Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 13:54

General

  • Target

    f758bc679e0edef42c79856d58b30cd1a67bc030450ba60e99e90ff70928ada5.exe

  • Size

    1.4MB

  • MD5

    42f2505083b71229be3a19e64132ac0e

  • SHA1

    0c4a9a0c70bf50b3b136ebc705065421f77c9005

  • SHA256

    f758bc679e0edef42c79856d58b30cd1a67bc030450ba60e99e90ff70928ada5

  • SHA512

    d5611c32a9cc604d99884ed283e644c2284456357b0a90700ea9ff2b763b9151adbc156bbba9c28c4e54585094c51d3949c59cf6be33717c2971e362ffdfd62e

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f758bc679e0edef42c79856d58b30cd1a67bc030450ba60e99e90ff70928ada5.exe
    "C:\Users\Admin\AppData\Local\Temp\f758bc679e0edef42c79856d58b30cd1a67bc030450ba60e99e90ff70928ada5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3104
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:4112
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5080
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:664
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4896
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2428
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1348
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1976
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2132
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4656
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4372
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:3980
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:688
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:996
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="MNHMTTDP" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2832
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2188
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
              5⤵
                PID:2004
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3160
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                5⤵
                  PID:3304
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 6
                    6⤵
                    • Runs ping.exe
                    PID:2484
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\Music\rot.exe"
                  5⤵
                    PID:448
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 11
                      6⤵
                      • Runs ping.exe
                      PID:1936
                • C:\Windows\SysWOW64\attrib.exe
                  "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:4152
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                3⤵
                • Adds Run key to start application
                PID:4984
              • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                "ratt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3664

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            163.9MB

            MD5

            ce5ac9fd2a7d546ef5af13c7e3d796e6

            SHA1

            720d5df22ba2118a6ec69adeef46ba4ff0970461

            SHA256

            0a5ba06fe4cbc2a981e4f4591a4e07dfe3ce3752f6c56d85ed846ca440330225

            SHA512

            57606a7cdbab04d63660808672b284c1d2057a8c2cb81cb14bc91b6f549f456dff05a0137693c4f8739d2749a7627ce8d866640c2b2120bbd74512b5b84edbf0

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            1KB

            MD5

            33b19d75aa77114216dbc23f43b195e3

            SHA1

            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

            SHA256

            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

            SHA512

            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            a9c971a78001f21dbe2753ffd8e10b29

            SHA1

            5c88f640446a2db44fdb96ef5b40e5e13f3fd977

            SHA256

            4dc2e839d422a8ab56d0380632648a1914e7e5847dbb98db65ff98161614c1b3

            SHA512

            b0613dc3b3aca342e6cdc51547b223ba4331c90953d4f4e136eab7979bc8535f9fde137725f9bfb62b070c4f1a386da052598b4c9580fb9ec99d573e3d1e15f0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            46e8e98aed3774792eb3c030d4c1d901

            SHA1

            6a761f4b86df1e0954b6ffe24efdd31af4b6ce33

            SHA256

            123a79ef8d97fa2b0cce5589e68d8870dee10e5417d5b8cf2736459227a8a326

            SHA512

            b25a3ce81734f143708a318ba42e3583536714c9dc2c875ce7d1e62a77241175607eac8d385e347376862ac027711d3ff7f45c24745f32dab9f7c19fd5beb9e6

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            5bed8a858d4ba2e202c703bda6a3028c

            SHA1

            f1d99d54068b1640ec45eb55e1a9b953d54ae009

            SHA256

            9280f2d3de0da78edd56295dd777b39ef867839f4c32eeca67e4207f3c70824a

            SHA512

            1b2ee90121bd9bd539d4056e6d9b464e0e349c29c9185b124d909d19e57ea5c43fd5c46e9da1a45becb37a4f03d4f94ca1a2f50f1672d54a04860da187ce1ab8

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            aa12e6047ee7c64d98afc92413923918

            SHA1

            f492c993a0cc9d83940d92d60c6592f7066d00bf

            SHA256

            b276f1a5b2359fb366fe27e0c3a363db71b0b78367cbc53d92c96d2ce46a41d2

            SHA512

            2361d4a290baf1880809e54ba260a308636b09068a763eb375138a76e28455da5034963249420acba19ac9ca7db73320347092831d9e3be7f165f02c896239ee

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            9a8b0f2d284e96908fb684b23550469b

            SHA1

            a467e77bdab03195e0dcbbd89648ea1ded7ca3e9

            SHA256

            509bee3589536cc169179dea1085fb1187ea16982ac4a52d79cb52a27c89d753

            SHA512

            706a9dfb990f6ae73b22604d2f63350d33bf0f307b99d82f2462d67872d123a67f87ddc0d5e0b4daf91f6f9a027747b66f7d51b78b31c33252a74f12366c8b95

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

            Filesize

            1KB

            MD5

            0df43097e0f0acd04d9e17fb43d618b9

            SHA1

            69b3ade12cb228393a93624e65f41604a17c83b6

            SHA256

            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

            SHA512

            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xywplzzb.nna.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

