Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    37s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 20:37

General

  • Target

    8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe

  • Size

    1.4MB

  • MD5

    5f7bdaed54aa3bfac6172468fa2aa13e

  • SHA1

    a50d79912991ee01e4e791897a833431c0229343

  • SHA256

    8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e

  • SHA512

    0dc03b7f808a986828827d200b37084bf3ea84908f4573e7a34e615531074e56b52e9b480a70a24e27212548cc6f9050aab1ebdd8b013804f2511ac996ba627a

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe
    "C:\Users\Admin\AppData\Local\Temp\8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4128
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2016
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:988
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5108
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4532
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4616
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4840
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3780
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4688
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3216
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:2712
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1772
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3216
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1160
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:1288
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
                5⤵
                  PID:3404
              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
                "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                4⤵
                  PID:3852
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                    5⤵
                      PID:5080
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 9
                        6⤵
                        • Runs ping.exe
                        PID:1580
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                        6⤵
                          PID:352
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"
                        5⤵
                          PID:3572
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 14
                            6⤵
                            • Runs ping.exe
                            PID:3828
                      • C:\Windows\SysWOW64\attrib.exe
                        "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                        4⤵
                        • Views/modifies file attributes
                        PID:64
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                      3⤵
                        PID:4956
                      • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                        "ratt.exe"
                        3⤵
                          PID:932
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\Music\rot.exe"
                            4⤵
                              PID:4776
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 10
                                5⤵
                                • Runs ping.exe
                                PID:988
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 10
                                5⤵
                                • Runs ping.exe
                                PID:2856
                              • C:\Users\Admin\Music\rot.exe
                                "C:\Users\Admin\Music\rot.exe"
                                5⤵
                                  PID:4948

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                          Filesize

                          428.9MB

                          MD5

                          0323f9da1ccd48fbcd37b75a0373cc29

                          SHA1

                          ea8cdd71e55035dc75bdf93465337b04097e301b

                          SHA256

                          960cb2c766dfe4eea18d72e6a22ffddf7d50010ff68185843a854792a8520e68

                          SHA512

                          bee869fcb66f6245d399dc0a6c35e48b69ff307537da70a01b43a9ec33d66130b93d96912c51970049be686777500c5f77da7d5a85275c1bdb577cc600f55975

                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                          Filesize

                          313.9MB

                          MD5

                          2c01ca29aea1a35638c9c5a2eda2b9a5

                          SHA1

                          0f466e95259a5c0a3b74050fa2cd5953001682a2

                          SHA256

                          b81cba29a8ff04cf70ece963bd6513e200db0b1ad159fa21b53a07b5895ada99

                          SHA512

                          2cc71f9af2e16f2b339c3d3a5812f600ef1df09d17b78e7eb22de505b18eb78c13fc80063278f028e9a7f8baf700da114a23986709dea9e9957da3bb7d2c39c6

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                          Filesize

                          1KB

                          MD5

                          33b19d75aa77114216dbc23f43b195e3

                          SHA1

                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                          SHA256

                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                          SHA512

                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

                          Filesize

                          1KB

                          MD5

                          9a2d0ce437d2445330f2646472703087

                          SHA1

                          33c83e484a15f35c2caa3af62d5da6b7713a20ae

                          SHA256

                          30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

                          SHA512

                          a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          c5ba82a12ecb995713814782f3cd03da

                          SHA1

                          988f58ec78892b83590e1eb3f5214f65f6ef4bf6

                          SHA256

                          cc99c20b37b7fa98750908fd8caff76a841f3b2b34e6a2256af6aac472962297

                          SHA512

                          0758b9ffc7c6cbd265667495305c965ffd299e43f42c395b7b355fb14b02a2587ce44c145621234c9a4540fee07a4475bd06a6e65df7b4a48a3e832e3f8acbf9

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          2d6d22857285ed47d19f52c645f52d52

