Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 13:42

General

  • Target

    ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe

  • Size

    8.8MB

  • MD5

    17d0b1dfbf54177c8daafabfd20116c0

  • SHA1

    35387810a5db26159c6b72ee1985df219d67b33a

  • SHA256

    ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66

  • SHA512

    eb2e4881cb3d9df6f707f4e023bd4bc03ef290c41d0e2e12934b089c32a79c31508a658e571c6ea4aec6bac4abd7fc399a41369aef65f6a90cbe302351c7f845

  • SSDEEP

    49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecJ:K1+8e8e8f8e8e8c

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 58 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe
    "C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe
      "C:\Users\Admin\AppData\Local\Temp\ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66N.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4896
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3656
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1000
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4352
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2280
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1552
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2188
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3488
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:232
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2916
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3888
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2808
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4080
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4460
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3252
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4160
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:640
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4084
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2076
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3692
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4812
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5112
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2656
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:312
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3868
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:996
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2216
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1512
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1192
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4376
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3236
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4816
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3428
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2072
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:592
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:968
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1576
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3872
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2988
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1456
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:184
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3968
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1372
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4496
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:792
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5036
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2008
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2404
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3800
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2196
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1268
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4116
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3164
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1496
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2084
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2616
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2156
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          4⤵
            PID:4000
      • C:\Windows\SysWOW64\diskperf.exe
        "C:\Windows\SysWOW64\diskperf.exe"
        2⤵
          PID:2344

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

        Filesize

        8.8MB

        MD5

        17d0b1dfbf54177c8daafabfd20116c0

        SHA1

        35387810a5db26159c6b72ee1985df219d67b33a

        SHA256

        ecda55c7df6a1947a0ef4f1d34fd2ad969777e7eebfe2a40838a8b72d2881e66

        SHA512

        eb2e4881cb3d9df6f707f4e023bd4bc03ef290c41d0e2e12934b089c32a79c31508a658e571c6ea4aec6bac4abd7fc399a41369aef65f6a90cbe302351c7f845

      • C:\Windows\System\explorer.exe

        Filesize

        8.9MB

        MD5

        6b596423118161533f1f9940cdac22a3

        SHA1

        01ee3bc05ef13b1d9e410dc9642b5b9db6847e49

        SHA256

        9a402a60284bba766bae6925a470a4bdf3c526cb2071577a60b9fb683d87377e

        SHA512

        e873a5fbefb3095c6e7221d2aee6544bcc688768022da3988e40fbabcf6b8d363458b93982f7e251dbbad7de3f145d1a3af43f72f3d00ba5226b889606e3fadf

      • C:\Windows\System\spoolsv.exe

        Filesize

        2.3MB

        MD5

        8691f040eccb2c4e0cf04af6520d6338

        SHA1

        2352f6b693f3c589a822b7061b681b888e8bfd17

        SHA256

        dc3918812084ff39ae1e8a4f469ab37c861ea06fd6db5d7c704390a92231deb0

        SHA512

        f6aaeb45622ad79cb2920954c50d7f5fcaf7e642b8c7373c3701c12960e04f593dc80957b6dfaad4110868f52ba5e110dcdd6b8a8860880b3cc276d9a6718acd

      • C:\Windows\System\spoolsv.exe

        Filesize

        8.9MB

        MD5

        55fb31632c70c5ddd3843bf1fabaf99f

        SHA1

        f62ac0b1ee1278c190d433848ae082db98e905c6

        SHA256

        9dc5deea1e262e516539e322c8bec5b3cd56158104dd4aed2431f55714a7ec52

        SHA512

        40b025b98ba9f361ea2d8ea827e70329734320e1684c6f63f81ebc75220c3b6220b6491421a738bd4f6ddb12b2e99fa1e3bffb01cccc3a4f7b10fd415ab1454c

      • memory/184-141-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/184-163-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/232-81-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/312-118-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/592-123-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/592-150-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/640-101-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/792-173-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/968-152-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/968-126-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/996-99-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/996-122-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1000-68-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1192-132-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1372-146-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1372-169-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1456-161-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1456-138-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1512-105-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1512-129-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1552-74-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1576-155-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1576-130-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1708-17-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1708-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

        Filesize

        4KB

      • memory/1708-0-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1708-2-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/1708-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

        Filesize

        4KB

      • memory/2008-178-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2072-148-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2076-107-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2084-174-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2156-179-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2188-76-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2216-102-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2216-125-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2280-72-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2344-9-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2344-13-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2344-12-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2656-116-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2808-66-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2808-88-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2916-83-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2916-62-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/2988-159-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3060-8-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3060-26-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3060-24-0x0000000000440000-0x0000000000509000-memory.dmp

        Filesize

        804KB

      • memory/3060-4-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/3236-112-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3236-137-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3252-95-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3428-145-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3488-78-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3656-65-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3692-109-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3868-96-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3868-120-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3872-157-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3872-133-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3888-85-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3968-143-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/3968-165-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4000-42-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/4080-91-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4084-104-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4116-166-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4160-98-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4352-70-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4376-135-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4460-93-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4496-171-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4812-86-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4812-111-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4816-140-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4816-115-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4896-59-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/4896-35-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/4920-44-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4920-27-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/4920-23-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/5036-153-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/5036-176-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/5112-114-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

      • memory/5112-89-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB