Analysis

  • max time kernel
    4294361s
  • max time network
    303s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    22-03-2022 10:40

General

  • Target

    3c362636f19b4626866ca745bb197ebcc4f2fab1f2bec6b7f208c0748dc39dcd.exe

  • Size

    2.6MB

  • MD5

    c4cadec9357bec022e6ce6a11f67289c

  • SHA1

    5d4f5f80e946724aadedbd1ea833d5e582e98bd8

  • SHA256

    3c362636f19b4626866ca745bb197ebcc4f2fab1f2bec6b7f208c0748dc39dcd

  • SHA512

    9d113f7681e4304fc30a312aae75f9958a6f0aedba0e5d2830897ecf67fba1c4542fdd9b7b249ea07abe960776526297f356b68e9f8676ce91b33b8f4fc54fb0

Malware Config

Extracted

Family

redline

Botnet

5

C2

62.204.41.199:30941

Attributes
  • auth_value

    fa5949aa0d67fac8f05fd9fcece7888d

Extracted

Family

warzonerat

C2

136.144.41.92:5200

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • VKeylogger

    A keylogger first seen in Nov 2020.

  • VKeylogger Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • OnlyLogger Payload 1 IoCs
  • ASPack v2.12-2.42 18 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 34 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:884
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          3⤵
            PID:1316
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:1296
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:668
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
              PID:1196
              • C:\Users\Admin\AppData\Local\Temp\3c362636f19b4626866ca745bb197ebcc4f2fab1f2bec6b7f208c0748dc39dcd.exe
                "C:\Users\Admin\AppData\Local\Temp\3c362636f19b4626866ca745bb197ebcc4f2fab1f2bec6b7f208c0748dc39dcd.exe"
                2⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1596
                • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\setup_install.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\setup_install.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1620
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sonia_1.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1556
                    • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_1.exe
                      sonia_1.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1748
                      • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_1.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_1.exe" -a
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1508
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sonia_2.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1344
                    • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_2.exe
                      sonia_2.exe
                      5⤵
                      • Executes dropped EXE
                      PID:1756
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sonia_3.exe
                    4⤵
                      PID:724
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sonia_7.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1408
                      • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_7.exe
                        sonia_7.exe
                        5⤵
                        • Executes dropped EXE
                        PID:972
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sonia_6.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1228
                      • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_6.exe
                        sonia_6.exe
                        5⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Loads dropped DLL
                        PID:1308
                        • C:\Users\Admin\Documents\3dr4a1bPRmEXANrhQfHgYC2W.exe
                          "C:\Users\Admin\Documents\3dr4a1bPRmEXANrhQfHgYC2W.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:2236
                        • C:\Users\Admin\Documents\UxEaDjIOCwZzxjOWnR9vUoiB.exe
                          "C:\Users\Admin\Documents\UxEaDjIOCwZzxjOWnR9vUoiB.exe"
                          6⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2304
                        • C:\Users\Admin\Documents\bL7b1a0nyA9Ffv_hO2RFX7IZ.exe
                          "C:\Users\Admin\Documents\bL7b1a0nyA9Ffv_hO2RFX7IZ.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:2296
                          • C:\Windows\system32\cmd.exe
                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\crypted\main.bat" /s"
                            7⤵
                            • Loads dropped DLL
                            PID:2424
                            • C:\Windows\system32\mode.com
                              mode 65,10
                              8⤵
                                PID:2492
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e file.zip -p29897466628846 -oextracted
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2504
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e extracted/file_5.zip -oextracted
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2524
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e extracted/file_4.zip -oextracted
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2552
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e extracted/file_3.zip -oextracted
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2564
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e extracted/file_2.zip -oextracted
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2584
                              • C:\Users\Admin\AppData\Local\Temp\crypted\7z.exe
                                7z.exe e extracted/file_1.zip -oextracted
                                8⤵
                                • Executes dropped EXE
                                PID:2604
                              • C:\Windows\system32\attrib.exe
                                attrib +H "file5.exe"
                                8⤵
                                • Views/modifies file attributes
                                PID:2616
                              • C:\Users\Admin\AppData\Local\Temp\crypted\file5.exe
                                "file5.exe"
                                8⤵
                                • Executes dropped EXE
