa230f8c26bcbddc3b68f38ce0793d46c0ca2b

    SHA256

    6a6e16c176004128b918ef3f9ecf1d51d828e6099fba6542b5ac6abdb67c1030

    SHA512

    3682b4f5bc31cd056c3f552da657309093e35b4757c073a223385c04765f622ce9ee000fb5dbc950c68ad7913ffdcc831ef65bd5ed7241f6179ea375b17be822

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EasyBCD.exe.config

    Filesize

    330B

    MD5

    3379ac7243adcfa51a02295dbedc956a

    SHA1

    469bbae4b1844832809196c89f198029beef4af8

    SHA256

    7ec2512b59e62a3aeb0a1025bf152a31291e17e7e469ce18efae153064665b03

    SHA512

    08d7101b21b87e11aff79cd8b47ec3ba2878cf72406e4d59771531ce6098609f8340607cd8b9ae0721c56f8fba5927c93f0412f0042879f04f2cd223d82430a4

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NeoSmart.Localization.dll

    Filesize

    25KB

    MD5

    ad0a59ae87d4ba106e965c62f0bc3d88

    SHA1

    5b39b6fd95b5bee72a17d79a1f4958256a5c4149

    SHA256

    3a56005b2efb34620019ef432fe90eeb63726fc78b37be841f25c2aed82eb1db

    SHA512

    562b2cbd3fdbbb71dee9fdb68bd24b9bbf27beab93de338a616baec837910f31ad3b13d75564d45a1cca26e1150517b47d0b3984bae7d08675593bde22bbea98

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Newtonsoft.Json.dll

    Filesize

    472KB

    MD5

    0953851089821550ef013b487da3915a

    SHA1

    7b4dfb7d547404fb6f3cc561d9475209aa2c6172

    SHA256

    4a56ef352f84ad19c1b4486c7c9e64fef9a67c464c62e51bababa79cd2d89551

    SHA512

    4a41a97527604042e1d28e2869aac1dea79da372ffc7e211415e45e4212a853971731cf4fc9595d81c4f4b824f8e7441c2ad6f2641d053cd783b264c83c29e86

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\BootGrabber.exe

    Filesize

    183KB

    MD5

    2e12b37d32c8bcf8920f5ebb6d24a6b9

    SHA1

    7fcd9e4ebfa2c400d6340133440c087e56a3c9e6

    SHA256

    f9842333f0b562b4ab5349a09fc173b0b2971c1f600502c4284781c78a735d7e

    SHA512

    aa82f1ed984174a1b5a610eb28a422da6172dd027678d9d4b7a9714e85e050616403ad294a005ad1ab39032758a4d2fd8d498b1241dedda8c91698ffc7d3c527

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\UtfRedirect.exe

    Filesize

    189KB

    MD5

    5b40791899fa37507e7c08bc3d9f5294

    SHA1

    cb98852ec22251b5124507427d05b3dfe7ec53a7

    SHA256

    5a87d9485f6e13ee2c3ba4ac289a3e237d17a43ed428b8a5bd5f00fc4800d1ac

    SHA512

    d2c0de00943d7e9961571a8e798688e46a8e7267086e15abaae8abca0fa7aedd02d5df3c5eb3dc6cfab0c5982694129bf5b9c0cb5d8e978fec0d76d54e441390

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bcdedit.exe

    Filesize

    317KB

    MD5

    a60cbaea0f8ac802d21c0cc7bc2589be

    SHA1

    f4c1f4b7f340968ba9c360f3fc1ef783a8bc7b2a

    SHA256

    8bf1b71182fed18d6b4112bdc4d496800b5bf6681de4c4f6536ba67378f38a12

    SHA512

    24ab704e214758b9318a333bb3a466a05e4218fbef70752b266d782e5fe89de19db8e5d5a584245fcc6aaf32ea99a0764583b3cc56299e99a2b7cf6ec42c2ccb

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\AboutBox.xml

    Filesize

    1KB

    MD5

    883eb174fb50732863fcb223bb689630

    SHA1

    85421afa904951f836275f6d9434970d099b419b

    SHA256

    c837c908319881a9781e454d6a8e6e91606fede069b5c9296ba121dafecf7a79

    SHA512

    10db1a874ff6fb34ec95f3f85c7390905fd1810fecad918f791a3a6b8dde4699c436dc3a3fa07069008d521dad214b44693b5607b13626f85cd16c62d0c1c495

