Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-08-2023 02:47

General

  • Target

    048beca16d559033226ec3e37292418a576eb260a69c1e49d7727a057eb79c3e.exe

  • Size

    1.4MB

  • MD5

    53bf52bed3fb1c33b0d3ebd479663a01

  • SHA1

    b4ac577d8ccaaad6a443c7bda18338ae583ef26f

  • SHA256

    048beca16d559033226ec3e37292418a576eb260a69c1e49d7727a057eb79c3e

  • SHA512

    6ba4c8c54d6141cb467c1e49a45e799d10b72b48a56b01cd0eed70a8926cc599a5e868791214e9d16c4ada01e4769f95a7779e1c8ceb696d6e42dfb364efb8a5

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\048beca16d559033226ec3e37292418a576eb260a69c1e49d7727a057eb79c3e.exe
    "C:\Users\Admin\AppData\Local\Temp\048beca16d559033226ec3e37292418a576eb260a69c1e49d7727a057eb79c3e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:3732
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2292
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4856
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2308
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4060
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2196
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:4292
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:4400
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3544
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="MCPGVJNB" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3248
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
              5⤵
                PID:4460
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:648
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                5⤵
                  PID:3360
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 10
                    6⤵
                    • Runs ping.exe
                    PID:516
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                    6⤵
                    • Modifies WinLogon for persistence
                    PID:1556
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"
                  5⤵
                    PID:1512
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 14
                      6⤵
                      • Runs ping.exe
                      PID:4052
                • C:\Windows\SysWOW64\attrib.exe
                  "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:1604
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                3⤵
                • Adds Run key to start application
                PID:3412
              • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                "ratt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:4852

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            538.7MB

            MD5

            e49c767c5f103fe690171f11eb85c92b

            SHA1

            2efd2746f524f9cc7b60ed25b99e7b0b4f177d6e

            SHA256

            2d9c8e2b60e738068023a67b96f6b0032a51b5c7e57182d5336f62b0367e34be

            SHA512

            a9911fec63ce4e47f9d63c1aa42c50accb139e9ccc6e8c71be8c580456cc3a2720437b0963f0d4ebf08faf903a762fa6342f08d243664d7ccbf458c14059528b

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

            Filesize

            411.4MB

            MD5

            1305e0c1fc8d95b0617bd62b648cc903

            SHA1

            1ce5e6d420acda2b05846d722da2c89a647c0723

            SHA256

            736687153ea611408c0c2ce964184db6d9f8a433eb9db082855899833b611145

            SHA512

            50b5e647a1e04f650a36e9a9531d32daaa1c1d65564c9ac4ef8657592eb77208a79c122ad9f118a5fe9dec4fd8efc726979c9194c09a4b2f96d1e698509f3fd3

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            1KB

            MD5

            0f5cbdca905beb13bebdcf43fb0716bd

            SHA1

            9e136131389fde83297267faf6c651d420671b3f

            SHA256

            a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

            SHA512

            a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            12KB

            MD5

            061162a68f61f6bb1cf459ef39678cd3

            SHA1

            fb958368ef157313aa8392217b9c6a7ae84a9c64

            SHA256

            09949bcefe58d3e473e3663e00a1e49159da115ff65799f7c1bdc2e908f2f946

            SHA512

            6549394e9cdc30a86b3d6a3064f9b2a7b059da90d8e10d01dd99c0d4fb1f6d1466abf10818bea347b81d8fe8bfa8b079b10c455e823d8c3a890654963fae0c1e

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            12KB

            MD5

            feeed381de2956daed12fdf6e596bb76

            SHA1

            c08ce703aa49822b48ad7346fcbc6336c6f1cdc3

            SHA256

            4200fbeddf9a129f0865df8802fe17146c0bbf2096c93d34fef107560af38a9b

            SHA512

            278c5e6be93d8b6554509678d2c3e2b0a18fbeda99c023f3858c9e61f3273cd3bcca58f60a81bf60b58e105ae0168a75c66c55419fd8c1594c813d955e5cbebc

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            12KB

            MD5

            ad5eae113592c4ef1f6b2c9ad4e81d59

            SHA1

            998c0752284e19023958d40c08183099778f7010

            SHA256

            b8c05fca09c90a2aa16deae2e6fa47628eb45373f1cf9d6b634f391b9804ebfe

            SHA512

            02a47d5a0cb550c85f6b9f2588557c1b5e62f02a46cc818a098c3bb31f1acf86cdfee87f602eb3448703b4870a7362dcee2f739dc6b75ebe9d3c15fe3092967c