            Filesize

            693KB

            MD5

            7de6fdf3629c73bf0c29a96fa23ae055

            SHA1

            dcb37f6d43977601c6460b17387a89b9e4c0609a

            SHA256

            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

            SHA512

            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

            Filesize

            1KB

            MD5

            7ea1fec84d76294d9256ae3dca7676b2

            SHA1

            1e335451d1cbb6951bc77bf75430f4d983491342

            SHA256

            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

            SHA512

            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            136.1MB

            MD5

            85c4b967ff9082c71bdccb195864ee84

            SHA1

            c5ea606f4623f5b8f19c1ea721af6a6774268061

            SHA256

            6d5c40bb0384f5610215ac8a68d5ddb211c68bd7fc607ffe9aacd0ea621a40f7

            SHA512

            12b9512cd9c7838439a9191a92acf006369372c2c1358f9686831d620e822310cf539fcf9db4185ed79164c0697e07cae90660308e061cc025cd9fb26c5603e0

          • memory/1348-184-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/1348-195-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

            Filesize

            64KB

          • memory/1348-197-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/1976-211-0x00000000028F0000-0x0000000002900000-memory.dmp

            Filesize

            64KB

          • memory/1976-213-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/1976-199-0x00000000028F0000-0x0000000002900000-memory.dmp

            Filesize

            64KB

          • memory/1976-198-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/1976-200-0x00000000028F0000-0x0000000002900000-memory.dmp

            Filesize

            64KB

          • memory/2132-226-0x0000000004C70000-0x0000000004C80000-memory.dmp

            Filesize

            64KB

          • memory/2132-214-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/2132-227-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/2428-168-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/2428-182-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB

          • memory/2428-169-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB

          • memory/2428-183-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/2428-170-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB

          • memory/3160-304-0x0000000005360000-0x0000000005370000-memory.dmp

            Filesize

            64KB

          • memory/3160-307-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/3160-305-0x0000000005360000-0x0000000005370000-memory.dmp

            Filesize

            64KB

          • memory/3160-303-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/3160-299-0x0000000005690000-0x000000000569A000-memory.dmp

            Filesize

            40KB

          • memory/3160-298-0x0000000005360000-0x0000000005370000-memory.dmp

            Filesize

            64KB

          • memory/3160-296-0x00000000054D0000-0x0000000005562000-memory.dmp

            Filesize

            584KB

          • memory/3160-294-0x00000000053D0000-0x000000000546C000-memory.dmp

            Filesize

            624KB

          • memory/3160-293-0x0000000000D80000-0x0000000000F36000-memory.dmp

            Filesize

            1.7MB

          • memory/3160-292-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/3664-301-0x0000000000EA0000-0x0000000001056000-memory.dmp

            Filesize

            1.7MB

          • memory/3664-302-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/4372-283-0x00000000088A0000-0x0000000008E44000-memory.dmp

            Filesize

            5.6MB

          • memory/4372-282-0x00000000079C0000-0x00000000079E2000-memory.dmp

            Filesize

            136KB

          • memory/4372-257-0x000000007FC30000-0x000000007FC40000-memory.dmp

            Filesize

            64KB

          • memory/4372-258-0x0000000006900000-0x0000000006932000-memory.dmp

            Filesize

            200KB

          • memory/4372-259-0x0000000070F10000-0x0000000070F5C000-memory.dmp

            Filesize

            304KB

          • memory/4372-269-0x00000000068B0000-0x00000000068CE000-memory.dmp

            Filesize

            120KB

          • memory/4372-270-0x0000000007C70000-0x00000000082EA000-memory.dmp

            Filesize

            6.5MB

          • memory/4372-271-0x0000000007630000-0x000000000764A000-memory.dmp

            Filesize

            104KB

          • memory/4372-272-0x0000000005000000-0x000000000500A000-memory.dmp

            Filesize

            40KB

          • memory/4372-274-0x00000000078B0000-0x0000000007946000-memory.dmp

            Filesize

            600KB

          • memory/4372-273-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/4372-275-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4372-276-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4372-277-0x0000000007830000-0x000000000783E000-memory.dmp

            Filesize

            56KB

          • memory/4372-278-0x0000000007950000-0x000000000796A000-memory.dmp

            Filesize

            104KB

          • memory/4372-279-0x0000000007880000-0x0000000007888000-memory.dmp

            Filesize

            32KB

          • memory/4372-280-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4372-256-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4372-297-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/4372-242-0x00000000750F0000-0x00000000758A0000-memory.dmp

            Filesize

            7.7MB

          • memory/4372-243-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4372-244-0x0000000002930000-0x0000000002940000-memory.dmp

            Filesize

            64KB

          • memory/4656-238-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/4656-230-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/4656-234-0x0000000010000000-0x00000000100E2000-memory.dmp

            Filesize

            904KB

          • memory/4896-146-0x0000000001570000-0x00000000015A6000-memory.dmp

            Filesize

            216KB

          • memory/4896-151-0x0000000005E10000-0x0000000005E76000-memory.dmp

            Filesize

            408KB

          • memory/4896-149-0x0000000005770000-0x0000000005D98000-memory.dmp

            Filesize

            6.2MB

          • memory/4896-150-0x00000000054F0000-0x0000000005512000-memory.dmp

            Filesize

            136KB

          • memory/4896-152-0x0000000005E80000-0x0000000005EE6000-memory.dmp

            Filesize

            408KB

          • memory/4896-148-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/4896-162-0x00000000064C0000-0x00000000064DE000-memory.dmp

            Filesize

            120KB

          • memory/4896-163-0x0000000005130000-0x0000000005140000-memory.dmp

            Filesize

            64KB

          • memory/4896-166-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB

          • memory/4896-147-0x00000000751C0000-0x0000000075970000-memory.dmp

            Filesize

            7.7MB