Analysis

  • max time kernel
    132s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2023 22:15

General

  • Target

    15cba76812a5b7bc6da2a63484e8e95868a5060345c2844f69f40be2befc473b.exe

  • Size

    1.4MB

  • MD5

    77d77db6a2a5c89fddefe5ecae9eec43

  • SHA1

    c1461215a19ebfab63d6c1a07c57c1778a6d64e8

  • SHA256

    15cba76812a5b7bc6da2a63484e8e95868a5060345c2844f69f40be2befc473b

  • SHA512

    eb8b78a877e5fa873d69599fd5f51f378f5deaeee99dcfec5471591d21955d8c0a8b7ad64197564fae6e9834b2e5d3e88c9b32522c82adc4cecd77edf6f5c8ad

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15cba76812a5b7bc6da2a63484e8e95868a5060345c2844f69f40be2befc473b.exe
    "C:\Users\Admin\AppData\Local\Temp\15cba76812a5b7bc6da2a63484e8e95868a5060345c2844f69f40be2befc473b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:1788
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3408
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2000
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4588
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3736
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4372
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3196
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1880
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1648
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5016
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="BIHQJRXS" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1100
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
              5⤵
                PID:3332
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4144
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                5⤵
                  PID:4976
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 9
                    6⤵
                    • Runs ping.exe
                    PID:1456
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\Music\rot.exe"
                  5⤵
                    PID:1452
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 20
                      6⤵
                      • Runs ping.exe
                      PID:5092
                • C:\Windows\SysWOW64\attrib.exe
                  "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:2708
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                3⤵
                • Adds Run key to start application
                PID:3316
              • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                "ratt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:1636

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            245.3MB

            MD5

            0bdc6fda5666f79078fd1dca117b353c

            SHA1

            f0f5d0e346fd6185a5d989980205ae4d64a166a7

            SHA256

            1b8791c0ef47057277f5cc089db72b7ec3e91d69fbc076436509fb2ca9d10553

            SHA512

            f4aa9a8e2db84f3dcc4742dc82dd93dd9d56aa7d777c0fe78dc81642770dd946fc4954bd403ad30c20cc2caf0c0c908bfac07f1634c80864c605b4c7bc027467

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            1KB

            MD5

            33b19d75aa77114216dbc23f43b195e3

            SHA1

            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

            SHA256

            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

            SHA512

            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            51dd2e6c9c4ce75245ca7e08032b8053

            SHA1

            8c73756b2d1dced079ab9a1a6aebf1d4a2e20ec9

            SHA256

            e3f901835c8a4f77d7075a45d1c6edb08cb32c0289202274ccf3ba5999825555

            SHA512

            6dcfd2b525778e0a36ad9c6ca7f3b81d4fb44a55f012c6716c216bdc1afb28000d4460ecf4663212825166d473607f37971aeba2e655bb72172e43e61811cc6b

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            b1df7b0ce07178bc9ee120ed6deb92d6

            SHA1

            4dc77bb5cf2fdec8690e92cd707d285aa78c3989

            SHA256

            b5a76aa6b07e954e77d44c494d39c11e6fb97b3fcffe6c2db8eb18ae5743311a

            SHA512

            10807592f32bc37e4092f8bafed224d3724b2b550944f2195a9f49b09d69b61216a79f50748d46540d28e6ba291f190ae31f7e68bb3a0c65e11925da99b5c4b3

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            198dee52888167643ed6336f9e8a415c

            SHA1

            4ddc80ef5f8546885781f0448a19ffd4e34fa507

            SHA256

            f9cc0a4aede0208e4f9a2db4ada659545d78a19a91cf982d81a61c9238ec2367

            SHA512

            1f80dfdc9b6643fdbd47472c0056d14bc807d5e92d2b1175f50e71b1ac0fd856006ba5b1b0c7f9c665b7ecdb4ee1c6ff4046adde0893de56d5262250b58cf66c

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            b85d37f1f39d5784869c79766db27b5e

            SHA1

            8516bbb585e6171124db7ab6e0f2c802163fcc9e

            SHA256

            e4ce5699458ac0730020a480c1d074aa7f2735377284cd6d1c6b46867ddb1578

            SHA512

            efa93b28dc88ef7157464a52e599e03ace1b4d88d32b715a9b691705806a4cc0c559e439b34a40f0dae29a1db16b918fd44b9972d0af2f6052bd787d31788a01

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            38ef63f9ecd2bf94bfd7a08befee5e1d

            SHA1

            8a38dfe2de0563da96ef0fa1508c5be1c2ba8ded

            SHA256

            77175033ffcc06da28c5cca4f373ddb7bd6118f7a372bc6e4c3283e832c18da3

            SHA512

            70eb52143b65347f0afc93c0b4d54288b371b553de4fcfe09cf6c0f6a733f44e2484be084968939358fc92a7d66f85f01dddc4989a3dcc8f03420946f0352e77

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

            Filesize

            1KB

            MD5

            0df43097e0f0acd04d9e17fb43d618b9

            SHA1

            69b3ade12cb228393a93624e65f41604a17c83b6

            SHA256

            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

            SHA512

            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ce2egqag.cca.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

            Filesize

            693KB

            MD5

            7de6fdf3629c73bf0c29a96fa23ae055

            SHA1

            dcb37f6d43977601c6460b17387a89b9e4c0609a

            SHA256

            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

            SHA512

            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

            Filesize

            1KB

            MD5

            7ea1fec84d76294d9256ae3dca7676b2

            SHA1

            1e335451d1cbb6951bc77bf75430f4d983491342

            SHA256

            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

            SHA512

            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            106.2MB

            MD5

            743ddf94073684616974c6771436f6bd

            SHA1

            bb32d6fb13966b26b10dbbc58ed6bf28db0f8810

            SHA256

            44e18761be1277d6587946ad42fa400d402a3fb8068942d9661ab546cb6e8941

            SHA512

            74b2905308cfa012ae04e47509198407444f94e715869605ec9f47574090465bc29f7992a533408d6a2b3f7d9a6d7d341d001d55fef1a634f61b5c784869cf52

          • memory/1636-298-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/1636-297-0x0000000000CA0000-0x0000000000E56000-memory.dmp

            Filesize

            1.7MB

          • memory/1712-230-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/1712-216-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/1712-217-0x0000000002710000-0x0000000002720000-memory.dmp

            Filesize

            64KB

          • memory/1712-229-0x0000000002710000-0x0000000002720000-memory.dmp

            Filesize

            64KB

          • memory/2556-276-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/2556-275-0x00000000071E0000-0x0000000007276000-memory.dmp

            Filesize

            600KB

          • memory/2556-259-0x0000000002400000-0x0000000002410000-memory.dmp

            Filesize

            64KB

          • memory/2556-261-0x0000000070510000-0x000000007055C000-memory.dmp

            Filesize

            304KB

          • memory/2556-271-0x00000000061F0000-0x000000000620E000-memory.dmp

            Filesize

            120KB

          • memory/2556-272-0x0000000007580000-0x0000000007BFA000-memory.dmp

            Filesize

            6.5MB

          • memory/2556-246-0x0000000002400000-0x0000000002410000-memory.dmp

            Filesize

            64KB

          • memory/2556-273-0x0000000006F60000-0x0000000006F7A000-memory.dmp

            Filesize

            104KB

          • memory/2556-274-0x0000000004930000-0x000000000493A000-memory.dmp

            Filesize

            40KB

          • memory/2556-260-0x0000000006DE0000-0x0000000006E12000-memory.dmp

            Filesize

            200KB

          • memory/2556-284-0x00000000081B0000-0x0000000008754000-memory.dmp

            Filesize

            5.6MB

          • memory/2556-277-0x0000000002400000-0x0000000002410000-memory.dmp

            Filesize

            64KB

          • memory/2556-278-0x0000000007160000-0x000000000716E000-memory.dmp

            Filesize

            56KB

          • memory/2556-293-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/2556-279-0x0000000007280000-0x000000000729A000-memory.dmp

            Filesize

            104KB

          • memory/2556-280-0x00000000071B0000-0x00000000071B8000-memory.dmp

            Filesize

            32KB

          • memory/2556-281-0x0000000002400000-0x0000000002410000-memory.dmp

            Filesize

            64KB

          • memory/2556-247-0x0000000002400000-0x0000000002410000-memory.dmp

            Filesize

            64KB

          • memory/2556-283-0x00000000072F0000-0x0000000007312000-memory.dmp

            Filesize

            136KB

          • memory/2556-245-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/3196-237-0x0000000010000000-0x00000000100E2000-memory.dmp

            Filesize

            904KB

          • memory/3196-241-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/3196-233-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/3736-182-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

            Filesize

            64KB

          • memory/3736-171-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

            Filesize

            64KB

          • memory/3736-170-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

            Filesize

            64KB

          • memory/3736-169-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/3736-184-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/3904-213-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

            Filesize

            64KB

          • memory/3904-202-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

            Filesize

            64KB

          • memory/3904-200-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/3904-201-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

            Filesize

            64KB

          • memory/3904-215-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/4144-287-0x0000000000270000-0x0000000000426000-memory.dmp

            Filesize

            1.7MB

          • memory/4144-292-0x0000000005020000-0x0000000005030000-memory.dmp

            Filesize

            64KB

          • memory/4144-302-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4144-291-0x0000000004EA0000-0x0000000004F32000-memory.dmp

            Filesize

            584KB

          • memory/4144-288-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4144-300-0x0000000005020000-0x0000000005030000-memory.dmp

            Filesize

            64KB

          • memory/4144-289-0x0000000004E00000-0x0000000004E9C000-memory.dmp

            Filesize

            624KB

          • memory/4144-299-0x0000000005020000-0x0000000005030000-memory.dmp

            Filesize

            64KB

          • memory/4144-295-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4144-294-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

            Filesize

            40KB

          • memory/4372-198-0x0000000004780000-0x0000000004790000-memory.dmp

            Filesize

            64KB

          • memory/4372-199-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/4372-186-0x0000000004780000-0x0000000004790000-memory.dmp

            Filesize

            64KB

          • memory/4372-185-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/4588-163-0x00000000060A0000-0x00000000060BE000-memory.dmp

            Filesize

            120KB

          • memory/4588-149-0x0000000001050000-0x0000000001060000-memory.dmp

            Filesize

            64KB

          • memory/4588-150-0x00000000051F0000-0x0000000005818000-memory.dmp

            Filesize

            6.2MB

          • memory/4588-151-0x00000000050D0000-0x00000000050F2000-memory.dmp

            Filesize

            136KB

          • memory/4588-152-0x00000000059D0000-0x0000000005A36000-memory.dmp

            Filesize

            408KB

          • memory/4588-148-0x0000000001050000-0x0000000001060000-memory.dmp

            Filesize

            64KB

          • memory/4588-147-0x0000000002AB0000-0x0000000002AE6000-memory.dmp

            Filesize

            216KB

          • memory/4588-146-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB

          • memory/4588-153-0x0000000005A40000-0x0000000005AA6000-memory.dmp

            Filesize

            408KB

          • memory/4588-164-0x0000000001050000-0x0000000001060000-memory.dmp

            Filesize

            64KB

          • memory/4588-167-0x00000000747C0000-0x0000000074F70000-memory.dmp

            Filesize

            7.7MB