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            12KB

            MD5

            2a4695d9f9363e56da7e0be10cf00ec6

            SHA1

            f4aeed9001c758a9e31ea7822a83c3833ae430c8

            SHA256

            02014b54792d552a86622dc7edc28598a46e4d7a774082f9411e58bedbedffcc

            SHA512

            aacb5be3d51a08fc754a142fc2199818ab5cb9fea8788e280597902187549dea22e135d6d498e0abc5bbf7be58f24a53614252cd8f43f86292293578394da348

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            12KB

            MD5

            aba9221d573f79ecb543467c9407946f

            SHA1

            3ca0cdddf50c356e74dbe1f3d1740f57f76c48e9

            SHA256

            6139719526a1d1f2ee2a593dabeb14fb757ace549a6df88565bb147f1c399aa7

            SHA512

            1e8a72d40f1e806a4620289c7f7bc96e9f16ea57774d5c35cd0b22e62545e4cb5a3bd25c8948580b7b8ff6e7484d21a5e5bfd8bc479be7478e69ff92d422e9ad

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

            Filesize

            1KB

            MD5

            0df43097e0f0acd04d9e17fb43d618b9

            SHA1

            69b3ade12cb228393a93624e65f41604a17c83b6

            SHA256

            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

            SHA512

            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxg4ker5.1l0.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

            Filesize

            693KB

            MD5

            7de6fdf3629c73bf0c29a96fa23ae055

            SHA1

            dcb37f6d43977601c6460b17387a89b9e4c0609a

            SHA256

            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

            SHA512

            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

            Filesize

            1KB

            MD5

            7ea1fec84d76294d9256ae3dca7676b2

            SHA1

            1e335451d1cbb6951bc77bf75430f4d983491342

            SHA256

            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

            SHA512

            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            276.3MB

            MD5

            8c1a9ae9a662060166348add3c4f5872

            SHA1

            4b83015ec27677bbdc865c643e30a91dd392a5df

            SHA256

            55f86c9d0d5649061b3e1f4e7691ea62682426a1708aa95aa5a9a4f2e091bd5b

            SHA512

            e55511bfa2b0151ab995a125fcc4b3c91377cd8cd66076377260589d34d047624d2dc379214d9f276a2ab52a8ae95e1c02f925a63627b9d6db77a091b8c14243

          • \Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • memory/648-562-0x00000000009E0000-0x0000000000B96000-memory.dmp

            Filesize

            1.7MB

          • memory/648-567-0x00000000050F0000-0x0000000005100000-memory.dmp

            Filesize

            64KB

          • memory/648-579-0x0000000004F20000-0x0000000004F2A000-memory.dmp

            Filesize

            40KB

          • memory/648-561-0x0000000073CA0000-0x000000007438E000-memory.dmp

            Filesize

            6.9MB

          • memory/648-565-0x0000000004E60000-0x0000000004EFC000-memory.dmp

            Filesize

            624KB

          • memory/648-566-0x0000000004F40000-0x0000000004FD2000-memory.dmp

            Filesize

            584KB

          • memory/648-570-0x0000000004DC0000-0x0000000004E06000-memory.dmp

            Filesize

            280KB

          • memory/800-255-0x0000000010000000-0x00000000100E2000-memory.dmp

            Filesize

            904KB

          • memory/800-251-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/800-259-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/2196-248-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/2196-244-0x00000000070F0000-0x0000000007100000-memory.dmp

            Filesize

            64KB

          • memory/2196-247-0x00000000070F0000-0x0000000007100000-memory.dmp

            Filesize

            64KB

          • memory/2196-232-0x00000000070F0000-0x0000000007100000-memory.dmp

            Filesize

            64KB

          • memory/2196-231-0x00000000070F0000-0x0000000007100000-memory.dmp

            Filesize

            64KB

          • memory/2196-230-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/2308-170-0x0000000007430000-0x0000000007440000-memory.dmp

            Filesize

            64KB

          • memory/2308-186-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/2308-168-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/2308-169-0x0000000007430000-0x0000000007440000-memory.dmp