                          SHA1

                          1d84e5d25272c41abfa5913ca9870fe4555b9162

                          SHA256

                          663de1a60104cf5706e4bb5df8d722ead46793ea1064d69eb67917924bba72c5

                          SHA512

                          4243560dc33825865f131687f62c6643a053ba74a2a0495f41cc97fdf2adbb274bb80598c860e6f93f318b26fa7c96a65935408dbf9461bb198d1a6114b89c2b

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          c9f18f13e1e0ef99e8d7463b7dc26ac2

                          SHA1

                          5bbc6a9e5e5f70a9e285cb3153165ea99be6cc79

                          SHA256

                          8f2ae56c53eed9469d8a0138e4ddac0ec1d96369649d193c652b5bf989199d2e

                          SHA512

                          9a494636d37af4744453b67b119e1f3476e2eb7dd45667be747d216999a344d352a4cce86cf77167ffb10b5f25ec625fccf8f5c2fb77a8a29b0c1be48737bf86

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          50b88afafcfeebf4e2106ad1ba3ec2d5

                          SHA1

                          67c80b960854c012a57b00aa26ca0b820513a3c3

                          SHA256

                          db6e5dc69d452d8a9ccf419ef66828ec185195b025d193c3644c637b945c9b6b

                          SHA512

                          ef165a9825b2d5e03f3fa3e28a2890f70830fcff8a40a6b8833afd65a7f7cd90e186632992993321a306650e71d58ea018a9970cf992f31da896042122d5d2cc

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                          Filesize

                          11KB

                          MD5

                          9cda842396a58877f2959651b59987e5

                          SHA1

                          abac42758f5591eff66cca69788f93bbc0911b77

                          SHA256

                          3c0c4d83f46dfca52466e7f2a49b449ae5324a65310cedb3b0236c34caccb177

                          SHA512

                          21916a67621da8268005bc57c792c0c87506be4769d0e38469bdc5bd57be2c167e3c7d9b61d30f3ebab7ac6af34c60ca7d3d09677e403bcc10568894d8a9fd94

                        • C:\Users\Admin\AppData\Local\Temp\7z.dll

                          Filesize

                          328KB

                          MD5

                          15bbbe562f9be3e5dcbb834e635cc231

                          SHA1

                          7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                          SHA256

                          ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                          SHA512

                          769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                        • C:\Users\Admin\AppData\Local\Temp\7z.dll

                          Filesize

                          328KB

                          MD5

                          15bbbe562f9be3e5dcbb834e635cc231

                          SHA1

                          7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                          SHA256

                          ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                          SHA512

                          769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                        • C:\Users\Admin\AppData\Local\Temp\7z.exe

                          Filesize

                          71KB

                          MD5

                          8ba2e41b330ae9356e62eb63514cf82e

                          SHA1

                          8dc266467a5a0d587ed0181d4344581ef4ff30b2

                          SHA256

                          ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                          SHA512

                          2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                        • C:\Users\Admin\AppData\Local\Temp\7z.exe

                          Filesize

                          71KB

                          MD5

                          8ba2e41b330ae9356e62eb63514cf82e

                          SHA1

                          8dc266467a5a0d587ed0181d4344581ef4ff30b2

                          SHA256

                          ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                          SHA512

                          2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                        • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                          Filesize

                          1KB

                          MD5

                          0df43097e0f0acd04d9e17fb43d618b9

                          SHA1

                          69b3ade12cb228393a93624e65f41604a17c83b6

                          SHA256

                          c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                          SHA512

                          01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3re5jq5f.g2g.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                          Filesize

                          693KB

                          MD5

                          7de6fdf3629c73bf0c29a96fa23ae055

                          SHA1

                          dcb37f6d43977601c6460b17387a89b9e4c0609a

                          SHA256

                          069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                          SHA512

                          d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                        • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                          Filesize

                          1KB

                          MD5

                          7ea1fec84d76294d9256ae3dca7676b2

                          SHA1

                          1e335451d1cbb6951bc77bf75430f4d983491342

                          SHA256

                          9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                          SHA512

