Resubmissions

12/06/2024, 04:57

240612-flpr1a1flp 6

12/06/2024, 04:52

240612-fhvtva1eqd 6

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 04:52

General

  • Target

    PingPlotter Professional 5.24.3.8913/pingplotter_install.exe

  • Size

    21.4MB

  • MD5

    ae2015bc36bb8a0b872d049430c622c2

  • SHA1

    c11db0f26d3554dea55b601eecdc50f90eae785d

  • SHA256

    3586e0620442b8dfe2ae80f14dd389c224a7b9db7e6b9b29779a5b3d28e4a47f

  • SHA512

    85c3b9380c2a803bb2f3f64a667bc062f0ee786f9bc5d50f6ce5157055eae20c76f6c6ae3d0ead0a89f011925dd7bb8097d5c6014c2fb5b077cf5ff734cceaf0

  • SSDEEP

    393216:SeHSB8FeRF1NDgVEoZM9m5boLMMzgO+8+X7gj/pIBibcqBKOCCtbP:YzXay9UoL5+RgjLRgEP

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PingPlotter Professional 5.24.3.8913\pingplotter_install.exe
    "C:\Users\Admin\AppData\Local\Temp\PingPlotter Professional 5.24.3.8913\pingplotter_install.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2724
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CD4260307A46ACE0967FBF6020BC780E C
      2⤵
      • Loads dropped DLL
      PID:1948
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3112
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9D1F35A8187679CFA452B8AC6F18A8F4
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2620
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DC1D9B417077D784F70220BE90416E41 E Global\MSI0000
        2⤵
        • Drops file in System32 directory
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\SysWOW64\cmd.exe
          /C "C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            /C "C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat"
            3⤵
              PID:1132
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" /queue:1
              3⤵
              • Drops file in Windows directory
              PID:1712
          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
            "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver initializeprofile quiet
            2⤵
            • Executes dropped EXE
            PID:5044
          • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
            "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver quiet
            2⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            PID:4904
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:2376
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
          1⤵
            PID:4896

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Config.Msi\e58dc52.rbs

                  Filesize

                  2.1MB

                  MD5

                  51ed69178e2fdb90e1e101c7fef44982

                  SHA1

                  581cc6a5735e94a431680d73853762129b95d7c9

                  SHA256

                  d99be018e924eeb40c9ca4c51a38b0c58b897b737b533ed0dcc89d9cc93db62d

                  SHA512

                  5ba82b862cf56757b2009e513b62be5b7bc16afc3202ae6f1f66c318009481eaa95c5664f6a442fe8cf68809ef03f091db97f007a0bfdcf557fa27f4dea2216c

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.DataGrid.Contrib.Wpf.dll

                  Filesize

                  87KB

                  MD5

                  9c43eb18df357b00aaf31b6684e57a53

                  SHA1

                  6de6fc5c23b5ef38eb2faab1eb643c3161c2e9f6

                  SHA256

                  abf2ec51aff791bee7580e77502a90b28aa034d2e729580e0d2b10d7ee296fd6

                  SHA512

                  fea50d9884aef63e24546d0947608fee8fb3aad6b0f8b5a02fdf5fead5564c2d8f16828fae1c182f1350b209a8a9b2e99201822957c36787b6ff36d266412309

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Docking.Wpf.dll

                  Filesize

                  677KB

                  MD5

                  b9d27fbdd161b1879aa1b5bf390b8114

                  SHA1

                  1e9ffc3fcefc25581fd726087c74d257c713ffe4

                  SHA256

                  3866414e85e128dd761a894b63befed29fded32788ab79087d0abc79335f17a4

                  SHA512

                  4af0057663f74f65af501ec45bed8cc75e225395b1acbd318220cd97eb28123b3b7290c34b865129edc20255c6876c58c25308ae1a458a97f5df285f5a2444c6

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Editors.Wpf.dll

                  Filesize

                  929KB

                  MD5

                  6f0e2870c72222d5989e9842d7d9e275

                  SHA1

                  9a847f1d5efe181c945c60bcfeeb43132db3f599

                  SHA256

                  b637f6e4c87ac32276f92c609ee71bb3d482b36d5516e383e5c52d8f615359e8

                  SHA512

                  ff99918d8a8510d70d250695a583deb91953f6db2abf2a71069a2d67932532977529d3a50ec012cd4547a03601cf8f5367592187768fe4d8aa5a80d8dacfda0d

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll

                  Filesize

                  315KB

                  MD5

                  3e50933e28b0ac08f7158e3a783f6bf4

                  SHA1

                  2178728de734670785b749499e4cfda7e1e30f60

                  SHA256

                  7d0ee0f0aad53788758a43ccf295cad4b8e6afae6815f2a2800033b29b81c14a

                  SHA512

                  3324d40fdc9a82915b8323f5386d00361bea8ae42aa79fc85b4d9d95a087fbadfc557d9f77e34938ef4fdc8b04d0e6a9f24bbfca6569d981cf404626fb2eb7f6

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Shared.Wpf.dll

                  Filesize

                  1.9MB

                  MD5

                  674447f18caace5e1163fb227e4cf08d

                  SHA1

                  62082108201e8be712cd52806a66503cf51fe714

                  SHA256

                  56dfde9007145d5f6ed21730ecbb5ac04e7c6bc1370fb317acb0e29bffaf5c84

                  SHA512

                  89fcdc36bd040a554a3bf8be205541914a00e0eed741eed066831d7564fa0f2ede717fb21d1e85e9503d9d262145d2fef837e37ed40087bb7386159fa5411bb8

                • C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Wpf.dll

                  Filesize

                  1.1MB

                  MD5

                  855914201fde2285b71d87c05c4bbcc2

                  SHA1

                  8bc1bdbb97c2775c0399e9d0e90a036f41357a4c

                  SHA256

                  580a06e4ff57218280a92877d2b5def390b563c86a16366882cfee5d30951bd6

                  SHA512

                  7040fcb1fa29171f10e9a6400deae3283a078899eb21c969d9fde51136ab5002d2cc95ef9b37ea1647fd28c18df1f1776bd80d12b16703a9b15f2776d97b7fbb

                • C:\Program Files (x86)\PingPlotter 5\CoreLib.dll

                  Filesize

                  2.2MB

                  MD5

                  4f79b56c4bebf4683f731c2fa68126ce

                  SHA1

                  be502d11260c83f3bdb67279f796b137094248b6

                  SHA256

                  28130a2c33fd8ac4a915bd2a695b1160e61ad179136860675b42bbebc878bb63

                  SHA512

                  3384c07d2378e87d9e7e85f5db6af6bbfe804b559057339b04fda64e744344255da4d309a75efed9ec3246afbb852d4b4dde9baa7d2a783230f25a56d5f6294f

                • C:\Program Files (x86)\PingPlotter 5\NGraphics.Net.dll

                  Filesize

                  24KB

                  MD5

                  50f77484e5ebbab4178d226457277f61

                  SHA1

                  f9ce26a5dac69bc620481e76ff4bcaa44610b4f1

                  SHA256

                  76a4ee07ad63c27d6d95b9e0cc9a903563514e9b8fb51744646a19e00c3175a5

                  SHA512

                  f094291b6097608443d168d7cc5cd6a288f98f6bdb418e22d6f606ea2f54a6c6c166f13fedd827a79e8812d598e4fca1d59f50af17264f80e8dd3621856c77da

                • C:\Program Files (x86)\PingPlotter 5\NGraphics.dll

                  Filesize

                  100KB

                  MD5

                  36896e5b8ff559857c870c8d60470d79

                  SHA1

                  8abe9941ec44d19b2f079fa66c118d60ecd75141

                  SHA256

                  57f963ae4825b02214ccae01276708613cdda30d74c50289972f4a16bea3d823

                  SHA512

                  ddbd19c34fe0b38958778cb8e01ec0daf22882a5db774f24d5fbaf3f18938f71f48b55d6b8ed1d31ac31086d416c65f3e410168c891295412a3d67cbbf781793

                • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe

                  Filesize

                  2.9MB

                  MD5

                  aea6964efb6bfc8723f85e191c6db9b0

                  SHA1

                  f213e8ae0088838ae76d9d5841f9e9a2376c78a9

                  SHA256

                  89a3e51a67ef4684952ab912be4e9fd379b4cf46991d6c17c6e59d34f6ec5eac

                  SHA512

                  84a8587ccc35cdb2392f2de20a7323bf626bfdef0cc1ba6957273921aa8336086edd58689fac446e342d3ecb9f0a00e7dd2dbb2e5de223a5b6a42e75d845ab8a

                • C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe.config

                  Filesize

                  27KB

                  MD5

                  928b8e104bc50973bad9150c577aaa64

                  SHA1

                  33eb7ed6547d26bbb8dbb087a45baf41292d01d2

                  SHA256

                  b42eb2bb81f89946449c5b27315afec9c87070ac01a6d0d1df91bd9d46702629

                  SHA512

                  3b8ac3ce5365b27c8156dfb1ccfeff4f8a0e3b10360c2e5639d3516f2b5aa3c2dc524ddbbd6e3d1941ae0d15f8867eb2e19a0df1c31d1872d25f7758c481cff2

                • C:\Program Files (x86)\PingPlotter 5\System.IO.dll

                  Filesize

                  15KB

                  MD5

                  ba3845f4986d242d62641e1f6e14caba

                  SHA1

                  9278fe4d60ed3462835a90c56bf187cadc35ddda

                  SHA256

                  ab5d0fa375fd11f411293552ffa7b127a62ecc7bef74c5c3a49cad629413e38b

                  SHA512

                  4ccc206b30208cf1ceef1e7341cf7f28e36f3ba90daff5051ee706841a1f30d49d654399c33b2d336d330789b76e5d3fac39d22d6d45d6d76a3ef643750a70cf

                • C:\Users\Admin\AppData\Local\Temp\MSI804F.tmp

                  Filesize

                  364KB

                  MD5

                  ca95f207ec70ba34b46c785f7bcb5570

                  SHA1

                  25c0d45cb9f94892e2877033d06fe8909e5b9972

                  SHA256

                  8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

                  SHA512

                  c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

                • C:\Users\Admin\AppData\Local\Temp\MSI8219.tmp

                  Filesize

                  561KB

                  MD5

                  5576bf4d22dc695564e49a68cbc98bc2

                  SHA1

                  80e0e045162a65d84939e22a821ecbbbde3f31d6

                  SHA256

                  20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

                  SHA512

                  4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

                • C:\Users\Admin\AppData\Local\Temp\nsu4642.tmp\DotNetChecker.dll

                  Filesize

                  84KB

                  MD5

                  f18364fa5084add86c6e73e457404f18

                  SHA1

                  6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a

                  SHA256

                  39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91

                  SHA512

                  716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3

                • C:\Users\Admin\AppData\Local\Temp\nsu4642.tmp\System.dll

                  Filesize

                  11KB

                  MD5

                  ca332bb753b0775d5e806e236ddcec55

                  SHA1

                  f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

                  SHA256

                  df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

                  SHA512

                  2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

                • C:\Users\Admin\AppData\Local\Temp\ymbrvablvg.tmp

                  Filesize

                  48B

                  MD5

                  96a568f9af3d18ebb930331118447946

                  SHA1

                  30519320aed158e16d1db748d9a9064094593554

                  SHA256

                  6b824e9f13ee7210ccabdc81e255cf3a390e5b8fcc7b69069349d89de428994e

                  SHA512

                  b45971c7a6e3ccc4f02227f570bbd7adfbcef7ed4cf39322c272a1ce70fca4f5e048001c44cc17eddf9313770c31fc6728b9e15c56007f03b554a7f529765aab

                • C:\Users\Admin\AppData\Local\Temp\ymbrvablvg.tmp

                  Filesize

                  48B

                  MD5

                  2a13a6f38d9299bdfbb1d30a1cea8fde

                  SHA1

                  8a3d0cd8dcdb24b4d0b40e1de5988b6dc980ed0f

                  SHA256

                  0f0a878a2dbefb3233c75339d2b5511f0f86e54a230ae037fe3b64a87e193399

                  SHA512

                  1be095400f54a1cbab1f3f58a485aef463b019a3a55be9b07e2096d30b43676f98b97df3987a97b9a04f5b9a427ad7c26074a0feeec1002a51fb8dd156812cbb

                • C:\Users\Admin\AppData\Local\Temp\{FE7D9469-69FF-4AD0-A0FA-666CF8090897}.bat

                  Filesize

                  104B

                  MD5

                  a937e8f48d3a6c808168c5b8ccde386d

                  SHA1

                  a5c79ce563c6976b75f3037ab544616813b1ac48

                  SHA256

                  a159304fedf73b8147af1cf80d495f9338db77bbafc822ba176eee02cab7561b

                  SHA512

                  33cf95a0dc2f57e3e9084eb3ff526c469b2372b64fef0968ac95933f8f6f50b9b7784cfc4aae63d57c02feadb9b0a4845d870f907b41dcfc1a06558fb728a55a

                • C:\Windows\Installer\MSI1027.tmp

                  Filesize

                  195KB

                  MD5

                  71c143221c4d2f06e495ee3f9e51a7f0

                  SHA1

                  44a3aa0ca190243d6f21becbd5b0c5e923426135

                  SHA256

                  8d245ef042215b0e9211692c7deaef442f4d46bd5323d74aa1bf25d676525bd9

                  SHA512

                  98a97a4f45cb70eb671ddc3c8d26a9a4c3d34745f0d1b6ee052a2080e1b4b3dac11303eb9a0c8d38e34df624edc28864e52f13e4d79bc16fe9223c5663372445

                • C:\Windows\Installer\MSI11DF.tmp

                  Filesize

                  196KB

                  MD5

                  94fa9ff9c26724e0b8ac910c1e7c40aa

                  SHA1

                  0cf47957200dec349d6b6da432e24165afd590eb

                  SHA256

                  adae076f90908818d67777c050c5b1b6cc94be728017bab6c638dfc7763d4d09

                  SHA512

                  becb8229e8ef77a673829c547d2520d6fec94218abf2a21e2948ae5c156bf4a1eb64bfec38653b49902bb31708d9cf770c38f042c1f869d4d4695313b2acfefb

                • C:\Windows\Installer\MSI1200.tmp

                  Filesize

                  849KB

                  MD5

                  99dc199a4a390a86f2728f5232a2f9a6

                  SHA1

                  21b03b2dacbc5e19f3334054703ce53c8ba4a15f

                  SHA256

                  12b9deeb6e80129593bae1439bcbc491c6f602bfff255f72eba627100a54e2f9

                  SHA512

                  8ba930b0fb37257bbb0d5ea97bbb581ec7d545b737bdce03a78e713b3ad95a2f4b2b6d101817102763100edfe8e46f4532946a7bd3ac24d2142358ac26ec45db

                • C:\Windows\Installer\MSI1388.tmp

                  Filesize

                  409KB

                  MD5

                  e34827bf55cae867e83cc6122d25154a

                  SHA1

                  e513c23028532a6997692965765e235d42d96efa

                  SHA256

                  7f8ce80c53a7a4c3cecfbf497ee443538fd126a6e369b9930a3b021db548b55a

                  SHA512

                  506143a220f58c4236e4736f404c9421b9d5e0caaa21eff950953258ccf783de3534ea702e476acf565719964da6aeaeed787fca2d66c2b8ef5aa51c9b6e38d2

                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                  Filesize

                  23.7MB

                  MD5

                  29235c8b397a0b7cc27d7e81b0279ebd

                  SHA1

                  bed43f593c3cd174514bb0c1175606bcb353e04e

                  SHA256

                  af6b1d10b043b53d07a902934665d503ab6ca270dab555e8d0bf3bac6fa7c938

                  SHA512

                  1082f31d93847b41da5152e535642ca1dd7f9ac221afeeaaf1b35f30387ad05ed4c2e24c9053f0f00c7df72aecbfbb32540e14602b6b28743f6e9bda88f962ef

                • \??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0f901d05-e6b5-4346-a3f0-c7e8795fba43}_OnDiskSnapshotProp

                  Filesize

                  6KB

                  MD5

                  c2d3287eacfe9b2b84a06ecc53a06f3f

                  SHA1

                  870c4a36229db9de6a60d26a94eea102f9462417

                  SHA256

                  f1d365244c4d85454404359b41e39f3ac35c0d6dea0f3571d5813a6ab8504b7a

                  SHA512

                  38d7b5d19a4d84f588e6efbc8760880f8e90bbe89e1aa9e979d5bb323805a788abffec2ea47634e8a3567625c8e082fa98de3b4a2651acefbf739d138bcbc9ce

                • memory/5044-534-0x0000029245090000-0x0000029245098000-memory.dmp

                  Filesize

                  32KB

                • memory/5044-526-0x0000029246910000-0x0000029246A26000-memory.dmp

                  Filesize

                  1.1MB

                • memory/5044-539-0x0000029246A30000-0x0000029246AE2000-memory.dmp

                  Filesize

                  712KB

                • memory/5044-540-0x0000029246AF0000-0x0000029246B8C000-memory.dmp

                  Filesize

                  624KB

                • memory/5044-541-0x0000029246130000-0x000002924615C000-memory.dmp

                  Filesize

                  176KB

                • memory/5044-542-0x00000292466D0000-0x00000292466F4000-memory.dmp

                  Filesize

                  144KB

                • memory/5044-538-0x00000292460F0000-0x00000292460FA000-memory.dmp

                  Filesize

                  40KB

                • memory/5044-536-0x0000029246030000-0x0000029246038000-memory.dmp

                  Filesize

                  32KB

                • memory/5044-543-0x0000029246B90000-0x0000029246BC2000-memory.dmp

                  Filesize

                  200KB

                • memory/5044-535-0x00000292460D0000-0x00000292460EA000-memory.dmp

                  Filesize

                  104KB

                • memory/5044-522-0x0000029246730000-0x000002924690E000-memory.dmp

                  Filesize

                  1.9MB

                • memory/5044-544-0x00000292471F0000-0x0000029247808000-memory.dmp

                  Filesize

                  6.1MB

                • memory/5044-532-0x0000029246050000-0x000002924606C000-memory.dmp

                  Filesize

                  112KB

                • memory/5044-524-0x0000029246070000-0x00000292460C2000-memory.dmp

                  Filesize

                  328KB

                • memory/5044-530-0x0000029245000000-0x000002924500A000-memory.dmp

                  Filesize

                  40KB

                • memory/5044-537-0x0000029246040000-0x000002924604A000-memory.dmp

                  Filesize

                  40KB

                • memory/5044-520-0x0000029246460000-0x000002924654C000-memory.dmp

                  Filesize

                  944KB

                • memory/5044-518-0x00000292463B0000-0x000002924645E000-memory.dmp

                  Filesize

                  696KB

                • memory/5044-545-0x0000029246BD0000-0x0000029246BE2000-memory.dmp

                  Filesize

                  72KB

                • memory/5044-546-0x0000029246BF0000-0x0000029246C06000-memory.dmp

                  Filesize

                  88KB

                • memory/5044-547-0x0000029246E30000-0x0000029246E48000-memory.dmp

                  Filesize

                  96KB

                • memory/5044-548-0x0000029246EA0000-0x0000029246EEC000-memory.dmp

                  Filesize

                  304KB

                • memory/5044-549-0x0000029246FB0000-0x000002924706A000-memory.dmp

                  Filesize

                  744KB

                • memory/5044-550-0x0000029246EF0000-0x0000029246F14000-memory.dmp

                  Filesize

                  144KB

                • memory/5044-551-0x0000029246F90000-0x0000029246FA2000-memory.dmp

                  Filesize

                  72KB

                • memory/5044-554-0x0000029247B40000-0x0000029247E6E000-memory.dmp

                  Filesize

                  3.2MB

                • memory/5044-528-0x0000029246010000-0x000002924602A000-memory.dmp

                  Filesize

                  104KB

                • memory/5044-516-0x0000029246160000-0x00000292463A2000-memory.dmp

                  Filesize

                  2.3MB

                • memory/5044-514-0x000002922A950000-0x000002922AC40000-memory.dmp

                  Filesize

                  2.9MB