Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    597s
  • max time network
    597s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-04-2021 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DBF.Viewer.Pro.3.11.crack.by.F4CG.exe

  • Size

    4.8MB

  • MD5

    98e0552e7c661d3f84c5ca691bb58b60

  • SHA1

    f8747cbd9256e9587e45b1feeded6b082b098e5d

  • SHA256

    23e30d6f1d505e6a0cf1672ec7420d28af81975a9832f1af2eae8a3233a09eb4

  • SHA512

    d767b09e6d24ce96ce95e7cbcb248b93373f7dcbad3a96ba249a3c54df9511567c4ff2bfd8393492a0f90ae8bf5ab37c1cf71f75092ad81dde7a7a7a5f7e76da

Score
10/10
azorultdcratponyxmrigdiscoveryevasioninfostealerminerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 29 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DBF.Viewer.Pro.3.11.crack.by.F4CG.exe
    "C:\Users\Admin\AppData\Local\Temp\DBF.Viewer.Pro.3.11.crack.by.F4CG.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:4004
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:1888
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:3952
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Users\Admin\AppData\Local\Temp\B8ZX78V0E7\setups.exe
            "C:\Users\Admin\AppData\Local\Temp\B8ZX78V0E7\setups.exe" ll
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2092
            • C:\Users\Admin\AppData\Local\Temp\is-3ICB5.tmp\setups.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-3ICB5.tmp\setups.tmp" /SL5="$80062,635399,250368,C:\Users\Admin\AppData\Local\Temp\B8ZX78V0E7\setups.exe" ll
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:3536
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1252
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1760
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Users\Admin\AppData\Roaming\C0E4.tmp.exe
            "C:\Users\Admin\AppData\Roaming\C0E4.tmp.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:4748
            • C:\Users\Admin\AppData\Roaming\C0E4.tmp.exe
              "C:\Users\Admin\AppData\Roaming\C0E4.tmp.exe"
              6⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4948
          • C:\Users\Admin\AppData\Roaming\C1A1.tmp.exe
            "C:\Users\Admin\AppData\Roaming\C1A1.tmp.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            PID:4780
            • C:\Windows\system32\msiexec.exe
              -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
              6⤵
                PID:2656
              • C:\Windows\system32\msiexec.exe
                -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                6⤵
                • Blocklisted process makes network request
                PID:3668
            • C:\Users\Admin\AppData\Roaming\C26D.tmp.exe
              "C:\Users\Admin\AppData\Roaming\C26D.tmp.exe"
              5⤵
              • Executes dropped EXE
              PID:4828
              • C:\Windows\SysWOW64\cmd.exe
                /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\C26D.tmp.exe
                6⤵
                  PID:4892
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 3
                    7⤵
                    • Delays execution with timeout.exe
                    PID:5100
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                5⤵
                  PID:4912
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1
                    6⤵
                    • Runs ping.exe
                    PID:5104
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                4⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                PID:3996
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                4⤵
                • Executes dropped EXE
                PID:5064
                • C:\ProgramData\7729505.exe
                  "C:\ProgramData\7729505.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1032
                • C:\ProgramData\677057.exe
                  "C:\ProgramData\677057.exe"
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:3936
                  • C:\ProgramData\Windows Host\Windows Host.exe
                    "C:\ProgramData\Windows Host\Windows Host.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:1492
                • C:\ProgramData\2089419.exe
                  "C:\ProgramData\2089419.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4972
                  • C:\ProgramData\2089419.exe
                    "{path}"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5044
                  • C:\ProgramData\2089419.exe
                    "{path}"
                    6⤵
                    • Executes dropped EXE
                    PID:3296
                • C:\ProgramData\1746094.exe
                  "C:\ProgramData\1746094.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4428
                  • C:\ProgramData\1746094.exe
                    "{path}"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3260
                • C:\ProgramData\8171295.exe
                  "C:\ProgramData\8171295.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4936
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:1228
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  5⤵
                  • Executes dropped EXE
                  PID:4340
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5004
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4280
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
          • Modifies Internet Explorer settings
          PID:4332
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:4676
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:4924
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:4980
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4204
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
          • Modifies Internet Explorer settings
          PID:3972
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:5040
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:4464
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:4600

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1032-147-0x0000000002810000-0x0000000002811000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1032-159-0x0000000004E90000-0x0000000004E91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1032-194-0x00000000091C0000-0x00000000091C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1032-127-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/1032-135-0x00000000005B0000-0x00000000005B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1032-168-0x0000000004830000-0x0000000004864000-memory.dmp

          Filesize

          208KB

          Download

        • memory/1032-172-0x00000000048B0000-0x00000000048B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1492-191-0x00000000056A0000-0x00000000056A1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1492-177-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/2092-39-0x0000000000401000-0x000000000040C000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2656-95-0x0000000140000000-0x0000000140383000-memory.dmp

          Filesize

          3.5MB

          Download

        • memory/2656-90-0x0000000140000000-0x0000000140383000-memory.dmp

          Filesize

          3.5MB

          Download

        • memory/2704-80-0x00000000005D0000-0x00000000005EB000-memory.dmp

          Filesize

          108KB

          Download

        • memory/2704-79-0x00000000005E0000-0x00000000005E1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2704-69-0x0000000002E10000-0x0000000002EFF000-memory.dmp

          Filesize

          956KB

          Download

        • memory/2704-32-0x00000000010C0000-0x000000000125C000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2928-33-0x000000001B0A0000-0x000000001B0A2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2928-25-0x0000000000430000-0x0000000000431000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2928-24-0x00007FFD5ABF0000-0x00007FFD5B5DC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/3260-207-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

          Download

        • memory/3260-226-0x0000000005F40000-0x0000000005F41000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3260-231-0x0000000006240000-0x0000000006241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3260-211-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/3260-217-0x0000000005750000-0x0000000005751000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3260-219-0x0000000005960000-0x0000000005961000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3260-224-0x00000000064B0000-0x00000000064B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3536-55-0x00000000001E0000-0x00000000001E1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3536-54-0x00000000031B1000-0x00000000031B8000-memory.dmp

          Filesize

          28KB

          Download

        • memory/3536-51-0x0000000003171000-0x000000000319C000-memory.dmp

          Filesize

          172KB

          Download

        • memory/3536-47-0x0000000003141000-0x0000000003143000-memory.dmp

          Filesize

          8KB

          Download

        • memory/3668-101-0x0000021675E90000-0x0000021675EB0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3668-98-0x00000216745A0000-0x00000216745B4000-memory.dmp

          Filesize

          80KB

          Download

        • memory/3668-202-0x0000021675EB0000-0x0000021675ED0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3668-99-0x0000000140000000-0x000000014070A000-memory.dmp

          Filesize

          7.0MB

          Download

        • memory/3668-100-0x0000000140000000-0x000000014070A000-memory.dmp

          Filesize

          7.0MB

          Download

        • memory/3668-96-0x0000000140000000-0x000000014070A000-memory.dmp

          Filesize

          7.0MB

          Download

        • memory/3936-133-0x0000000000190000-0x0000000000191000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3936-153-0x0000000002520000-0x0000000002534000-memory.dmp

          Filesize

          80KB

          Download

        • memory/3936-128-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/3936-149-0x00000000024D0000-0x00000000024D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3936-167-0x0000000002390000-0x0000000002391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3936-160-0x0000000004C80000-0x0000000004C81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4004-27-0x0000000000400000-0x0000000000983000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/4004-34-0x0000000000400000-0x0000000000983000-memory.dmp

          Filesize

          5.5MB

          Download

        • memory/4428-142-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/4428-205-0x0000000002BB0000-0x0000000002C0E000-memory.dmp

          Filesize

          376KB

          Download

        • memory/4428-166-0x0000000005200000-0x0000000005201000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4428-163-0x0000000001290000-0x0000000001291000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4428-180-0x0000000005500000-0x0000000005505000-memory.dmp

          Filesize

          20KB

          Download

        • memory/4428-150-0x0000000000720000-0x0000000000721000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4428-170-0x0000000005160000-0x0000000005161000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4428-183-0x0000000006E20000-0x0000000006E21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4428-203-0x0000000009EB0000-0x0000000009F54000-memory.dmp

          Filesize

          656KB

          Download

        • memory/4492-81-0x0000000003650000-0x0000000003698000-memory.dmp

          Filesize

          288KB

          Download

        • memory/4492-61-0x0000000000910000-0x000000000091D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/4748-82-0x0000000004810000-0x0000000004811000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4748-86-0x0000000004810000-0x0000000004857000-memory.dmp

          Filesize

          284KB

          Download

        • memory/4828-102-0x00000000075E0000-0x000000000CA5C000-memory.dmp

          Filesize

          84.5MB

          Download

        • memory/4828-103-0x0000000000400000-0x000000000587C000-memory.dmp

          Filesize

          84.5MB

          Download

        • memory/4936-189-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4936-165-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4936-174-0x0000000004AB0000-0x0000000004AEB000-memory.dmp

          Filesize

          236KB

          Download

        • memory/4936-175-0x0000000004B00000-0x0000000004B01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4936-154-0x00000000002F0000-0x00000000002F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4936-148-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/4948-84-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB

          Download

        • memory/4948-88-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB

          Download

        • memory/4972-132-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/4972-181-0x00000000057A0000-0x0000000005835000-memory.dmp

          Filesize

          596KB

          Download

        • memory/4972-143-0x0000000005900000-0x0000000005901000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4972-152-0x00000000052C0000-0x00000000052C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4972-176-0x00000000053F0000-0x00000000053F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4972-134-0x0000000000820000-0x0000000000821000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4972-204-0x0000000008710000-0x00000000087B6000-memory.dmp

          Filesize

          664KB

          Download

        • memory/4972-206-0x000000000AD60000-0x000000000ADC1000-memory.dmp

          Filesize

          388KB

          Download

        • memory/5044-220-0x0000000005210000-0x0000000005211000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5044-229-0x00000000058D0000-0x00000000058D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5044-228-0x0000000005890000-0x0000000005891000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5044-233-0x00000000068C0000-0x00000000068C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5044-212-0x00000000714B0000-0x0000000071B9E000-memory.dmp

          Filesize

          6.9MB

          Download

        • memory/5044-209-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

          Download

        • memory/5044-235-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5044-222-0x00000000055D0000-0x00000000055D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5064-112-0x00007FFD5ABF0000-0x00007FFD5B5DC000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/5064-113-0x0000000000C20000-0x0000000000C21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5064-117-0x0000000002B10000-0x0000000002B2D000-memory.dmp

          Filesize

          116KB

          Download

        • memory/5064-118-0x0000000001240000-0x0000000001241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5064-119-0x000000001B870000-0x000000001B872000-memory.dmp

          Filesize

          8KB

          Download

        • memory/5064-116-0x0000000001230000-0x0000000001231000-memory.dmp

          Filesize

          4KB

          Download