Resubmissions

09-04-2024 13:06

240409-qcaa3aba2z 10

09-04-2024 13:06

240409-qb91asba2y 10

09-04-2024 13:06

240409-qb9drsba2x 10

09-04-2024 13:06

240409-qb831afg26 10

28-08-2023 01:00

230828-bcmttsgb4v 10

Analysis

  • max time kernel
    1199s
  • max time network
    1208s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-04-2024 13:06

General

  • Target

    06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe

  • Size

    7.8MB

  • MD5

    03b9dd8b1e16ad5c2a605ad6b18493a7

  • SHA1

    725f4473d8e09a8a9fcad2e8900dfb74623d4f18

  • SHA256

    06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3

  • SHA512

    8c5c077bd7575483b3601221b77e5b49b9acb7181fe73173dd5879cd19b6d517b5f2454390884ea87490da72cb2e37b5d476132f96415a68b209ce740c7b1c4f

  • SSDEEP

    196608:LIRcbH4jSteTGvwxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuwxwZ6v1CPwDv3uFteg2EeJUO9E

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe
    "C:\Users\Admin\AppData\Local\Temp\06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:228
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2520
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3912
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3600
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:196
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3500
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4900
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4284
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2040
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4536
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4980
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3200
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4368
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:5012
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2748
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1720
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4572
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3344
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:64
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4376
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:168
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4984
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2100
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2728
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4660
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3656
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:924
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4376
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3492
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4144
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1556
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2940
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1848
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:60
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1044
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2492
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4556
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2152
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:608
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:664
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4448
    • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\cached-certs

    Filesize

    20KB

    MD5

    3c13019dd69db94af7e37991e2e82f85

    SHA1

    d5535a7d04270b3277d91902e457b3d394e06501

    SHA256

    fffeda7f690238d4e867af8463d46877ddd78483d42697adacf3e54af79d3d3f

    SHA512

    76effd0947865baca4ed30dfc80f7d904a0969a26df9fc2c82f29b726fe76d1ee7cca986f1c26eb133b726cbba12610d54f5e604deeabf8266295db9a2173e13

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\cached-microdesc-consensus.tmp

    Filesize

    2.6MB

    MD5

    cc74fe855429ddc5afd0492c81a99ed3

    SHA1

    9f01e7f41fe661b9d0ea01b5618d3ca142e0e9c8

    SHA256

    d4244a317932d44c7cdc64bf716a1452c61bfafd28b8ab0fa85fb785725e8dbc

    SHA512

    4a11e0b81b9714e42841ff7744a1baedc8396589cd275ce0627502c5e9582ecdb279602325c01a07616d5d1e4c635ae9aa12353e3273c310e735c480a3f9c442

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\cached-microdescs

    Filesize

    20.4MB

    MD5

    d79129b9e6566a8d124f10ce10241aca

    SHA1

    691ab46fadcaf38fc8b41ed1c0b70fa57db4e8b9

    SHA256

    41d9866514f4475d3cf902b963ca9113eca3985b670d6dff6a679a2b2ba0d65c

    SHA512

    031a5bb6de8aefe309d702e26ef0c72a1c63bf318477eb290808f2ae6797dc3670fd21eb7f57c9471ad114483d575a718ab1da5c4ff23a1376524f793bb84e0b

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\cached-microdescs.new

    Filesize

    20.4MB

    MD5

    acea973d458033eaabafb7e8efcfe103

    SHA1

    f61dd33037b46884ea89ce04edd7fcffdbac8fee

    SHA256

    0d6bef241220cb2ab2439ec4a075e129c5c77d14a18b102c9da4c0fcd73a858a

    SHA512

    577132cf8cb2dfb8da05c5c35a431b051ce38bdfc4a6f0e730af97fb2d889551e28b1a166d5a36d794e729377892b0f96c14e8a1dfb0797173b092a41c8d94eb