                          ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                        • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                          Filesize

                          554.6MB

                          MD5

                          d8f8fdf948604928ab282535270d6b49

                          SHA1

                          98b82c24d8de23899d42e254eb9a7029ffd5ee04

                          SHA256

                          4a9111451d6b73e3a1b27ca5c46488dc97c13a6c6399b90537c0fa65400a746f

                          SHA512

                          d1379fb3dd83cf0e70d3182d12ec7f9f1d109afb4e1db351e84f5b495c75de8e2b4e4f8adeeccb02338f0f0ced4cb8253246af363b9edab3ae867e9db8dc0c30

                        • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                          Filesize

                          285.7MB

                          MD5

                          4081fe22cf72f1ab8bd4fc210206cff8

                          SHA1

                          d54569cf6e0bdd006232ed4211c87b0943d00a0d

                          SHA256

                          8a49562fdfab010888ba36231a4b2ec731f8e8eb7b2017edb04e7a1bafa65b86

                          SHA512

                          63dc5e92e21c2c9c4d0be2782b907d9cbe5948964efb5a8007b4d8a0cc47740686339494c90ebecb09536443b754bc342ab4b2453dba8e3e077503b7f35b55c8

                        • C:\Users\Admin\Music\rot.exe

                          Filesize

                          105.4MB

                          MD5

                          8301ea3e700c4ce0fc28becafc1e08c4

                          SHA1

                          53c6e8d6e8dd206a97715458707d722b8e6ee586

                          SHA256

                          aa3e7b60cd80844e3964112e105ca809911417f079ee64eb9267e9a95b04b145

                          SHA512

                          83905df594f702527b2f501540e28d59fdd8e05cee8a6e87e0cd48b731db50995701d50a9b243705be1dc6e7063e97687959ee92e0898754a105a98654dbf03a

                        • C:\Users\Admin\Music\rot.exe

                          Filesize

                          30.7MB

                          MD5

                          ea6a3dd88aebc161e47e3c8c5b14cf21

                          SHA1

                          42cba2c87c4d12e33be9d1da672bdc5e048ddcf8

                          SHA256

                          49ad9949c944cbf9a944ac447e6fd429308098ffb7b628f7a091e7bd619c7550

                          SHA512

                          515f99572ea64951490ff92a8be4abcf10bd9a2e743d65d0c529d46b1b3f3ec379d1e5a6f2b1fbcc39e6826ff2b92c76b6d3971ca95a9f6d17c5a34e4fc870cf

                        • C:\Users\Admin\Music\rot.exe

                          Filesize

                          34.1MB

                          MD5

                          8dbfbf4d2f3941c809166f9f784e046b

                          SHA1

                          65fc3dc62dc1fb2d12326aa622a9f6fcb287959b

                          SHA256

                          a892004a682bcf07914e82c1d1d5517af739fe2f0c5d044389873160e25ce6e3

                          SHA512

                          c5c01a1438a2dabef1aa3ef02a74f42384eecb05458bdd8c64caa35a20efb7d3d01794fefa858f98db4d04591a1801235f1c2fa396805b8d537d0365c75625ce

                        • memory/932-299-0x0000000000E70000-0x0000000001026000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/932-300-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/932-302-0x0000000005720000-0x0000000005730000-memory.dmp

                          Filesize

                          64KB

                        • memory/3216-240-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/3216-232-0x0000000000400000-0x0000000000432000-memory.dmp

                          Filesize

                          200KB

                        • memory/3216-236-0x0000000010000000-0x00000000100E2000-memory.dmp

                          Filesize

                          904KB

                        • memory/3660-281-0x0000000007150000-0x0000000007172000-memory.dmp

                          Filesize

                          136KB

                        • memory/3660-273-0x0000000006E10000-0x0000000006E1A000-memory.dmp

                          Filesize

                          40KB

                        • memory/3660-294-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3660-285-0x000000007EE40000-0x000000007EE50000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-270-0x0000000006050000-0x000000000606E000-memory.dmp

                          Filesize

                          120KB

                        • memory/3660-284-0x0000000000E70000-0x0000000000E80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-282-0x0000000008040000-0x00000000085E4000-memory.dmp

                          Filesize

                          5.6MB

                        • memory/3660-260-0x00000000705C0000-0x000000007060C000-memory.dmp

                          Filesize

                          304KB

                        • memory/3660-259-0x0000000006080000-0x00000000060B2000-memory.dmp

                          Filesize

                          200KB

                        • memory/3660-280-0x0000000000E70000-0x0000000000E80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-279-0x0000000000E70000-0x0000000000E80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-278-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3660-277-0x0000000007010000-0x0000000007018000-memory.dmp

                          Filesize

                          32KB

                        • memory/3660-276-0x00000000070E0000-0x00000000070FA000-memory.dmp

                          Filesize

                          104KB

                        • memory/3660-275-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

                          Filesize

                          56KB

                        • memory/3660-274-0x0000000007040000-0x00000000070D6000-memory.dmp

                          Filesize

                          600KB

                        • memory/3660-244-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3660-245-0x0000000000E70000-0x0000000000E80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-246-0x0000000000E70000-0x0000000000E80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3660-271-0x0000000007410000-0x0000000007A8A000-memory.dmp

                          Filesize

                          6.5MB

                        • memory/3660-272-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

                          Filesize

                          104KB

                        • memory/3660-258-0x000000007EE40000-0x000000007EE50000-memory.dmp

                          Filesize

                          64KB

                        • memory/3780-200-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3780-201-0x00000000030B0000-0x00000000030C0000-memory.dmp

                          Filesize

                          64KB

                        • memory/3780-213-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3852-290-0x0000000004A90000-0x0000000004B2C000-memory.dmp

                          Filesize

                          624KB

                        • memory/3852-298-0x0000000004D70000-0x0000000004D80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3852-301-0x0000000004D70000-0x0000000004D80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3852-296-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3852-295-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

                          Filesize

                          40KB

                        • memory/3852-292-0x0000000004D70000-0x0000000004D80000-memory.dmp

                          Filesize

                          64KB

                        • memory/3852-291-0x0000000004BD0000-0x0000000004C62000-memory.dmp

                          Filesize

                          584KB

                        • memory/3852-289-0x00000000747A0000-0x0000000074F50000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3852-288-0x0000000000540000-0x00000000006F6000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/4532-151-0x0000000005090000-0x00000000050F6000-memory.dmp

                          Filesize

                          408KB

                        • memory/4532-149-0x0000000005250000-0x0000000005878000-memory.dmp

                          Filesize

                          6.2MB

                        • memory/4532-146-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4532-166-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4532-147-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4532-148-0x0000000002670000-0x00000000026A6000-memory.dmp

                          Filesize

                          216KB

                        • memory/4532-163-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4532-150-0x0000000004FF0000-0x0000000005012000-memory.dmp

                          Filesize

                          136KB

                        • memory/4532-157-0x0000000005980000-0x00000000059E6000-memory.dmp

                          Filesize

                          408KB

                        • memory/4532-162-0x0000000006030000-0x000000000604E000-memory.dmp

                          Filesize

                          120KB

                        • memory/4616-172-0x00000000050A0000-0x00000000050B0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4616-183-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4616-168-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4616-169-0x00000000050A0000-0x00000000050B0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4616-181-0x00000000050A0000-0x00000000050B0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4688-229-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4688-215-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4688-214-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4688-228-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4688-216-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4840-186-0x0000000004E30000-0x0000000004E40000-memory.dmp

                          Filesize

                          64KB

                        • memory/4840-198-0x0000000004E30000-0x0000000004E40000-memory.dmp

                          Filesize

                          64KB

                        • memory/4840-199-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4840-184-0x0000000074870000-0x0000000075020000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4840-185-0x0000000004E30000-0x0000000004E40000-memory.dmp

                          Filesize

                          64KB