            Filesize

            64KB

          • memory/2308-182-0x0000000007430000-0x0000000007440000-memory.dmp

            Filesize

            64KB

          • memory/2308-183-0x0000000007430000-0x0000000007440000-memory.dmp

            Filesize

            64KB

          • memory/4060-207-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/4060-203-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/4060-206-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/4060-191-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/4060-190-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/4060-189-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/4348-531-0x00000000092C0000-0x00000000092E2000-memory.dmp

            Filesize

            136KB

          • memory/4348-300-0x0000000009220000-0x00000000092B4000-memory.dmp

            Filesize

            592KB

          • memory/4348-532-0x000000000A3C0000-0x000000000A8BE000-memory.dmp

            Filesize

            5.0MB

          • memory/4348-526-0x0000000009180000-0x000000000919A000-memory.dmp

            Filesize

            104KB

          • memory/4348-525-0x0000000009D40000-0x000000000A3B8000-memory.dmp

            Filesize

            6.5MB

          • memory/4348-499-0x0000000008DF0000-0x0000000008DF8000-memory.dmp

            Filesize

            32KB

          • memory/4348-494-0x0000000008E50000-0x0000000008E6A000-memory.dmp

            Filesize

            104KB

          • memory/4348-371-0x00000000066F0000-0x0000000006700000-memory.dmp

            Filesize

            64KB

          • memory/4348-265-0x0000000073CA0000-0x000000007438E000-memory.dmp

            Filesize

            6.9MB

          • memory/4348-266-0x00000000066F0000-0x0000000006700000-memory.dmp

            Filesize

            64KB

          • memory/4348-267-0x0000000007700000-0x0000000007A50000-memory.dmp

            Filesize

            3.3MB

          • memory/4348-299-0x00000000066F0000-0x0000000006700000-memory.dmp

            Filesize

            64KB

          • memory/4348-269-0x0000000007B30000-0x0000000007B7B000-memory.dmp

            Filesize

            300KB

          • memory/4348-298-0x0000000073CA0000-0x000000007438E000-memory.dmp

            Filesize

            6.9MB

          • memory/4348-291-0x0000000008E10000-0x0000000008E43000-memory.dmp

            Filesize

            204KB

          • memory/4348-292-0x0000000008CB0000-0x0000000008CCE000-memory.dmp

            Filesize

            120KB

          • memory/4348-297-0x00000000090D0000-0x0000000009175000-memory.dmp

            Filesize

            660KB

          • memory/4628-226-0x0000000006E90000-0x0000000006EA0000-memory.dmp

            Filesize

            64KB

          • memory/4628-211-0x0000000007CA0000-0x0000000007FF0000-memory.dmp

            Filesize

            3.3MB

          • memory/4628-210-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/4628-223-0x0000000006E90000-0x0000000006EA0000-memory.dmp

            Filesize

            64KB

          • memory/4628-227-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/4856-146-0x0000000006FE0000-0x0000000006FFC000-memory.dmp

            Filesize

            112KB

          • memory/4856-144-0x0000000007800000-0x0000000007866000-memory.dmp

            Filesize

            408KB

          • memory/4856-160-0x0000000006A20000-0x0000000006A30000-memory.dmp

            Filesize

            64KB

          • memory/4856-159-0x0000000006A20000-0x0000000006A30000-memory.dmp

            Filesize

            64KB

          • memory/4856-148-0x0000000007F40000-0x0000000007FB6000-memory.dmp

            Filesize

            472KB

          • memory/4856-147-0x0000000008220000-0x000000000826B000-memory.dmp

            Filesize

            300KB

          • memory/4856-145-0x0000000007870000-0x0000000007BC0000-memory.dmp

            Filesize

            3.3MB

          • memory/4856-164-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB

          • memory/4856-143-0x0000000007790000-0x00000000077F6000-memory.dmp

            Filesize

            408KB

          • memory/4856-142-0x0000000006EA0000-0x0000000006EC2000-memory.dmp

            Filesize

            136KB

          • memory/4856-141-0x0000000007060000-0x0000000007688000-memory.dmp

            Filesize

            6.2MB

          • memory/4856-140-0x0000000006A20000-0x0000000006A30000-memory.dmp

            Filesize

            64KB

          • memory/4856-139-0x0000000006A20000-0x0000000006A30000-memory.dmp

            Filesize

            64KB

          • memory/4856-138-0x0000000004760000-0x0000000004796000-memory.dmp

            Filesize

            216KB

          • memory/4856-137-0x0000000073D70000-0x000000007445E000-memory.dmp

            Filesize

            6.9MB