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\cached-microdescs.new

    Filesize

    11.9MB

    MD5

    fa03d396c9ef10d524cd197e75bde28d

    SHA1

    284be10e2cafb91c75611e23494c8e08e4900387

    SHA256

    39ac6994b2d6ee1b21e5087f7d3104dc6fbab8698f61d884219f847b88e3654b

    SHA512

    33a15c40bf086eaaa0d31f9318ce88cb3385893e8abfe43482bdd9c64004f9d55c390aa5d9baf081705e2b93eae58fb103f7472a80f9d72c520961ab8a632411

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\state

    Filesize

    232B

    MD5

    f031121f486ba08a353b9903ca1f9973

    SHA1

    ab86d7d11b963284e0125f43f83f62f15c418cca

    SHA256

    b671a150b8c6d57ecd77e4be6e53a490cfc009dbda823816b3ac159e7c6ca923

    SHA512

    7e63a7a88c0594d9463bbd67444f17fa8bcf9553537bf391bfb79cec79d100c50e2eb00d63e165b78dbfed95fa950eb04f6b1c41954415eaf11c1b060a6d519f

  • C:\Users\Admin\AppData\Local\951497bb\tor\data\state

    Filesize

    3KB

    MD5

    1df72262759362891cb870e2cde9be99

    SHA1

    260572dc48637fb537027d7ad5b165070481d2ea

    SHA256

    554be7634390d666148df6b6e4b797a7486af8b7ef5bee020b4512a1545e7d91

    SHA512

    62d44f3b9fd2071e1a87e1c230a144a2ca3b21b72b3a36ef13872276026001ca8cd397aa85b114facfc13b7f3adb01dbe844b058997c4650295df4199c190a3d

  • C:\Users\Admin\AppData\Local\951497bb\tor\dllhost.exe

    Filesize

    973KB

    MD5

    5cfe61ff895c7daa889708665ef05d7b

    SHA1

    5e58efe30406243fbd58d4968b0492ddeef145f2

    SHA256

    f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

    SHA512

    43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

  • C:\Users\Admin\AppData\Local\951497bb\tor\libcrypto-1_1.dll

    Filesize

    1.7MB

    MD5

    2384a02c4a1f7ec481adde3a020607d3

    SHA1

    7e848d35a10bf9296c8fa41956a3daa777f86365

    SHA256

    c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

    SHA512

    1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

  • C:\Users\Admin\AppData\Local\951497bb\tor\libssp-0.dll

    Filesize

    88KB

    MD5

    2c916456f503075f746c6ea649cf9539

    SHA1

    fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

    SHA256

    cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

    SHA512

    1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

  • C:\Users\Admin\AppData\Local\951497bb\tor\libwinpthread-1.dll

    Filesize

    188KB

    MD5

    d407cc6d79a08039a6f4b50539e560b8

    SHA1

    21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

    SHA256

    92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

    SHA512

    378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

  • C:\Users\Admin\AppData\Local\951497bb\tor\torrc

    Filesize

    157B

    MD5

    0abc0c2c50e17f9ae5c8ab3245eb656b

    SHA1

    079865f62cef9dd3577f1b16e5a33411e38bbc7a

    SHA256

    eee8bdeac9340fd17d498eced366348b65e9da7176aaa5614cdb7f5fa34394ea

    SHA512

    9adf325f4bd495e93a380e5dda2f08cbdd2cb30045f669b3d3a979dce09c71f5a7677cff009f234bd14943f995b38d3675571fb56f201208b947df82130a9ddd

