Analysis

  • max time kernel
    38s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-02-2021 09:59

General

  • Target

    pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe

  • Size

    9.0MB

  • MD5

    10a7ec6eec9d29e7cf84477015651b65

  • SHA1

    c6b132ff8919f5da4959d68b5a9cf86919ccebee

  • SHA256

    a252756f1326333e8587740cfecad63d80ffd26dd49d6b9699d685fb5096b730

  • SHA512

    34c53db9f782e6899004673c3c531b58aacc2153554fd2ca06b47d80d21f8d536912f4ec7f7336738e24b034f5a567b32cf99015ee8c01259902b63a86722aaa

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Nirsoft 4 IoCs
  • Executes dropped EXE 16 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • themida 4 IoCs

    Detects Themida, Advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
    "C:\Users\Admin\AppData\Local\Temp\pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1572
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:2308
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:4044
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1896
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:2392
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1912
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2456
            • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
              C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4540
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:1164
              • C:\Users\Admin\AppData\Roaming\1613383421906.exe
                "C:\Users\Admin\AppData\Roaming\1613383421906.exe" /sjson "C:\Users\Admin\AppData\Roaming\1613383421906.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:232
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:744
              • C:\Users\Admin\AppData\Roaming\1613383424219.exe
                "C:\Users\Admin\AppData\Roaming\1613383424219.exe" /sjson "C:\Users\Admin\AppData\Roaming\1613383424219.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3480
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                  PID:2128
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
                  6⤵
                    PID:4984
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      7⤵
                      • Runs ping.exe
                      PID:1012
                • C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe
                  C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp1
                  5⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Writes to the Master Boot Record (MBR)
                  • Checks SCSI registry key(s)
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:372
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1104
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      PID:1472
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"
                    6⤵
                      PID:4956
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 3
                        7⤵
                        • Runs ping.exe
                        PID:4724
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3696
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      6⤵
                      • Runs ping.exe
                      PID:1080
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  PID:2668
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 3900
                    5⤵
                    • Drops file in Windows directory
                    • Program crash
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2452
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                  4⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5016
                  • C:\Users\Admin\AppData\Roaming\A994.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\A994.tmp.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5104
                    • C:\Users\Admin\AppData\Roaming\A994.tmp.exe
                      "C:\Users\Admin\AppData\Roaming\A994.tmp.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:4472
                  • C:\Users\Admin\AppData\Roaming\AB1B.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\AB1B.tmp.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4784
                  • C:\Users\Admin\AppData\Roaming\AC55.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\AC55.tmp.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4800
                    • C:\Windows\SysWOW64\cmd.exe
                      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\AC55.tmp.exe
                      6⤵
                        PID:672
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 3
                          7⤵
                          • Delays execution with timeout.exe
                          PID:4304
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                      5⤵
                        PID:3384
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1
                          6⤵
                          • Runs ping.exe
                          PID:1164
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                      4⤵
                        PID:4300
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX3\installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX3\installer.exe"
                          5⤵
                            PID:1908
                            • C:\ProgramData\4506405.49
                              "C:\ProgramData\4506405.49"
                              6⤵
                                PID:200
                              • C:\ProgramData\965330.10
                                "C:\ProgramData\965330.10"
                                6⤵
                                  PID:2588
                                  • C:\ProgramData\Windows Host\Windows Host.exe
                                    "C:\ProgramData\Windows Host\Windows Host.exe"
                                    7⤵
                                      PID:4872
                                  • C:\ProgramData\5321221.58
                                    "C:\ProgramData\5321221.58"
                                    6⤵
                                      PID:4680
                                    • C:\ProgramData\8989758.98
                                      "C:\ProgramData\8989758.98"
                                      6⤵
                                        PID:2424
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gdrrr.exe
                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gdrrr.exe"
                                    4⤵
                                      PID:4476
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                          PID:844
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                            PID:3592
                                  • C:\Windows\system32\msiexec.exe
                                    C:\Windows\system32\msiexec.exe /V
                                    1⤵
                                    • Enumerates connected drives
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4656
                                    • C:\Windows\syswow64\MsiExec.exe
                                      C:\Windows\syswow64\MsiExec.exe -Embedding 7845B0D04F465DBD4EDB249417BA2D77 C
                                      2⤵
                                      • Loads dropped DLL
                                      PID:208
                                    • C:\Windows\system32\srtasks.exe
                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                      2⤵
                                        PID:832
                                    • C:\Windows\system32\vssvc.exe
                                      C:\Windows\system32\vssvc.exe
                                      1⤵
                                        PID:2484
                                      • \??\c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                        1⤵
                                          PID:1768

