Analysis

  • max time kernel
    147s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 00:35

General

  • Target

    b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90.exe

  • Size

    216KB

  • MD5

    3df8c2521ccc2a565789e21a7efe2a2a

  • SHA1

    b9cdd76a4e650b8b1df9cad6e28af5e902e195eb

  • SHA256

    b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90

  • SHA512

    e9c5b865d70f1fccf13fab15357c7429f75f4c27aef8253b23f4fbef81caa941e678e5e27b81d843ac5c3a57beeaa7591525b7c1064b279b1591b729d7ab8a1e

  • SSDEEP

    3072:ds9KL2cTu/9QvFaWA8pDhDIYG7BswwubXW3pCFUKH5cDKCMvW2PrRh4xeqLsSzjM:WKacK/WaV8pyYG7CyCCPHPrX4xeqLp4

Malware Config

Signatures

  • Modifies security service 2 TTPs 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 11 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 22 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 33 IoCs
  • Runs .reg file with regedit 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90.exe
    "C:\Users\Admin\AppData\Local\Temp\b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\tempr.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2848
    • C:\Windows\SysWOW64\Tilesys.com
      C:\Windows\system32\Tilesys.com 504 "C:\Users\Admin\AppData\Local\Temp\b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\Tilesys.com
        C:\Windows\system32\Tilesys.com 552 "C:\Windows\SysWOW64\Tilesys.com"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c c:\tempr.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • System Location Discovery: System Language Discovery
            • Runs .reg file with regedit
            PID:2112
        • C:\Windows\SysWOW64\Tilesys.com
          C:\Windows\system32\Tilesys.com 560 "C:\Windows\SysWOW64\Tilesys.com"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2520
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c c:\tempr.bat
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              6⤵
              • Modifies security service
              • System Location Discovery: System Language Discovery
              • Runs .reg file with regedit
              PID:2620
          • C:\Windows\SysWOW64\Tilesys.com
            C:\Windows\system32\Tilesys.com 564 "C:\Windows\SysWOW64\Tilesys.com"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:532
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c c:\tempr.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1108
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                7⤵
                • Modifies security service
                • System Location Discovery: System Language Discovery
                • Runs .reg file with regedit
                PID:2200
            • C:\Windows\SysWOW64\Tilesys.com
              C:\Windows\system32\Tilesys.com 568 "C:\Windows\SysWOW64\Tilesys.com"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:992
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\tempr.bat
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2392
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                  8⤵
                  • Modifies security service
                  • System Location Discovery: System Language Discovery
                  • Runs .reg file with regedit
                  PID:2408
              • C:\Windows\SysWOW64\Tilesys.com
                C:\Windows\system32\Tilesys.com 572 "C:\Windows\SysWOW64\Tilesys.com"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2844
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c c:\tempr.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:792
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                    9⤵
                    • Modifies security service
                    • System Location Discovery: System Language Discovery
                    • Runs .reg file with regedit
                    PID:764
                • C:\Windows\SysWOW64\Tilesys.com
                  C:\Windows\system32\Tilesys.com 576 "C:\Windows\SysWOW64\Tilesys.com"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Writes to the Master Boot Record (MBR)
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2496
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c c:\tempr.bat
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1356
                    • C:\Windows\SysWOW64\regedit.exe
                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                      10⤵
                      • Modifies security service
                      • System Location Discovery: System Language Discovery
                      • Runs .reg file with regedit
                      PID:2736
                  • C:\Windows\SysWOW64\Tilesys.com
                    C:\Windows\system32\Tilesys.com 580 "C:\Windows\SysWOW64\Tilesys.com"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:2648
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c c:\tempr.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:2696
                      • C:\Windows\SysWOW64\regedit.exe
                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                        11⤵
                        • Modifies security service
                        • System Location Discovery: System Language Discovery
                        • Runs .reg file with regedit
                        PID:2124
                    • C:\Windows\SysWOW64\Tilesys.com
                      C:\Windows\system32\Tilesys.com 584 "C:\Windows\SysWOW64\Tilesys.com"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Writes to the Master Boot Record (MBR)
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:2864
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c c:\tempr.bat
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:1808
                        • C:\Windows\SysWOW64\regedit.exe
                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                          12⤵
                          • Modifies security service
                          • System Location Discovery: System Language Discovery
                          • Runs .reg file with regedit
                          PID:2268
                      • C:\Windows\SysWOW64\Tilesys.com
                        C:\Windows\system32\Tilesys.com 588 "C:\Windows\SysWOW64\Tilesys.com"
                        11⤵
                        • Executes dropped EXE
                        • Writes to the Master Boot Record (MBR)
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:2008
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c c:\tempr.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:1664
                          • C:\Windows\SysWOW64\regedit.exe
                            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                            13⤵
                            • Modifies security service
                            • System Location Discovery: System Language Discovery
                            • Runs .reg file with regedit
                            PID:2632

