Resubmissions

17-04-2024 14:47

240417-r6de9acg59 10

17-04-2024 14:47

240417-r6ctqaec2s 10

17-04-2024 14:47

240417-r6az5acg56 10

17-04-2024 14:47

240417-r6apcseb9z 10

17-04-2024 14:47

240417-r59gascg54 10

15-04-2024 13:15

240415-qhmtcahe7v 10

10-04-2024 08:18

240410-j7smkacd9y 10

10-04-2024 08:18

240410-j7r12ahc48 10

10-04-2024 08:18

240410-j7q4qshc46 10

10-04-2024 08:17

240410-j6pvaahc28 10

Analysis

  • max time kernel
    599s
  • max time network
    605s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 08:18

General

  • Target

    b960516dbba002bdd037ada7f1b06a5b.exe

  • Size

    7.2MB

  • MD5

    b960516dbba002bdd037ada7f1b06a5b

  • SHA1

    e1e1332833b253cb3a012a1ee98f73bab2a912d1

  • SHA256

    7e362d3f43b007df435a0f3ec47c3a84851b56c3ff77875399d94ae32783ad7a

  • SHA512

    cb026ef01582506af21a03c4894e91d46bafe21ab909c915dbb6bc5de78ce959c24cb538cc74efedac2698315100031df660969ae2052328b10db2ac9612c948

  • SSDEEP

    196608:WSiMHV9Zxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOfTV73c+:WSiMHV9ZxwZ6v1CPwDv3uFteg2EeJUOl

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 18 IoCs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: RenamesItself 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b960516dbba002bdd037ada7f1b06a5b.exe
    "C:\Users\Admin\AppData\Local\Temp\b960516dbba002bdd037ada7f1b06a5b.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2060
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2408
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4248
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5076
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4460
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1592
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1892
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4528
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4816
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4584
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4836
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:560
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1004
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2284
    • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe
      "C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4792
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4808
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4288 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:492
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4944
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:440

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-certs

          Filesize

          20KB

          MD5

          930f5334b1f47811208e1243790b27ff

          SHA1

          ffae7458f7ec078d31b331c301d7171e01070a3c

          SHA256

          414a957159d4a60eef17538a384c5446b68db43c3c243c9863f67923d87fe6ce

          SHA512

          d6e57457ecf0a9ba4b43d22bb5d9841d4999ba913ab4e964e4770cacfd951d3bab5df746f03d2b2ee05f241b19e487ddc9c461d9bb987318b12bac02bf3df8e0

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-certs

          Filesize

          15KB

          MD5

          eea50fb978db0873ac4292df86bcafc2

          SHA1

          dcc5f7cd641df62feb282f5595940269cd64068e

          SHA256

          e0fe9a9c07c00ec7f993e3d65ec5ec665bc42ff10df6a4a854eba68cc0081f77

          SHA512

          948ed90fe3acdffbe4ee2e1416741e5866def896e24ce45467857d1fed5a3ca64d8fd1d4f8828d5359854727ac9df82b3e9e6b6bc9a3d1dcafcf68105986805f

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-microdesc-consensus.tmp

          Filesize

          2.6MB

          MD5

          a173b8e93561a83eed397b44c6828c69

          SHA1

          bb13b10ce96fbdb08a3b8212d232e4ed487341e8

          SHA256

          f8164107078eca9924335d62d5422a51770591cf73eded6616b63cb6df62cb7e

          SHA512

          47ad20ee565a17547361f0d06a6ee9cc6b08df5f40255d24fcaa4bde041dff3986baf0ebd8192d7d95b826eb41638c766f7c4cd6a0cba616591ca1947b0f6f23

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-microdescs

          Filesize

          20.3MB

          MD5

          cc3fbe9892bfd72da3275f0486077f02

          SHA1

          587db5bc9b07ff7bce4e0de9d42ac2d3927c9244

          SHA256

          734bfc69c6455218b103edbfdddc4c6bebee225cff700fded0e707abff90e2eb

          SHA512

          98dbf5b2c16ffefcd6b36f675fba5d3451f9e773f6a67c1b31166506afabdf4e0f40161c22424a3c3324a09e99672225895fa67a72533a51a85432cf703af87d

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-microdescs.new

          Filesize

          8.1MB

          MD5

          3a8c349ca9aeb4a090183337096229c5

          SHA1

          c3ae7b57709b926464f776818936ca88ed592743

          SHA256

          563abe865526aa170f7987e74771e8849d2fe3adf3c0ceba1f8d36063f738f88

          SHA512

          5ffca60eb72f89389562d59a31c50ea029e7b81b175e38a0fa2c967baba5867cc6ad2b544818f4bf6787fa95c394aa3dae5deb0d4903ff918d78a61936477df0

