Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2023, 10:31

General

  • Target

    19f629eba202bc43a7f385ccf899f7671fb39a63815cdaab25df501f73f5d80e.exe

  • Size

    1.4MB

  • MD5

    09df25f88daf2a25e70bf4db665311a9

  • SHA1

    d7510231ab97feca5dd6edc5b69d938154176beb

  • SHA256

    19f629eba202bc43a7f385ccf899f7671fb39a63815cdaab25df501f73f5d80e

  • SHA512

    94232f2b2aafd5ae1c5be019adc90ca39adb9e38ed32bd047a70b8e15d5b8e75207bd284cf84b148d75ba8ba978ed86da2e2d663505710e11c88894ed3115916

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19f629eba202bc43a7f385ccf899f7671fb39a63815cdaab25df501f73f5d80e.exe
    "C:\Users\Admin\AppData\Local\Temp\19f629eba202bc43a7f385ccf899f7671fb39a63815cdaab25df501f73f5d80e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:4524
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3152
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4676
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1928
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:564
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1156
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3824
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3992
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2684
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3832
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:3552
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:3492
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4156
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="SMIJWJMH" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:240
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
              5⤵
                PID:4964
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
              "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:252
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                5⤵
                  PID:4232
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 8
                    6⤵
                    • Runs ping.exe
                    PID:4148
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                    6⤵
                    • Modifies WinLogon for persistence
                    PID:3520
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\Music\rot.exe"
                  5⤵
                    PID:3792
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 19
                      6⤵
                      • Runs ping.exe
                      PID:1704
                • C:\Windows\SysWOW64\attrib.exe
                  "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:1760
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                3⤵
                • Adds Run key to start application
                PID:4468
              • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                "ratt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3276

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            727.1MB

            MD5

            08a3626a0f8550e8ffc277ad75f94e9c

            SHA1

            58d7c18057a49bbd57648cf138337b118273980c

            SHA256

            244e5a79173acbbe436646619fb3e858e938b567a728f5af28424e96616e386a

            SHA512

            439db303837043dacae81cd32e8a4bbfaea270b584d89c36a5aa768310c625cf130eff8f40c1e4929d85885226c79b7a19ff157714ced9f533ac0bade524b630

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

            Filesize

            280.7MB

            MD5

            120a0dd76805e782f9cb84b6c97e9930

            SHA1

            0e7cd83d584806489e2e65b71bca1ec55abaecfc

            SHA256

            5bb384d271dbb967c6bab27592022457c8df3a99cc4e7ea25a8b94d390d90396

            SHA512

            a956dabfe47f87fc4fe1e8c88cada66e0cc0b8e4b9655a43d14d04fe8a24b9b7a990bc7331696efe347ebd8b0fdf767a8176ae6dcb21a76cdfa4c1b4052fc3a5

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            1KB

            MD5

            33b19d75aa77114216dbc23f43b195e3

            SHA1

            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

            SHA256

            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

            SHA512

            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            2269ab445e3c2d4cc5dcd4ef0aca2271

            SHA1

            bb9c37361bc40f623ea612654679bc07b91f1b93

            SHA256

            192cb0e0fe83bf2f838ef67d312fd99b2cdbe9cc16c66525f072f1c642176791

            SHA512

            1feaad89dace7205b2bffa4e98bd645266a12c509f9dfcb8d75b11fe51bb51a064f2dccc46442d5ba4554d8e40e5ae8f882c9fb53760e6bc024a0a0cc89a28de

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            55e4749e16e1103a46b3b590b31ba41d

            SHA1

            e533489fb5f5cb04bc19a2b0235fdb89fec4a593

            SHA256

            821f377e5dc1086c89e4f68c4829b35e272519195fabde6d3b2774c0c95ebc7d

            SHA512

            0d3e918928751e4945664a9b51c9ce9d324be28c3ab729ce7e314bb7a1f0e8ab8528e8f1b1077a2af621863a7fbb57c31cf6435eb13f239e58839420f66dc4b1

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            55d7aaa7fa96c70a1746fe0eb24cb8ed

            SHA1

            fb452ec0165ffb11e9f1127332be7629ad422993

            SHA256

            7ee8889ad7c93771ee18f1122c547307e7b64ae9cd06a06370ea51891b409470

            SHA512

            1ab1929f84170f578ef0c0e447f15a94822c73c389263c41878cad4c51965f61e7733b7e75b23175474576510d0a9b42c94ea816237aedea1029608f66c9ca68

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            b83c2fe93139b995a1729d4d9c3b5038