  • \Users\Admin\AppData\Local\951497bb\tor\libevent-2-1-6.dll

    Filesize

    366KB

    MD5

    099983c13bade9554a3c17484e5481f1

    SHA1

    a84e69ad9722f999252d59d0ed9a99901a60e564

    SHA256

    b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

    SHA512

    89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

  • \Users\Admin\AppData\Local\951497bb\tor\libgcc_s_sjlj-1.dll

    Filesize

    286KB

    MD5

    b0d98f7157d972190fe0759d4368d320

    SHA1

    5715a533621a2b642aad9616e603c6907d80efc4

    SHA256

    2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

    SHA512

    41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

  • \Users\Admin\AppData\Local\951497bb\tor\libssl-1_1.dll

    Filesize

    439KB

    MD5

    c88826ac4bb879622e43ead5bdb95aeb

    SHA1

    87d29853649a86f0463bfd9ad887b85eedc21723

    SHA256

    c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

    SHA512

    f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

  • \Users\Admin\AppData\Local\951497bb\tor\zlib1.dll

    Filesize

    52KB

    MD5

    add33041af894b67fe34e1dc819b7eb6

    SHA1

    6db46eb021855a587c95479422adcc774a272eeb

    SHA256

    8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

    SHA512

    bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

  • memory/196-284-0x0000000073AB0000-0x0000000073AD4000-memory.dmp

    Filesize

    144KB

  • memory/196-282-0x0000000073240000-0x000000007350F000-memory.dmp

    Filesize

    2.8MB

  • memory/196-281-0x0000000073AE0000-0x0000000073B29000-memory.dmp

    Filesize

    292KB

  • memory/196-318-0x0000000073240000-0x000000007350F000-memory.dmp

    Filesize

    2.8MB

  • memory/196-317-0x0000000073510000-0x00000000735D8000-memory.dmp

    Filesize

    800KB

  • memory/196-280-0x0000000073510000-0x00000000735D8000-memory.dmp

    Filesize

    800KB

  • memory/196-287-0x0000000072FD0000-0x000000007309E000-memory.dmp

    Filesize

    824KB

  • memory/196-286-0x0000000073130000-0x000000007323A000-memory.dmp

    Filesize

    1.0MB

  • memory/196-288-0x00000000730A0000-0x0000000073128000-memory.dmp

    Filesize

    544KB

  • memory/196-271-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/196-316-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-39-0x00000000016B0000-0x000000000197F000-memory.dmp

    Filesize

    2.8MB

  • memory/228-63-0x0000000072D20000-0x0000000072FEF000-memory.dmp

    Filesize

    2.8MB

  • memory/228-69-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-71-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-79-0x00000000016B0000-0x0000000001738000-memory.dmp

    Filesize

    544KB

  • memory/228-80-0x00000000016B0000-0x000000000197F000-memory.dmp

    Filesize

    2.8MB

  • memory/228-81-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-95-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-103-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-111-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-119-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-62-0x0000000072B50000-0x0000000072BD8000-memory.dmp

    Filesize

    544KB

  • memory/228-60-0x0000000072BE0000-0x0000000072CEA000-memory.dmp

    Filesize

    1.0MB

  • memory/228-58-0x0000000072FF0000-0x00000000730BE000-memory.dmp

    Filesize

    824KB

  • memory/228-55-0x0000000073110000-0x00000000731D8000-memory.dmp

    Filesize

    800KB

  • memory/228-53-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/228-20-0x0000000073110000-0x00000000731D8000-memory.dmp

    Filesize

    800KB

  • memory/228-147-0x00000000016B0000-0x0000000001738000-memory.dmp

    Filesize

    544KB

  • memory/228-26-0x0000000072FF0000-0x00000000730BE000-memory.dmp

    Filesize

    824KB

  • memory/228-36-0x00000000730C0000-0x0000000073109000-memory.dmp

    Filesize

    292KB

  • memory/228-38-0x0000000072D20000-0x0000000072FEF000-memory.dmp

    Filesize

    2.8MB

  • memory/228-37-0x0000000072CF0000-0x0000000072D14000-memory.dmp

    Filesize

    144KB

  • memory/228-35-0x00000000016B0000-0x0000000001738000-memory.dmp

    Filesize

    544KB

  • memory/228-33-0x0000000072B50000-0x0000000072BD8000-memory.dmp

    Filesize

    544KB

  • memory/228-31-0x0000000072BE0000-0x0000000072CEA000-memory.dmp

    Filesize

    1.0MB

  • memory/228-16-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/2520-146-0x0000000072D20000-0x0000000072FEF000-memory.dmp

    Filesize

    2.8MB

  • memory/2520-144-0x0000000072BE0000-0x0000000072CEA000-memory.dmp

    Filesize

    1.0MB

  • memory/2520-143-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/2520-131-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/2520-134-0x0000000072D20000-0x0000000072FEF000-memory.dmp