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\cached-microdescs.new

          Filesize

          20.3MB

          MD5

          d1c8461a403356262875ed5ec2af1359

          SHA1

          adb83afe74a6037ce873400590cf1578bc42b7fe

          SHA256

          fff42922c4854851110da166b07c1998e0dc57e1467c327021f1d9e35faf2f9d

          SHA512

          e9b5a7df4fe6605d5982764989ffff9d3f3291800b1f1ff24570791d30bff2aeb553986ab52b1a8da53ed03abaef39ce83d55fdd7c6b473210a2e25199a154d9

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\state

          Filesize

          7KB

          MD5

          e03ccefdd06777afb8d0bf5d1977696b

          SHA1

          5b0ce3e9db4cb7d5637bcf7ed9456b032a26dba8

          SHA256

          34b7e0307616c3392136c2b110bceb44e4cdbb24fb4f9e79e0ebdfbd47ba35af

          SHA512

          0f7fa1a3c77c55a08048db70a4a4c675f5d817f8770d17a3f74bf306efc6360462b4feda111e9a33e35617bd89f029634398c5fc66f193a19d5df14e3f6ce477

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\state

          Filesize

          9KB

          MD5

          5c40f985732427ef759ede813d45eb4d

          SHA1

          d5e2c390edf93222e214e92e1aac49a8866e82c8

          SHA256

          6cfe0ce658f59126e7bd19b044a9af57ffb8466b9a84df78c3e4160c65cdfccd

          SHA512

          773515ab1dcf82206e4d366a080378b0c30369966288f9c50b948796b0ca03c9dfd9acc0839bafda8d42ed4df5e7b7c66a0bfd1012702cfdaca67fc83b939412

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\data\state

          Filesize

          232B

          MD5

          c6ae9f1da8f9e1515ea9840b92464bbb

          SHA1

          031285db69eef382cfd025bf99eb9146f7a99c15

          SHA256

          ff201722ade7dc60befab67401102890d5b6d1663fa42f68aa6b767421508e92

          SHA512

          040e610c98745f1ee3bfb2fa0701f7c6fa5fda4d4fb953546871625c27380c30c4dfc0e95c053a2a7828c0fde4133946b241955ba23a9e1893822f64cd4321b0

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libcrypto-1_1.dll

          Filesize

          1.7MB

          MD5

          2384a02c4a1f7ec481adde3a020607d3

          SHA1

          7e848d35a10bf9296c8fa41956a3daa777f86365

          SHA256

          c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

          SHA512

          1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libevent-2-1-6.dll

          Filesize

          366KB

          MD5

          099983c13bade9554a3c17484e5481f1

          SHA1

          a84e69ad9722f999252d59d0ed9a99901a60e564

          SHA256

          b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

          SHA512

          89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libgcc_s_sjlj-1.dll

          Filesize

          286KB

          MD5

          b0d98f7157d972190fe0759d4368d320

          SHA1

          5715a533621a2b642aad9616e603c6907d80efc4

          SHA256

          2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

          SHA512

          41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libssl-1_1.dll

          Filesize

          439KB

          MD5

          c88826ac4bb879622e43ead5bdb95aeb

          SHA1

          87d29853649a86f0463bfd9ad887b85eedc21723

          SHA256

          c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

          SHA512

          f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libssp-0.dll

          Filesize

          88KB

          MD5

          2c916456f503075f746c6ea649cf9539

          SHA1

          fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

          SHA256

          cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

          SHA512

          1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\libwinpthread-1.dll

          Filesize

          188KB

          MD5

          d407cc6d79a08039a6f4b50539e560b8

          SHA1

          21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

          SHA256

          92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

          SHA512

          378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\system32.exe

          Filesize

          973KB

          MD5

          5cfe61ff895c7daa889708665ef05d7b

          SHA1

          5e58efe30406243fbd58d4968b0492ddeef145f2

          SHA256

          f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

          SHA512

          43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\torrc

          Filesize

          139B

          MD5

          7445394ecb157b83afdb3c1e9f26da5d

          SHA1

          0df86834eb2195e2f14e4ae6d19457c8083627e9

          SHA256

          ca4160db0404329ef6715d473abbc6db102de69ebd1b2b8899cd2d8f5a1e7197

          SHA512

          7d9f72e7f023c00bdb20f00b35a7d0c60bf5950298e1806efbab0d21c5abe9845033e5c1e9ef98ddddd51c85d2086dbb18824d02da609f658ad0be5ade757ce1