            SHA1

            2247cf63000e75aef38c0287374a9a0a6ff1b458

            SHA256

            f611dcd1b9a925d2bb109309cd0fb12bb3b5134c4571fc93b861d04d98d319d1

            SHA512

            e3b90c31899c016249254f3ba8632dea03e0a179c386885935bf6764107762bfe20eed63f515292c2f8891314683bf8f740e2478acef03e2a751d56e3ab95198

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            11KB

            MD5

            fa7a81e8772348233e368749b0520fee

            SHA1

            186652fd047cdd0863830d13e4313b0271dc7ae2

            SHA256

            f49282cb7c5884acc575390361ab05d34051fbf55bf776512c8f68d34f7fa1ec

            SHA512

            a4c855f8efe89038f1e96e19339bb46ef3d51d3fc5d25b919ae342c9f16c8b68bad2a38c6c788c613d13b0d0820275bdd7d633ffe9e507529fb9da69b475b488

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.dll

            Filesize

            328KB

            MD5

            15bbbe562f9be3e5dcbb834e635cc231

            SHA1

            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

            SHA256

            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

            SHA512

            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\7z.exe

            Filesize

            71KB

            MD5

            8ba2e41b330ae9356e62eb63514cf82e

            SHA1

            8dc266467a5a0d587ed0181d4344581ef4ff30b2

            SHA256

            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

            SHA512

            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

            Filesize

            1KB

            MD5

            0df43097e0f0acd04d9e17fb43d618b9

            SHA1

            69b3ade12cb228393a93624e65f41604a17c83b6

            SHA256

            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

            SHA512

            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzv24pr1.snx.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

            Filesize

            693KB

            MD5

            7de6fdf3629c73bf0c29a96fa23ae055

            SHA1

            dcb37f6d43977601c6460b17387a89b9e4c0609a

            SHA256

            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

            SHA512

            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

            Filesize

            1KB

            MD5

            7ea1fec84d76294d9256ae3dca7676b2

            SHA1

            1e335451d1cbb6951bc77bf75430f4d983491342

            SHA256

            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

            SHA512

            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            745.1MB

            MD5

            be788bb3680cf3809d9678ee6f7ba321

            SHA1

            499f01d5f654f83e172004dcc03f99abdd251734

            SHA256

            03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

            SHA512

            83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

            Filesize

            256.0MB

            MD5

            49cca944e0915a93e7b1d9ac693f5b21

            SHA1

            8c634faaf0f46671a3eb772342fe3b1d2d549a7d

            SHA256

            92716fd2aaec444fbf7d2b87f2b59189e363e91b24fbfb2f10320e8e02ae0b58

            SHA512

            8123a1b1a3a101b0e27d969c467edaf0c469159dc125fc9c05087885492e1a893d342f07e29e0f5818b12892417db915448e61fc8076932b0699bcef0f06ecb2

          • memory/252-166-0x00000000000E0000-0x0000000000296000-memory.dmp

            Filesize

            1.7MB

          • memory/252-165-0x00000000747D0000-0x0000000074F80000-memory.dmp

            Filesize

            7.7MB

          • memory/252-167-0x0000000004B90000-0x0000000004C2C000-memory.dmp

            Filesize

            624KB

          • memory/564-52-0x0000000002540000-0x0000000002550000-memory.dmp

            Filesize

            64KB

          • memory/564-49-0x0000000002540000-0x0000000002550000-memory.dmp

            Filesize

            64KB

          • memory/564-53-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/564-37-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/564-48-0x0000000005610000-0x0000000005964000-memory.dmp

            Filesize

            3.3MB

          • memory/564-47-0x0000000002540000-0x0000000002550000-memory.dmp

            Filesize

            64KB

          • memory/1156-54-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/1156-66-0x0000000004960000-0x0000000004970000-memory.dmp

            Filesize

            64KB

          • memory/1156-68-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/1156-55-0x0000000004960000-0x0000000004970000-memory.dmp