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • memory/200-148-0x0000000002840000-0x0000000002875000-memory.dmp

                                          Filesize

                                          212KB

                                        • memory/200-135-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/200-134-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/200-155-0x0000000002880000-0x0000000002881000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/200-199-0x00000000092D0000-0x00000000092D1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/200-141-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/200-149-0x0000000005040000-0x0000000005041000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/232-66-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/372-55-0x0000000002F00000-0x00000000033AF000-memory.dmp

                                          Filesize

                                          4.7MB

                                        • memory/372-46-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/744-85-0x0000013387480000-0x0000013387481000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/744-75-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/1164-58-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/1164-59-0x0000000010000000-0x0000000010057000-memory.dmp

                                          Filesize

                                          348KB

                                        • memory/1164-62-0x000001C266E20000-0x000001C266E21000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1572-26-0x0000000002D00000-0x0000000002E9C000-memory.dmp

                                          Filesize

                                          1.6MB

                                        • memory/1908-127-0x0000000000580000-0x0000000000581000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1908-130-0x000000001AFD0000-0x000000001AFD2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1908-129-0x0000000000590000-0x0000000000591000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1908-128-0x0000000000770000-0x000000000078E000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/1908-125-0x0000000000140000-0x0000000000141000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1908-124-0x00007FFEE8270000-0x00007FFEE8C5C000-memory.dmp

                                          Filesize

                                          9.9MB

                                        • memory/1912-25-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/1912-28-0x0000000010000000-0x000000001033D000-memory.dmp

                                          Filesize

                                          3.2MB

                                        • memory/2128-207-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/2424-194-0x0000000005500000-0x0000000005501000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-161-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/2424-163-0x0000000001130000-0x0000000001131000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-186-0x00000000052B0000-0x00000000052B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-172-0x0000000005260000-0x0000000005261000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2452-61-0x0000000004330000-0x0000000004331000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2588-152-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2588-146-0x0000000000D70000-0x0000000000D7B000-memory.dmp

                                          Filesize

                                          44KB

                                        • memory/2588-140-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/2588-142-0x0000000000420000-0x0000000000421000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3480-80-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/4472-107-0x0000000000400000-0x0000000000448000-memory.dmp

                                          Filesize

                                          288KB

                                        • memory/4472-111-0x0000000000400000-0x0000000000448000-memory.dmp

                                          Filesize

                                          288KB

                                        • memory/4540-54-0x0000000003830000-0x0000000003CDF000-memory.dmp

                                          Filesize

                                          4.7MB

                                        • memory/4540-44-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                                          Filesize

                                          588KB

                                        • memory/4680-212-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-213-0x00000000074B0000-0x00000000074B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-162-0x0000000005930000-0x0000000005931000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-159-0x0000000000820000-0x0000000000821000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-175-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-157-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/4680-177-0x0000000006110000-0x0000000006111000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-179-0x0000000005A90000-0x0000000005A91000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-168-0x00000000778C4000-0x00000000778C5000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-166-0x0000000005900000-0x0000000005901000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-181-0x0000000005B00000-0x0000000005B01000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-219-0x00000000072F0000-0x00000000072F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-95-0x0000000005E40000-0x0000000005E41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-92-0x0000000000E30000-0x0000000000E31000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-102-0x0000000008DF0000-0x0000000008DF1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-96-0x00000000057E0000-0x00000000057E1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-88-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/4784-99-0x0000000005750000-0x0000000005751000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-105-0x0000000005620000-0x0000000005621000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4784-101-0x00000000058D0000-0x00000000058D2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4784-100-0x0000000008D10000-0x0000000008D4D000-memory.dmp

                                          Filesize

                                          244KB

                                        • memory/4784-104-0x0000000005930000-0x0000000005931000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4800-103-0x0000000000400000-0x000000000395C000-memory.dmp

                                          Filesize

                                          53.4MB

                                        • memory/4800-98-0x0000000005AC0000-0x000000000901C000-memory.dmp

                                          Filesize

                                          53.4MB

                                        • memory/4872-171-0x0000000071190000-0x000000007187E000-memory.dmp

                                          Filesize

                                          6.9MB

                                        • memory/4872-193-0x0000000005930000-0x0000000005931000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/5016-97-0x0000000000400000-0x000000000044A000-memory.dmp

                                          Filesize

                                          296KB

                                        • memory/5016-73-0x0000000000E00000-0x0000000000E0D000-memory.dmp

                                          Filesize

                                          52KB

                                        • memory/5104-106-0x0000000003140000-0x0000000003141000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/5104-110-0x0000000002C00000-0x0000000002C45000-memory.dmp

                                          Filesize

                                          276KB