        • C:\Users\Admin\AppData\Local\ecc71f27\tor\zlib1.dll

          Filesize

          52KB

          MD5

          add33041af894b67fe34e1dc819b7eb6

          SHA1

          6db46eb021855a587c95479422adcc774a272eeb

          SHA256

          8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

          SHA512

          bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

        • memory/2060-45-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-62-0x0000000001960000-0x0000000001C2F000-memory.dmp

          Filesize

          2.8MB

        • memory/2060-39-0x00000000743E0000-0x0000000074468000-memory.dmp

          Filesize

          544KB

        • memory/2060-46-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/2060-47-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/2060-48-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/2060-49-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/2060-51-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/2060-52-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/2060-53-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-54-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-40-0x0000000001960000-0x0000000001C2F000-memory.dmp

          Filesize

          2.8MB

        • memory/2060-63-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-71-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-38-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/2060-91-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2060-35-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/2060-34-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/2060-33-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/2060-30-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/2060-29-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/2060-18-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-148-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-222-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-110-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/2408-117-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/2408-124-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-125-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/2408-116-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/2408-138-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-107-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-118-0x00000000743E0000-0x0000000074468000-memory.dmp

          Filesize

          544KB

        • memory/2408-149-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/2408-111-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/2408-114-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/2408-115-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/4008-370-0x0000000073CD0000-0x0000000073D09000-memory.dmp

          Filesize

          228KB

        • memory/4008-253-0x0000000072D10000-0x0000000072D49000-memory.dmp

          Filesize

          228KB

        • memory/4008-353-0x0000000075140000-0x0000000075179000-memory.dmp

          Filesize

          228KB

        • memory/4008-146-0x00000000747E0000-0x0000000074819000-memory.dmp

          Filesize

          228KB

        • memory/4008-44-0x0000000073CD0000-0x0000000073D09000-memory.dmp

          Filesize

          228KB

        • memory/4008-0-0x0000000075140000-0x0000000075179000-memory.dmp

          Filesize

          228KB

        • memory/4248-218-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/4248-226-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/4248-252-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/4248-220-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/4248-254-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/4248-255-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/4248-256-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/4248-312-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/4248-225-0x00000000743E0000-0x0000000074468000-memory.dmp

          Filesize

          544KB

        • memory/4248-221-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/4248-224-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/4248-223-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/4460-346-0x00000000742F0000-0x00000000743B8000-memory.dmp

          Filesize

          800KB

        • memory/4460-379-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/4460-356-0x0000000074000000-0x00000000740CE000-memory.dmp

          Filesize

          824KB

        • memory/4460-355-0x00000000740D0000-0x0000000074158000-memory.dmp

          Filesize

          544KB

        • memory/4460-354-0x00000000743C0000-0x000000007468F000-memory.dmp

          Filesize

          2.8MB

        • memory/4460-380-0x00000000742F0000-0x00000000743B8000-memory.dmp

          Filesize

          800KB

        • memory/4460-352-0x0000000074160000-0x000000007426A000-memory.dmp

          Filesize

          1.0MB

        • memory/4460-350-0x0000000074270000-0x0000000074294000-memory.dmp

          Filesize

          144KB

        • memory/4460-349-0x00000000742A0000-0x00000000742E9000-memory.dmp

          Filesize

          292KB

        • memory/5076-313-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/5076-337-0x00000000743E0000-0x0000000074468000-memory.dmp

          Filesize

          544KB

        • memory/5076-336-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/5076-335-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/5076-334-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/5076-332-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/5076-333-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/5076-331-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB

        • memory/5076-330-0x00000000003F0000-0x00000000007F4000-memory.dmp

          Filesize

          4.0MB

        • memory/5076-321-0x00000000743E0000-0x0000000074468000-memory.dmp

          Filesize

          544KB

        • memory/5076-320-0x00000000742D0000-0x00000000743DA000-memory.dmp

          Filesize

          1.0MB

        • memory/5076-319-0x0000000074540000-0x0000000074564000-memory.dmp

          Filesize

          144KB

        • memory/5076-318-0x0000000074640000-0x0000000074689000-memory.dmp

          Filesize

          292KB

        • memory/5076-317-0x0000000074470000-0x000000007453E000-memory.dmp

          Filesize

          824KB

        • memory/5076-316-0x0000000074570000-0x0000000074638000-memory.dmp

          Filesize

          800KB

        • memory/5076-315-0x0000000074000000-0x00000000742CF000-memory.dmp

          Filesize

          2.8MB