            Filesize

            64KB

          • memory/1928-32-0x0000000002D40000-0x0000000002D50000-memory.dmp

            Filesize

            64KB

          • memory/1928-29-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

            Filesize

            3.3MB

          • memory/1928-15-0x0000000002B20000-0x0000000002B56000-memory.dmp

            Filesize

            216KB

          • memory/1928-14-0x0000000002D40000-0x0000000002D50000-memory.dmp

            Filesize

            64KB

          • memory/1928-16-0x00000000053A0000-0x00000000059C8000-memory.dmp

            Filesize

            6.2MB

          • memory/1928-19-0x0000000005B00000-0x0000000005B66000-memory.dmp

            Filesize

            408KB

          • memory/1928-17-0x0000000005160000-0x0000000005182000-memory.dmp

            Filesize

            136KB

          • memory/1928-18-0x0000000005300000-0x0000000005366000-memory.dmp

            Filesize

            408KB

          • memory/1928-30-0x0000000006140000-0x000000000615E000-memory.dmp

            Filesize

            120KB

          • memory/1928-31-0x0000000006170000-0x00000000061BC000-memory.dmp

            Filesize

            304KB

          • memory/1928-13-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/1928-35-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/2684-107-0x0000000010000000-0x00000000100E2000-memory.dmp

            Filesize

            904KB

          • memory/2684-103-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/2684-111-0x0000000000400000-0x0000000000432000-memory.dmp

            Filesize

            200KB

          • memory/3824-70-0x0000000005430000-0x0000000005440000-memory.dmp

            Filesize

            64KB

          • memory/3824-80-0x00000000062F0000-0x0000000006644000-memory.dmp

            Filesize

            3.3MB

          • memory/3824-69-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/3824-83-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/3832-152-0x0000000007AD0000-0x0000000007AE1000-memory.dmp

            Filesize

            68KB

          • memory/3832-115-0x00000000747D0000-0x0000000074F80000-memory.dmp

            Filesize

            7.7MB

          • memory/3832-117-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-129-0x00000000067B0000-0x00000000067FC000-memory.dmp

            Filesize

            304KB

          • memory/3832-116-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-131-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-133-0x0000000006B90000-0x0000000006BC2000-memory.dmp

            Filesize

            200KB

          • memory/3832-132-0x000000007FA70000-0x000000007FA80000-memory.dmp

            Filesize

            64KB

          • memory/3832-134-0x00000000705F0000-0x000000007063C000-memory.dmp

            Filesize

            304KB

          • memory/3832-144-0x0000000006B70000-0x0000000006B8E000-memory.dmp

            Filesize

            120KB

          • memory/3832-145-0x0000000007860000-0x0000000007903000-memory.dmp

            Filesize

            652KB

          • memory/3832-146-0x0000000007F90000-0x000000000860A000-memory.dmp

            Filesize

            6.5MB

          • memory/3832-147-0x0000000006C90000-0x0000000006CAA000-memory.dmp

            Filesize

            104KB

          • memory/3832-148-0x0000000007940000-0x000000000794A000-memory.dmp

            Filesize

            40KB

          • memory/3832-149-0x00000000747D0000-0x0000000074F80000-memory.dmp

            Filesize

            7.7MB

          • memory/3832-150-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-151-0x0000000007B70000-0x0000000007C06000-memory.dmp

            Filesize

            600KB

          • memory/3832-127-0x0000000005FA0000-0x00000000062F4000-memory.dmp

            Filesize

            3.3MB

          • memory/3832-153-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-154-0x0000000007AF0000-0x0000000007AFE000-memory.dmp

            Filesize

            56KB

          • memory/3832-155-0x0000000007B00000-0x0000000007B14000-memory.dmp

            Filesize

            80KB

          • memory/3832-156-0x00000000051E0000-0x00000000051F0000-memory.dmp

            Filesize

            64KB

          • memory/3832-157-0x0000000007C10000-0x0000000007C2A000-memory.dmp

            Filesize

            104KB

          • memory/3832-158-0x0000000007B40000-0x0000000007B48000-memory.dmp

            Filesize

            32KB

          • memory/3832-159-0x000000007FA70000-0x000000007FA80000-memory.dmp

            Filesize

            64KB

          • memory/3832-161-0x0000000007C50000-0x0000000007C72000-memory.dmp

            Filesize

            136KB

          • memory/3832-162-0x0000000008BC0000-0x0000000009164000-memory.dmp

            Filesize

            5.6MB

          • memory/3992-100-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB

          • memory/3992-98-0x00000000030D0000-0x00000000030E0000-memory.dmp

            Filesize

            64KB

          • memory/3992-96-0x0000000005E60000-0x00000000061B4000-memory.dmp

            Filesize

            3.3MB

          • memory/3992-91-0x00000000030D0000-0x00000000030E0000-memory.dmp

            Filesize

            64KB

          • memory/3992-85-0x00000000030D0000-0x00000000030E0000-memory.dmp

            Filesize

            64KB

          • memory/3992-84-0x00000000748A0000-0x0000000075050000-memory.dmp

            Filesize

            7.7MB