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\BcdLibrary.xml

    Filesize

    3KB

    MD5

    219c12bbd4390df75ac7f6adcb5aff3d

    SHA1

    ca05e39b1b60fe53f5a4e2082197df4292618e39

    SHA256

    534a14891db815a7728a8bfd7d683584b39d118a7bca2e5323a3ae5e5e2479f2

    SHA512

    e7b0cc131641ecac16fca753309aa3c7db160baa4fa96f05d1f5f791d9e0050546e9cdf89a1c35ece021b9adfcc88b8b59e83b47c5536c0de838a4655f6cfc25

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\DefragDialog.xml

    Filesize

    329B

    MD5

    8500ee43f1b0ea2a47a9637377902a7e

    SHA1

    69399c69041561fd018e4c0dd6c50b00a14ca242

    SHA256

    7084593701e3d7f0aceffb6b5d63bec611d103e41850d26ec90b2fd4a7944d98

    SHA512

    966d96e82aed98c90c702f6233e1372c4bc48fcfe8ae6e22324960476607e952b556894e6daba9527cb05244fa3cab1d486eed9c8a5e21dd69b25230b6e48c6a

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\DonationDialog.xml

    Filesize

    1KB

    MD5

    1f6859a48903f308639e03ba3284e7f5

    SHA1

    be6cc001a5a4dcd8e04aefcb124889fb51a58a5d

    SHA256

    318667ac37efbc88e9ef7e984e2caec11cc8b16b454c07adcd133784ac123f2e

    SHA512

    41eb5afd8d7aa78298825b25b669016f2695e478f5e57748f0c8d2e0dc4d4de105e74f62b3ff69c4554d16f944e625cd81c43d812c0f86f0b99d5f1a5b74d5c2

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\DriveSelect.xml

    Filesize

    1KB

    MD5

    dd35c3a5a530e2eec685855d2d3a37bb

    SHA1

    5fc3a189aaca5df055bb230744e5fbe91ebf8f74

    SHA256

    9be6ef8e6644e87c68718df8f3f3dacfd760d6d8b6d51a4ea84dbdaa6ab68db4

    SHA512

    8b8dc2ce8112439461e0f3c99e6bccc98088bdbcba452152b2356b34e6660709f462238ed0a90e55e58211f9705235c24f820521ee6882fcc8e4a3923d53d190

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\EasyBCD.xml

    Filesize

    21KB

    MD5

    b1c31e3485b654f3687043e4fcc0b53f

    SHA1

    eae95c89e1f0a9485511e5a415fea3757411b193

    SHA256

    a3a4eab70f088585ea57c4f278a848d22757c2b2cfb6d1c53c881b332c02379e

    SHA512

    531146d2681967f884b68ff5167ef6c06b311c6c6ba9649cdb3059794cd082e80d1f414f7de040711179608fb28f3d12fc8c00bbace9fdc38f7b1190a1d676e0

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\EasyRE.xml

    Filesize

    1KB

    MD5

    ae8bb0e9b6e218a10be54da5899ae3e9

    SHA1

    665b44075d862e91da038501a43c64c3e5fa5f56

    SHA256

    a10925561a251b5e3462f979478147b7e8d4e739d7f38038ff1ca0d516204ec3

    SHA512

    7dd872b115e0122dc837eb21a095597a12366151f9ee7bfc82efc4b4fdd83f5fd8b0ed1f2a4d529c0880f009f52e0012001bfccef66567b5bd25d352ff0cb2e4

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\LanguageDialog.xml

    Filesize

    381B

    MD5

    dfc7dd6dd71c4ef40c9beec4b62a8ef4

    SHA1

    a1b4a01a4757ce8a5d8c87444b3b8f71a6634ede

    SHA256

    e5c2e1197b9179f3960b347ccb1b1837148b540f35ba8c2a6550631061a886f6

    SHA512

    a40bf12014d1a251fa55115f81baf6622a3c34b2ffdc1205f1526e5590782af44bd5b601e8e472c0e611a7a2c34b1cfb4db01fc4882d78baa690cc08ae81983e

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\LicenseDialog.xml

    Filesize

    1KB

    MD5

    8acbb0cb7057a9dce9f9c7505e9797b4

    SHA1

    07dcab47155264545641f2e60213775ad2b3a295

    SHA256

    f6851389f78a8b845b903cb42cd23c389368fcdaa9380e8e9573c629c11959ad

    SHA512

    c8cef019b2081b4ab2229a6874be38d35cdccff71973e5d00686eb914b3c5effbbf8397b372eef7b8e8136e5fbc0f8e5e5ba7d4abfc96118a6789ace552f2069

