Resubmissions

20/05/2025, 20:23

250520-y572ss1qv8 10

20/05/2025, 20:10

250520-yx65jabr7v 10

14/05/2025, 08:25

250514-kbrwtsfk31 10

Analysis

  • max time kernel
    215s
  • max time network
    222s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2025, 20:23

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

  • Size

    669KB

  • MD5

    ead18f3a909685922d7213714ea9a183

  • SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

  • SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

  • SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • SSDEEP

    6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Malware Config

Extracted

Path

C:\ProgramData\_readme.txt

Ransom Note
ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-T9WE5uiVT6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
URLs

https://we.tl/t-T9WE5uiVT6

Signatures

  • Renames multiple (211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 35 IoCs
  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:972
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4760 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:64
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1092
            5⤵
            • Program crash
            PID:4268
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1784
          4⤵
          • Program crash
          PID:2084
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3552 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 1304
          4⤵
          • Program crash
          PID:2840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1544
        3⤵
        • Program crash
        PID:1888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 1832
      2⤵
      • Program crash
      PID:2496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4152 -ip 4152
    1⤵
      PID:5008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 64 -ip 64
      1⤵
        PID:3672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4760 -ip 4760
        1⤵
          PID:1648
        • C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1020
          • C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
            "C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4796
            • C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
              "C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 4796 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4856
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 1272
                4⤵
                • Program crash
                PID:3148
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1704
              3⤵
              • Program crash
              PID:2476
          • C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
            "C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1020 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:116
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 1416
              3⤵
              • Program crash
              PID:952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1716
            2⤵
            • Program crash
            PID:4152
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4996 -ip 4996
          1⤵
            PID:3800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3552 -ip 3552
            1⤵
              PID:3636
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4312
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 116 -ip 116
              1⤵
                PID:2144
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1020 -ip 1020
                1⤵
                  PID:536
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4856 -ip 4856
                  1⤵
                    PID:4676
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4796 -ip 4796
                    1⤵
                      PID:2888

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

                            Filesize

                            1.3MB

                            MD5

                            f782b09fd215d3d9bb898d61ea2e7a37

                            SHA1

                            a382348e9592bdf93dd10c49773b815a992fa7c7

                            SHA256

                            7bd4646090dff9875e08ea00e5727b11be19fcb850344856e66360c152835694

                            SHA512

                            9342bd7a0cbabd7e699ea545897a6403371a0034e4bea067a9662dad9e492c5fa9b27efa4c850e1c001c79d6a76ffe0dacb6831010e41c8d5e2a92bd5b898606

                          • C:\ProgramData\Microsoft\Windows\Caches\{310BE333-667E-4153-A8B0-AFCFDD6E440A}.2.ver0x0000000000000001.db.kropun

                            Filesize

                            1KB

                            MD5

                            f0df9d2422ffe60e7f84bd97fcf78119

                            SHA1

                            b59340f796352eaa86acad4b9b1fe16ba8384b28

                            SHA256

                            c0eb9770ca175693f44faea3df865c68697a6bdc0000877e61a52e17e6b38daa

                            SHA512

                            2a17dd00d21eac2602512e7af311691cecdedb3341ee9fe00b262180f61c34c68ae422e39a297351df99b1f94197d59307956fa765a46d967b2134628d2871c6

                          • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.kropun

                            Filesize

                            622KB

                            MD5

                            4e6518161cc338011531e6ec335401e2

                            SHA1

                            6d221aae3781af873141e6bbc6790c7ffb20259e

                            SHA256

                            a47f41aa7bcec0354731bea88367b16ea9010ff199298e613b6e3aee6744beca

                            SHA512

                            549c082c5d737f1b1ffcabea6b7f5c44d87efbc9864081afb02a10fa33ffb7c4a081956814e0ccbf9f0ed8a590c4ee9bad782ca49bd63ec9818a25e5b3af1382

                          • C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\dotnet-host-6.0.27-win-x64.msi

                            Filesize

                            736KB

                            MD5

                            c3c0fe1bf5f38a6c89cead208307b99c

                            SHA1

                            df5d4f184c3124d4749c778084f35a2c00066b0b

                            SHA256

                            f4f6d008e54b5a6bac3998fc3fe8e632c347d6b598813e3524d5489b84bd2eaf

                            SHA512

                            0f3e96d16c512e37025b04ff7989d60126c3d65fe868dbcfbeae4dac910ce04fc52d1089f0e41ce85c2def0182a927fdcc349094e74cdd21b45a42fde7f01806

                          • C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

                            Filesize

                            180KB

                            MD5

                            b2e47100abd58190e40c8b6f9f672a36

                            SHA1

                            a754a78021b16e63d9e606cacc6de4fcf6872628

                            SHA256

                            889217bcb971387bc3cb6d76554646d2b0822eceb102320d40adf2422c829128

                            SHA512

                            d30da8c901e063df5901d011b22a01f884234ddddd44b9e81b3c43d93a51e10342074523339d155d69ff03a03a1df66c7d19e0137a16f47735b5b600616ca2a9