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1.reg

          Filesize

          3KB

          MD5

          9e5db93bd3302c217b15561d8f1e299d

          SHA1

          95a5579b336d16213909beda75589fd0a2091f30

          SHA256

          f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

          SHA512

          b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

        • C:\Users\Admin\AppData\Local\Temp\1.reg

          Filesize

          576B

          MD5

          8a0897226da780b90c11da0756b361f1

          SHA1

          67f813e8733ad75a2147c59cca102a60274daeab

          SHA256

          115ff7b8bbe33e1325a2b03fb279281b79b2b9c4c0d6147c049c99da39867bee

          SHA512

          55e0e0791fb8e76fb67511ef2bfe1bdb934c857a5a555f9c72dd063250c18b17c57ff9f220c0d3cdd219828d87f5c08bfe5e198476c9d38119c4cfb099b99642

        • C:\Users\Admin\AppData\Local\Temp\1.reg

          Filesize

          1KB

          MD5

          5b77620cb52220f4a82e3551ee0a53a6

          SHA1

          07d122b8e70ec5887bad4ef8f4d6209df18912d0

          SHA256

          93ee7aaab4bb8bb1a11aede226bdb7c2ad85197ef5054eb58531c4df35599579

          SHA512

          9dc2b10a03c87d294903ff3514ca38ce1e85dec66213a7042d31f70fb20d36fed645150c5a6cb6f08c31bdc9f61e7dee2f1737c98aab263c289b09ffa663371c

        • C:\Users\Admin\AppData\Local\Temp\1.reg

          Filesize

          1KB

          MD5

          3637baf389a0d79b412adb2a7f1b7d09

          SHA1

          f4b011a72f59cf98a325f12b7e40ddd0548ccc16

          SHA256

          835336f5d468ac1d8361f9afbc8e69ff1538c51b0b619d641b4b41dcfaa39cba

          SHA512

          ea71a49c3673e9ce4f92d0f38441b3bc5b3b9ef6649caa21972648e34b6cec8694fa8fb7fc0ddad1e58f0464e0ba917c4500090a3db3fc07e1d258079c1c2506

        • C:\Users\Admin\AppData\Local\Temp\1.reg

          Filesize

          3KB

          MD5

          752fd85212d47da8f0adc29004a573b2

          SHA1

          fa8fe3ff766601db46412879dc13dbec8d055965

          SHA256

          9faa69e9dabfb4beb40790bf12d0ae2ac0a879fb045e38c03b9e4d0ab569636e

          SHA512

          d7bbadb2ed764717dc01b012832e5c1debd6615bbdc121b5954e61d6364a03b2dd03718bdea26c5c2a6dbb6e33c5a7657c76862f6d8c0a916f7a0f9f8dd3b209

        • C:\Windows\SysWOW64\Tilesys.com

          Filesize

          216KB

          MD5

          3df8c2521ccc2a565789e21a7efe2a2a

          SHA1

          b9cdd76a4e650b8b1df9cad6e28af5e902e195eb

          SHA256

          b4923cbab0b28bdcbc4cf8ff8a6680afbb025f25f3f86904c32ba59ad19eea90

          SHA512

          e9c5b865d70f1fccf13fab15357c7429f75f4c27aef8253b23f4fbef81caa941e678e5e27b81d843ac5c3a57beeaa7591525b7c1064b279b1591b729d7ab8a1e

        • C:\tempr.bat

          Filesize

          5KB

          MD5

          0019a0451cc6b9659762c3e274bc04fb

          SHA1

          5259e256cc0908f2846e532161b989f1295f479b

          SHA256

          ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

          SHA512

          314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

        • memory/532-689-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/532-571-0x0000000002CE0000-0x0000000002D92000-memory.dmp

          Filesize

          712KB

        • memory/532-452-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/992-690-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/992-810-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/992-573-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1064-329-0x0000000002D60000-0x0000000002E12000-memory.dmp

          Filesize

          712KB

        • memory/1064-447-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2212-175-0x0000000002990000-0x0000000002991000-memory.dmp

          Filesize

          4KB

        • memory/2212-167-0x00000000028D0000-0x00000000028D1000-memory.dmp

          Filesize

          4KB

        • memory/2212-28-0x0000000001F90000-0x0000000001F91000-memory.dmp

          Filesize

          4KB

        • memory/2212-27-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

          Filesize

          4KB

        • memory/2212-26-0x0000000001F70000-0x0000000001F71000-memory.dmp

          Filesize

          4KB

        • memory/2212-25-0x0000000001F80000-0x0000000001F81000-memory.dmp

          Filesize

          4KB

        • memory/2212-23-0x0000000001F60000-0x0000000001F61000-memory.dmp

          Filesize

          4KB

        • memory/2212-22-0x0000000000910000-0x0000000000911000-memory.dmp

          Filesize

          4KB

        • memory/2212-21-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/2212-20-0x00000000008F0000-0x00000000008F1000-memory.dmp

          Filesize

          4KB

        • memory/2212-19-0x0000000000900000-0x0000000000901000-memory.dmp

          Filesize

          4KB

        • memory/2212-18-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2212-17-0x0000000000650000-0x0000000000651000-memory.dmp

          Filesize

          4KB

        • memory/2212-16-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2212-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2212-14-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/2212-13-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

        • memory/2212-12-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB

        • memory/2212-11-0x0000000000310000-0x0000000000311000-memory.dmp

          Filesize

          4KB

        • memory/2212-10-0x00000000002D0000-0x00000000002D1000-memory.dmp

          Filesize

          4KB

        • memory/2212-9-0x00000000002E0000-0x00000000002E1000-memory.dmp

          Filesize

          4KB

        • memory/2212-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

          Filesize

          4KB

        • memory/2212-7-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2212-6-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2212-5-0x0000000000290000-0x0000000000291000-memory.dmp

          Filesize

          4KB

        • memory/2212-4-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2212-162-0x00000000028A0000-0x00000000028A1000-memory.dmp

          Filesize

          4KB

        • memory/2212-185-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2212-182-0x0000000002B30000-0x0000000002BE2000-memory.dmp

          Filesize

          712KB

        • memory/2212-181-0x0000000002A30000-0x0000000002A31000-memory.dmp

          Filesize

          4KB

        • memory/2212-180-0x0000000002A40000-0x0000000002A41000-memory.dmp

          Filesize

          4KB

        • memory/2212-179-0x0000000002A10000-0x0000000002A11000-memory.dmp

          Filesize

          4KB

        • memory/2212-178-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/2212-177-0x00000000029B0000-0x00000000029B1000-memory.dmp

          Filesize

          4KB

        • memory/2212-176-0x00000000029C0000-0x00000000029C1000-memory.dmp

          Filesize

          4KB

        • memory/2212-30-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

          Filesize

          4KB

        • memory/2212-174-0x00000000029A0000-0x00000000029A1000-memory.dmp

          Filesize

          4KB

        • memory/2212-173-0x0000000002970000-0x0000000002971000-memory.dmp

          Filesize

          4KB

        • memory/2212-172-0x0000000002980000-0x0000000002981000-memory.dmp

          Filesize

          4KB

        • memory/2212-171-0x0000000002950000-0x0000000002951000-memory.dmp

          Filesize

          4KB

        • memory/2212-170-0x0000000002960000-0x0000000002961000-memory.dmp

          Filesize

          4KB

        • memory/2212-169-0x00000000028F0000-0x00000000028F1000-memory.dmp

          Filesize

          4KB

        • memory/2212-168-0x0000000002900000-0x0000000002901000-memory.dmp

          Filesize

          4KB

        • memory/2212-29-0x00000000023D0000-0x00000000023D1000-memory.dmp

          Filesize

          4KB

        • memory/2212-166-0x00000000028E0000-0x00000000028E1000-memory.dmp

          Filesize

          4KB

        • memory/2212-165-0x00000000028B0000-0x00000000028B1000-memory.dmp

          Filesize

          4KB

        • memory/2212-164-0x00000000028C0000-0x00000000028C1000-memory.dmp

          Filesize

          4KB

        • memory/2212-163-0x0000000002890000-0x0000000002891000-memory.dmp

          Filesize

          4KB

        • memory/2212-161-0x0000000002870000-0x0000000002871000-memory.dmp

          Filesize

          4KB

        • memory/2212-160-0x0000000002880000-0x0000000002881000-memory.dmp

          Filesize

          4KB

        • memory/2212-203-0x0000000000250000-0x0000000000280000-memory.dmp

          Filesize

          192KB

        • memory/2212-1-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2212-0-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2212-2-0x0000000000250000-0x0000000000280000-memory.dmp

          Filesize

          192KB

        • memory/2212-3-0x0000000000280000-0x0000000000283000-memory.dmp

          Filesize

          12KB

        • memory/2212-24-0x0000000001F50000-0x0000000001F51000-memory.dmp

          Filesize

          4KB

        • memory/2212-32-0x00000000023E0000-0x00000000023E1000-memory.dmp

          Filesize

          4KB

        • memory/2212-37-0x0000000002420000-0x0000000002421000-memory.dmp

          Filesize

          4KB

        • memory/2212-36-0x0000000002430000-0x0000000002431000-memory.dmp

          Filesize

          4KB

        • memory/2212-35-0x0000000002400000-0x0000000002401000-memory.dmp

          Filesize

          4KB

        • memory/2212-34-0x0000000002410000-0x0000000002411000-memory.dmp

          Filesize

          4KB

        • memory/2212-31-0x00000000023F0000-0x00000000023F1000-memory.dmp

          Filesize

          4KB

        • memory/2340-327-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2340-200-0x00000000023D0000-0x00000000023D1000-memory.dmp

          Filesize

          4KB

        • memory/2340-191-0x0000000000740000-0x0000000000741000-memory.dmp

          Filesize

          4KB

        • memory/2340-190-0x0000000000520000-0x0000000000521000-memory.dmp

          Filesize

          4KB

        • memory/2340-189-0x00000000004D0000-0x00000000004D1000-memory.dmp

          Filesize

          4KB

        • memory/2340-188-0x00000000004C0000-0x00000000004C1000-memory.dmp

          Filesize

          4KB

        • memory/2340-205-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2340-206-0x00000000002E0000-0x0000000000310000-memory.dmp

          Filesize

          192KB

        • memory/2340-208-0x0000000002CF0000-0x0000000002DA2000-memory.dmp

          Filesize

          712KB

        • memory/2340-326-0x00000000002E0000-0x0000000000310000-memory.dmp

          Filesize

          192KB

        • memory/2340-194-0x0000000002000000-0x0000000002001000-memory.dmp

          Filesize

          4KB

        • memory/2340-195-0x0000000002020000-0x0000000002021000-memory.dmp

          Filesize

          4KB

        • memory/2340-192-0x0000000000760000-0x0000000000761000-memory.dmp

          Filesize

          4KB

        • memory/2340-187-0x00000000002E0000-0x0000000000310000-memory.dmp

          Filesize

          192KB

        • memory/2340-199-0x00000000023B0000-0x00000000023B1000-memory.dmp

          Filesize

          4KB

        • memory/2340-196-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/2340-197-0x0000000002060000-0x0000000002061000-memory.dmp

          Filesize

          4KB

        • memory/2340-198-0x0000000002390000-0x0000000002391000-memory.dmp

          Filesize

          4KB

        • memory/2340-186-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2340-193-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

          Filesize

          4KB

        • memory/2340-202-0x0000000002430000-0x0000000002431000-memory.dmp

          Filesize

          4KB

        • memory/2340-201-0x00000000023F0000-0x00000000023F1000-memory.dmp

          Filesize

          4KB

        • memory/2520-450-0x0000000002CE0000-0x0000000002D92000-memory.dmp

          Filesize

          712KB

        • memory/2520-568-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2844-694-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/2844-812-0x0000000002CE0000-0x0000000002D92000-memory.dmp

          Filesize

          712KB