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\MainUI.xml

    Filesize

    13KB

    MD5

    c1c82f45c3129dfbed570e515532e2d6

    SHA1

    ccd3fbe9b7716ca344e67242311751af2fce2cbb

    SHA256

    8cce773649c3d42bd0a65f4fe7c64364fe67dac8540ebdf5428b91a348768bf2

    SHA512

    b5291539b48a3cb5ed2d5b6e27e8d6950c729837d9b8640c23926a787fca0ae8e24b14b9340ec08aad8220f88e0e572f411f38e27b980c2aea17f10c5ebd51f4

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\OptionsDialog.xml

    Filesize

    2KB

    MD5

    9fb4355e9719fe7f36b5e449161382b7

    SHA1

    d98e4ed815676f90c66535f0e3d78d1e9b17ed62

    SHA256

    d51e336d8fd980e4afe130f93cb39c393e5646aaa64b4961975f78cdfca87565

    SHA512

    5718ebc206ead911aecffaaa4328721fc96fa8403f12a573fc8a012151108f59344afc7375240da2f197e90fade3bb642c49f36494ee8d0517b1c20cf7c29d59

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\ProgressDialog.xml

    Filesize

    380B

    MD5

    f6d1c497ca3b282fec8cb468e056378a

    SHA1

    25e217a29a3345df6dc992b996805ea6b77824be

    SHA256

    373f68416d333cc97dc74a00bab8ada24ed861e621e0dded0edd92dbe3855341

    SHA512

    a45a9d98ed6f04566c4f305ef72e2046a585b4e1c8ab5f0d9865ad00b388b162ec68155f051e4c7b94989abff12208cc9370e096b35216aeedc8089c6487f10e

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\SdiMaker.xml

    Filesize

    840B

    MD5

    684490c4336716dd4148ecf789c26121

    SHA1

    3f194d47c8b9185ae96fdbef46e56088f7d3fd8a

    SHA256

    9c65c1b4d2b0078d0a035ed2496978fe25ed9483922ff3f35dc8b077ffc97eee

    SHA512

    7f456d84dc62b279f00870299f60ca1a3d4a2fe84d68db55ec99d3a1ab2b4206551f9702d7df233681e1cb836d778c47141e69717e2871d623245fbcdbddb904

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\lang\en-US\properties.xml

    Filesize

    182B

    MD5

    06eaea5b0972b869dc5c643ecbb2fcfe

    SHA1

    05e31974657b1d5ba89f0709a009b2b8233ebcf2

    SHA256

    f2b7e9d7e1dafe9335b53e39fd8570968358f4f0a3426012f0a510b1f7fec26d

    SHA512

    38b5cd2f7c762ff922a02389992bb1b77da9fbd6628873e156a152c5d31c46f6ac5e431198624e4d29ba0960b9467e6a8972e826e272c6e655ed1fbdaa88c0f3

  • memory/216-107-0x0000000001FF0000-0x0000000002020000-memory.dmp

    Filesize

    192KB

  • memory/216-168-0x0000000001FF0000-0x0000000002020000-memory.dmp

    Filesize

    192KB

  • memory/216-105-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/216-108-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/216-106-0x0000000001FF0000-0x0000000002020000-memory.dmp

    Filesize

    192KB

  • memory/216-104-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/216-138-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/216-144-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/216-182-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/216-145-0x0000000001FF0000-0x0000000002020000-memory.dmp

    Filesize

    192KB

  • memory/1336-115-0x0000000002460000-0x000000000246C000-memory.dmp

    Filesize

    48KB

  • memory/1336-183-0x00007FFB5C6B0000-0x00007FFB5D171000-memory.dmp

    Filesize

    10.8MB

  • memory/1336-113-0x00000000003E0000-0x00000000004D6000-memory.dmp

    Filesize

    984KB

  • memory/1336-112-0x00007FFB5C6B3000-0x00007FFB5C6B5000-memory.dmp

    Filesize

    8KB

  • memory/1336-180-0x00007FFB5C6B3000-0x00007FFB5C6B5000-memory.dmp

    Filesize

    8KB

  • memory/1336-164-0x0000000027C50000-0x0000000027CCC000-memory.dmp

    Filesize

    496KB

  • memory/1336-116-0x00007FFB5C6B0000-0x00007FFB5D171000-memory.dmp

    Filesize

    10.8MB

  • memory/1336-117-0x000000001B2F0000-0x000000001B364000-memory.dmp

    Filesize

    464KB

  • memory/1336-120-0x000000001C080000-0x000000001C0C4000-memory.dmp

    Filesize

    272KB

  • memory/2916-6-0x000000000042F000-0x0000000000430000-memory.dmp

    Filesize

    4KB

  • memory/2916-179-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2916-136-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2916-0-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2916-137-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2916-189-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2916-4-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2916-197-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2916-221-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB