Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2023, 10:48

General

  • Target

    dcbbadb9460751f4a7684af8b8bb8c78f3327b066445100d277af5c01f184f4eexe_JC.exe

  • Size

    1.4MB

  • MD5

    d033f99723109ae7a00f9861bfea7e8b

  • SHA1

    b6dbb1d6654ec62fa1925f8ca3ea9b73bfbe5746

  • SHA256

    dcbbadb9460751f4a7684af8b8bb8c78f3327b066445100d277af5c01f184f4e

  • SHA512

    13fd16b656d7dcd2f8027b082084fb4d0bb7f5f924c1db8bd027664a2cce26f20f2b41a6c2b5924a78a2641f1cacfa67e7998797b2b57836d1a1e5cc517eb91e

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcbbadb9460751f4a7684af8b8bb8c78f3327b066445100d277af5c01f184f4eexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\dcbbadb9460751f4a7684af8b8bb8c78f3327b066445100d277af5c01f184f4eexe_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:4504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4952
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3696
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1868
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2676
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:3080
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:976
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="GBSDSUCH" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:752
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
              5⤵
                PID:3212
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3352
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                5⤵
                  PID:1352
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 10
                    6⤵
                    • Runs ping.exe
                    PID:4412
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"
                  5⤵
                    PID:4052
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 14
                      6⤵
                      • Runs ping.exe
                      PID:928
                • C:\Windows\SysWOW64\attrib.exe
                  "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:2036
              • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                "ratt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3712
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                3⤵
                • Adds Run key to start application
                PID:4180

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                  Filesize

                  745.1MB

                  MD5

                  be788bb3680cf3809d9678ee6f7ba321

                  SHA1

                  499f01d5f654f83e172004dcc03f99abdd251734

                  SHA256

                  03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

                  SHA512

                  83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                  Filesize

                  139.8MB

                  MD5

                  aecd10b110094872fbff2e05d394908a

                  SHA1

                  83d20ce6bf3a399343e13c4acd489522ba20fc48

                  SHA256

                  34ee99cda8dcf25daa8e162534387f09cac1afe623ccf50bc23284dcd338df83

                  SHA512

                  b71ec67c7268e43ce39938d30a84e3ef6a50573294bf4c11482d94d1dede44cda4cce5562bca826d114cabf25fe84d9494e0fe893cafafca35e89b0843694782

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  1KB

                  MD5

                  33b19d75aa77114216dbc23f43b195e3

                  SHA1

                  36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                  SHA256

                  b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                  SHA512

                  676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  11KB

                  MD5

                  7f47597f8c56f9f1817b62e5cb07c6b3

                  SHA1

                  4d579608f2819b6cd69d7cf8fc7c7f871e24cd7b

                  SHA256

                  49cc22044b69c2d9aa4f394f3d36aba6c4cb84884c247d591958560836143342

                  SHA512

                  d59b1e35d3631890c6e9634d66fb671e3767b0c6c8b5f75b5b380798aaf32dc4ed0975bc77320fdab37b5578c2a072484201de06966e2d35abed810796f2ef07

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  11KB

                  MD5

                  d8ab5ad7c01a2fad9aff7acf9da569ba

                  SHA1

                  d65740afaf3f039816bb4e779c78d89ae444b733

                  SHA256

                  cc50e69d0160d360a22da067899645203dcfebfa1a750a384f756952cae7e06f

                  SHA512

                  933ad6066e02646529ebf7a418618617fb7289e8f69c4dbc0d4230a5ca586ff0d486ba329293378a5b9e00f5df593f5fccf5c67856a3b03b1e0c744183763d02

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  11KB

                  MD5

                  65935cc0478c6ad35a453f32cc1af726

                  SHA1

                  6e03bd26b290c29d452a38226363f097f9809586

                  SHA256

                  ec5e8308f8936bb0e5c029a224376909547aabd3acdd647dc0860560be1e0dbc

                  SHA512

                  f1bcc23969145925e669eaf24cb51f3b4c5ef422cb58d5d765acffd22682e65eddf931d569f145a560bd22b7e4bd86b215df761f31daffa932bd8b986f934517