    Filesize

    2.8MB

  • memory/2520-135-0x0000000073110000-0x00000000731D8000-memory.dmp

    Filesize

    800KB

  • memory/2520-141-0x0000000072CF0000-0x0000000072D14000-memory.dmp

    Filesize

    144KB

  • memory/2520-140-0x00000000730C0000-0x0000000073109000-memory.dmp

    Filesize

    292KB

  • memory/2520-145-0x0000000072B50000-0x0000000072BD8000-memory.dmp

    Filesize

    544KB

  • memory/2520-139-0x0000000072FF0000-0x00000000730BE000-memory.dmp

    Filesize

    824KB

  • memory/2520-148-0x0000000073110000-0x00000000731D8000-memory.dmp

    Filesize

    800KB

  • memory/2520-149-0x0000000072FF0000-0x00000000730BE000-memory.dmp

    Filesize

    824KB

  • memory/2520-151-0x0000000072CF0000-0x0000000072D14000-memory.dmp

    Filesize

    144KB

  • memory/3500-348-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3600-252-0x0000000073AE0000-0x0000000073B29000-memory.dmp

    Filesize

    292KB

  • memory/3600-266-0x0000000073170000-0x000000007323E000-memory.dmp

    Filesize

    824KB

  • memory/3600-247-0x0000000073310000-0x00000000735DF000-memory.dmp

    Filesize

    2.8MB

  • memory/3600-245-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3600-250-0x0000000073240000-0x0000000073308000-memory.dmp

    Filesize

    800KB

  • memory/3600-251-0x0000000073170000-0x000000007323E000-memory.dmp

    Filesize

    824KB

  • memory/3600-254-0x0000000073AB0000-0x0000000073AD4000-memory.dmp

    Filesize

    144KB

  • memory/3600-267-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3600-256-0x0000000073060000-0x000000007316A000-memory.dmp

    Filesize

    1.0MB

  • memory/3600-257-0x0000000072FD0000-0x0000000073058000-memory.dmp

    Filesize

    544KB

  • memory/3600-264-0x0000000073310000-0x00000000735DF000-memory.dmp

    Filesize

    2.8MB

  • memory/3600-265-0x0000000073240000-0x0000000073308000-memory.dmp

    Filesize

    800KB

  • memory/3912-203-0x0000000073240000-0x0000000073308000-memory.dmp

    Filesize

    800KB

  • memory/3912-176-0x0000000072FD0000-0x0000000073058000-memory.dmp

    Filesize

    544KB

  • memory/3912-204-0x0000000073170000-0x000000007323E000-memory.dmp

    Filesize

    824KB

  • memory/3912-248-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3912-202-0x0000000073310000-0x00000000735DF000-memory.dmp

    Filesize

    2.8MB

  • memory/3912-201-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3912-168-0x0000000073170000-0x000000007323E000-memory.dmp

    Filesize

    824KB

  • memory/3912-165-0x00000000002D0000-0x00000000006D4000-memory.dmp

    Filesize

    4.0MB

  • memory/3912-170-0x0000000073AB0000-0x0000000073AD4000-memory.dmp

    Filesize

    144KB

  • memory/3912-166-0x0000000073310000-0x00000000735DF000-memory.dmp

    Filesize

    2.8MB

  • memory/3912-175-0x0000000073060000-0x000000007316A000-memory.dmp

    Filesize

    1.0MB

  • memory/3912-167-0x0000000073240000-0x0000000073308000-memory.dmp

    Filesize

    800KB

  • memory/3912-169-0x0000000073AE0000-0x0000000073B29000-memory.dmp

    Filesize

    292KB

  • memory/4544-307-0x0000000072D30000-0x0000000072D6A000-memory.dmp

    Filesize

    232KB

  • memory/4544-43-0x0000000072860000-0x000000007289A000-memory.dmp

    Filesize

    232KB

  • memory/4544-0-0x0000000073AF0000-0x0000000073B2A000-memory.dmp

    Filesize

    232KB

  • memory/4544-343-0x0000000073AF0000-0x0000000073B2A000-memory.dmp

    Filesize

    232KB

  • memory/4544-192-0x0000000072D30000-0x0000000072D6A000-memory.dmp

    Filesize

    232KB