                          • C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi.kropun

                            Filesize

                            26.0MB

                            MD5

                            078fdfc06d675c9476796f61e8d8b396

                            SHA1

                            183e0f30aad003e5443fc282813f349ebd7bb1c8

                            SHA256

                            71474bbf9ec8997bb0ec65853cb095b000f1cdd52aa3f53b486a994588a4b7f7

                            SHA512

                            ec1b7bb3993e7022b600557fb63f405cca68fa269ebf9cebb4c699c7e35ac3bdafac44c12b60b67c01987d499023a2b5cfea0bdb66684eff4d67546ec5952a68

                          • C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi

                            Filesize

                            28.5MB

                            MD5

                            01bc6dc2e63ba4656e64f83debbc1f4e

                            SHA1

                            823cb85a326995b562bd02e26996a4a841795322

                            SHA256

                            b96e7138eee33474e5ec02c855673b56f78f0773d10fb962b7c9d015597db689

                            SHA512

                            90f0a9df306c83c3c10cdc7cb03110bb75796b3462a3562743a5a4cf9366d85e157cdf7b60bf6458051a0deec9275ae30fc49d19f83aebaae01ec908b3335175

                          • C:\ProgramData\_readme.txt

                            Filesize

                            1KB

                            MD5

                            d75064cfaac9c92f52aadf373dc7e463

                            SHA1

                            36ea05181d9b037694929ec81f276f13c7d2655c

                            SHA256

                            163ec5b903b6baadd32d560c44c1ea4dce241579a7493eb32c632eae9085d508

                            SHA512

                            43387299749f31c623c5dd4a53ff4d2eff5edfeb80fd4e2edd45860b5c9367d2767ae2ee9b60824b57301999dd2bd995b7d3bd5e7187e447aed76106272559d1

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                            Filesize

                            1KB

                            MD5

                            4a90329071ae30b759d279cca342b0a6

                            SHA1

                            0ac7c4f3357ce87f37a3a112d6878051c875eda5

                            SHA256

                            fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b

                            SHA512

                            f0e206053d4369437c2c0f1f90f0fd03d631e4b9859d807049b41efde823d64cf4d75c28316d932360f7c03bd409e923c8bc2d4f5959361feacecfcf101ae823

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                            Filesize

                            530B

                            MD5

                            1fbb37f79b317a9a248e7c4ce4f5bac5

                            SHA1

                            0ff4d709ebf17be0c28e66dc8bf74672ca28362a

                            SHA256

                            6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9

                            SHA512

                            287e1d62c9ceb660965c266f677c467fbb997c2f5dcd1d63e185e266488aafc3489ac1d3feec81d10f01ce4a72e61a8bc4e124f137ce8675a220aa7797002e74

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                            Filesize

                            174B

                            MD5

                            250610e87b73485576026356cd00f315

                            SHA1

                            d15bb698a49a6bc33ea7a4925a29106468924471

                            SHA256

                            17f10604300826452a6347e8698014e86a29ad175529e4a5890ca44c764013f4

                            SHA512

                            025376c44c693ca6bdf72c6e3f8609b35beb3d0fdda14aa00c0821ffc043150cae03a9827b76c14dda02a2e506d0e8e8bdeb08c5e396c159c75a47505a70b62d

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                            Filesize

                            170B

                            MD5

                            79a7262f039a766e73de23d2e06d1584

                            SHA1

                            7f91a22aced5ae9cf6a824421a0062df58b06621

                            SHA256

                            2855b07885108e348da4c83c865e91788c6701d5f5244f1ce19b4a996ee2ae21

                            SHA512

                            cfdbcf0aba19479eced13444091b64e74799f760efb4f4c6f0b4948c817b30994f036f851ae3800ed5f1ba6d87cc5093b4131ba3295e3aae45ea05d48192eb66

                          • C:\Users\Admin\AppData\Local\ebb05e88-d1a8-4d9d-aeb6-992a6106fa39\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

                            Filesize

                            669KB

                            MD5

                            ead18f3a909685922d7213714ea9a183

                            SHA1

                            1270bd7fd62acc00447b30f066bb23f4745869bf

                            SHA256

                            5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                            SHA512

                            6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                          • memory/64-36-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/64-44-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/64-43-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/116-1216-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/1020-1204-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/1020-1201-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/1020-1217-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-31-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-321-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-30-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-23-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-1199-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-29-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-22-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/3552-17-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4152-3-0x0000000000400000-0x0000000000476000-memory.dmp

                            Filesize

                            472KB

                          • memory/4152-0-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4152-16-0x0000000000670000-0x0000000000770000-memory.dmp

                            Filesize

                            1024KB

                          • memory/4152-19-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4152-20-0x0000000000400000-0x0000000000476000-memory.dmp

                            Filesize

                            472KB

                          • memory/4152-4-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4152-2-0x0000000000670000-0x0000000000770000-memory.dmp

                            Filesize

                            1024KB

                          • memory/4760-40-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4760-37-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4760-34-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4760-33-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4760-45-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4796-1219-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4796-1223-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4856-1221-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4856-1222-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4996-38-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB

                          • memory/4996-1198-0x0000000000400000-0x00000000004A9000-memory.dmp

                            Filesize

                            676KB