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  11KB

                  MD5

                  e70bdfd2b2201b25fc3302f94fb9ea25

                  SHA1

                  9c885a228a5c4908988e275b89ad3e4ad941c26f

                  SHA256

                  c80c99ef94b93aea7695a574d6f7390c909e0d09ddfda9cc53e56c7185a087bd

                  SHA512

                  f0f6a045dd9091afec32e32586b9c34435e19c8cc7e06078d7b58b5df9fa0d126b5e703c2aaf39f9f76a1c3f29366796e8a81488ba6a9b315be1a604835077bb

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  11KB

                  MD5

                  f96349304a8b44a0dc75a33568896c02

                  SHA1

                  97253fb24c1b89a28cb956d28f00fff771ad168f

                  SHA256

                  9f7f02aac250422dc64ff96c9e67338e6a31f296ef98d67b3701c358f180f8fd

                  SHA512

                  46bf330f5e49ed6c97a7fa109f327eac9b16ac12536ca900495de188066a311bb7227fcc8fa48d348e5e564fb21c57f5344107c52637b4e2b0c9c3b7b04a4d1a

                • C:\Users\Admin\AppData\Local\Temp\7z.dll

                  Filesize

                  328KB

                  MD5

                  15bbbe562f9be3e5dcbb834e635cc231

                  SHA1

                  7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                  SHA256

                  ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                  SHA512

                  769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                • C:\Users\Admin\AppData\Local\Temp\7z.dll

                  Filesize

                  328KB

                  MD5

                  15bbbe562f9be3e5dcbb834e635cc231

                  SHA1

                  7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                  SHA256

                  ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                  SHA512

                  769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                • C:\Users\Admin\AppData\Local\Temp\7z.exe

                  Filesize

                  71KB

                  MD5

                  8ba2e41b330ae9356e62eb63514cf82e

                  SHA1

                  8dc266467a5a0d587ed0181d4344581ef4ff30b2

                  SHA256

                  ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                  SHA512

                  2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                • C:\Users\Admin\AppData\Local\Temp\7z.exe

                  Filesize

                  71KB

                  MD5

                  8ba2e41b330ae9356e62eb63514cf82e

                  SHA1

                  8dc266467a5a0d587ed0181d4344581ef4ff30b2

                  SHA256

                  ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                  SHA512

                  2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                  Filesize

                  1KB

                  MD5

                  0df43097e0f0acd04d9e17fb43d618b9

                  SHA1

                  69b3ade12cb228393a93624e65f41604a17c83b6

                  SHA256

                  c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                  SHA512

                  01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t4h2m0ey.cpf.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                  Filesize

                  693KB

                  MD5

                  7de6fdf3629c73bf0c29a96fa23ae055

                  SHA1

                  dcb37f6d43977601c6460b17387a89b9e4c0609a

                  SHA256

                  069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                  SHA512

                  d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                  Filesize

                  1KB

                  MD5

                  7ea1fec84d76294d9256ae3dca7676b2

                  SHA1

                  1e335451d1cbb6951bc77bf75430f4d983491342

                  SHA256

                  9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                  SHA512

                  ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                  Filesize

                  745.1MB

                  MD5

                  be788bb3680cf3809d9678ee6f7ba321

                  SHA1

                  499f01d5f654f83e172004dcc03f99abdd251734

                  SHA256

                  03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

                  SHA512

                  83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

                • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                  Filesize

                  76.5MB

                  MD5

                  297fbdd6436b9790b1e5201324a2acb5

                  SHA1

                  ac0b0e3df853bde73950d0704b0008c0a5e3093a

                  SHA256

                  14897e1b43d27fd8fd67ad154a0d0e136aeb8ca0bc66ab18f34d96ba2db553b7

                  SHA512

                  cd138b4c25bbc8d2036ef6879abd4e020cd39f0373b21d390f3d0763faf519c2c236166aa6bc759a9865270929356bdb487f6cf1b455c7e73bb6516852efe438

                • memory/1868-148-0x0000000000E80000-0x0000000000EB6000-memory.dmp

                  Filesize

                  216KB

                • memory/1868-147-0x0000000000F00000-0x0000000000F10000-memory.dmp

                  Filesize

                  64KB

                • memory/1868-162-0x0000000006040000-0x000000000605E000-memory.dmp

                  Filesize

                  120KB

                • memory/1868-146-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1868-163-0x0000000000F00000-0x0000000000F10000-memory.dmp

                  Filesize

                  64KB

                • memory/1868-157-0x0000000005270000-0x00000000052D6000-memory.dmp

                  Filesize

                  408KB

                • memory/1868-166-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1868-149-0x0000000005330000-0x0000000005958000-memory.dmp

                  Filesize

                  6.2MB

                • memory/1868-151-0x0000000005110000-0x0000000005176000-memory.dmp

                  Filesize

                  408KB

                • memory/1868-150-0x0000000005070000-0x0000000005092000-memory.dmp

                  Filesize

                  136KB

                • memory/2276-208-0x0000000002770000-0x0000000002780000-memory.dmp

                  Filesize

                  64KB

                • memory/2276-210-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2276-196-0x0000000002770000-0x0000000002780000-memory.dmp

                  Filesize

                  64KB

                • memory/2276-197-0x0000000002770000-0x0000000002780000-memory.dmp

                  Filesize

                  64KB

                • memory/2276-195-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2388-194-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2388-182-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2580-241-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2580-276-0x00000000070B0000-0x00000000070CA000-memory.dmp

                  Filesize

                  104KB

                • memory/2580-290-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2580-281-0x0000000007FF0000-0x0000000008594000-memory.dmp

                  Filesize

                  5.6MB

                • memory/2580-280-0x0000000007120000-0x0000000007142000-memory.dmp

                  Filesize

                  136KB

                • memory/2580-278-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-277-0x0000000006FE0000-0x0000000006FE8000-memory.dmp

                  Filesize

                  32KB

                • memory/2580-242-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-243-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-275-0x0000000006F90000-0x0000000006F9E000-memory.dmp

                  Filesize

                  56KB

                • memory/2580-274-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-255-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-256-0x0000000006060000-0x0000000006092000-memory.dmp

                  Filesize

                  200KB

                • memory/2580-257-0x0000000070700000-0x000000007074C000-memory.dmp

                  Filesize

                  304KB

                • memory/2580-267-0x0000000005FF0000-0x000000000600E000-memory.dmp

                  Filesize

                  120KB

                • memory/2580-268-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2580-269-0x00000000073C0000-0x0000000007A3A000-memory.dmp

                  Filesize

                  6.5MB

                • memory/2580-270-0x0000000004790000-0x00000000047AA000-memory.dmp

                  Filesize

                  104KB

                • memory/2580-271-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

                  Filesize

                  40KB

                • memory/2580-272-0x00000000020F0000-0x0000000002100000-memory.dmp

                  Filesize

                  64KB

                • memory/2580-273-0x0000000007010000-0x00000000070A6000-memory.dmp

                  Filesize

                  600KB

                • memory/2676-229-0x0000000000400000-0x0000000000432000-memory.dmp

                  Filesize

                  200KB

                • memory/2676-237-0x0000000000400000-0x0000000000432000-memory.dmp

                  Filesize

                  200KB

                • memory/2676-233-0x0000000010000000-0x00000000100E2000-memory.dmp

                  Filesize

                  904KB

                • memory/2696-211-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2696-213-0x0000000003230000-0x0000000003240000-memory.dmp

                  Filesize

                  64KB

                • memory/2696-212-0x0000000003230000-0x0000000003240000-memory.dmp

                  Filesize

                  64KB

                • memory/2696-224-0x0000000003230000-0x0000000003240000-memory.dmp

                  Filesize

                  64KB

                • memory/2696-226-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3352-287-0x0000000005470000-0x0000000005502000-memory.dmp

                  Filesize

                  584KB

                • memory/3352-294-0x00000000056C0000-0x00000000056D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3352-284-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3352-286-0x00000000052E0000-0x000000000537C000-memory.dmp

                  Filesize

                  624KB

                • memory/3352-300-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3352-288-0x00000000056C0000-0x00000000056D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3352-298-0x00000000056C0000-0x00000000056D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3352-291-0x0000000005420000-0x000000000542A000-memory.dmp

                  Filesize

                  40KB

                • memory/3352-292-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3352-285-0x0000000000470000-0x0000000000626000-memory.dmp

                  Filesize

                  1.7MB

                • memory/3712-295-0x00000000748E0000-0x0000000075090000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3712-296-0x0000000000F80000-0x0000000001136000-memory.dmp

                  Filesize

                  1.7MB

                • memory/3712-297-0x0000000005110000-0x0000000005120000-memory.dmp

                  Filesize

                  64KB

                • memory/4392-168-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4392-181-0x00000000749B0000-0x0000000075160000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4392-179-0x0000000004870000-0x0000000004880000-memory.dmp

                  Filesize

                  64KB