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                PID:2632
                          • C:\Users\Admin\Documents\juX85bFTjvQKGrSSLQMUYAed.exe
                            "C:\Users\Admin\Documents\juX85bFTjvQKGrSSLQMUYAed.exe"
                            6⤵
                            • Modifies WinLogon for persistence
                            • Executes dropped EXE
                            PID:2288
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABTAHQAYQByAHQAIABNAGUAbgB1AFwAUAByAG8AZwByAGEAbQBzAFwAVQBwAGQAYQB0AGUAXABVAHAAZABhAHQAZQAuAGUAeABlACcA
                              7⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2600
                          • C:\Users\Admin\Documents\d0JOvpLlrNijfg5x8Eaq1d8x.exe
                            "C:\Users\Admin\Documents\d0JOvpLlrNijfg5x8Eaq1d8x.exe"
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2252
                          • C:\Users\Admin\Documents\VX8mFvpqjsv7qEx7ZtcF3j5d.exe
                            "C:\Users\Admin\Documents\VX8mFvpqjsv7qEx7ZtcF3j5d.exe"
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2260
                          • C:\Users\Admin\Documents\N1k_LdntygLOWEtcQ9nyGiYc.exe
                            "C:\Users\Admin\Documents\N1k_LdntygLOWEtcQ9nyGiYc.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:2720
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /im "N1k_LdntygLOWEtcQ9nyGiYc.exe" /f & erase "C:\Users\Admin\Documents\N1k_LdntygLOWEtcQ9nyGiYc.exe" & exit
                              7⤵
                                PID:2936
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /im "N1k_LdntygLOWEtcQ9nyGiYc.exe" /f
                                  8⤵
                                  • Kills process with taskkill
                                  PID:2992
                            • C:\Users\Admin\Documents\0uiyXPeGH1Mc3rQuGsAyJj8X.exe
                              "C:\Users\Admin\Documents\0uiyXPeGH1Mc3rQuGsAyJj8X.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops startup file
                              • NTFS ADS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2712
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\Users\Admin\Documents\0uiyXPeGH1Mc3rQuGsAyJj8X.exe"
                                7⤵
                                  PID:2564
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\Users\Admin\Documents\0uiyXPeGH1Mc3rQuGsAyJj8X.exe"
                                    8⤵
                                      PID:2732
                                • C:\Users\Admin\Documents\N6E7FSESaGA5T0NXSBTUDnaV.exe
                                  "C:\Users\Admin\Documents\N6E7FSESaGA5T0NXSBTUDnaV.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2752
                                • C:\Users\Admin\Documents\5VB1zipazpcTZk5IEajwReqN.exe
                                  "C:\Users\Admin\Documents\5VB1zipazpcTZk5IEajwReqN.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2744
                                  • C:\Windows\SysWOW64\svchost.exe
                                    "C:\Windows\System32\svchost.exe"
                                    7⤵
                                      PID:2916
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
                                      7⤵
                                        PID:2972
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd
                                          8⤵
                                            PID:2112
                                            • C:\Windows\SysWOW64\find.exe
                                              find /I /N "bullguardcore.exe"
                                              9⤵
                                                PID:2132
                                              • C:\Windows\SysWOW64\tasklist.exe
                                                tasklist /FI "imagename eq BullGuardCore.exe"
                                                9⤵
                                                • Enumerates processes with tasklist
                                                PID:2124
                                        • C:\Users\Admin\Documents\i2cJ84Kwhp6Q9gUVPECIWiBs.exe
                                          "C:\Users\Admin\Documents\i2cJ84Kwhp6Q9gUVPECIWiBs.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2736
                                        • C:\Users\Admin\Documents\yRUm0riQxKMvoWGAtlyVPJ1_.exe
                                          "C:\Users\Admin\Documents\yRUm0riQxKMvoWGAtlyVPJ1_.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2764
                                        • C:\Users\Admin\Documents\Dj4pJUGVlkCflCQYJQmUy0X_.exe
                                          "C:\Users\Admin\Documents\Dj4pJUGVlkCflCQYJQmUy0X_.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2792
                                        • C:\Users\Admin\Documents\LifeTAvGdi2ctUPO1lJGnjBt.exe
                                          "C:\Users\Admin\Documents\LifeTAvGdi2ctUPO1lJGnjBt.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Checks processor information in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2852
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im LifeTAvGdi2ctUPO1lJGnjBt.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\LifeTAvGdi2ctUPO1lJGnjBt.exe" & del C:\ProgramData\*.dll & exit
                                            7⤵
                                              PID:2152
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im LifeTAvGdi2ctUPO1lJGnjBt.exe /f
                                                8⤵
                                                • Kills process with taskkill
                                                PID:2108
                                          • C:\Users\Admin\Documents\1GHIjHTWd42zCEQxaRZAt10L.exe
                                            "C:\Users\Admin\Documents\1GHIjHTWd42zCEQxaRZAt10L.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2844
                                            • C:\Windows\SysWOW64\explorer.exe
                                              "C:\Windows\SysWOW64\explorer.exe"
                                              7⤵
                                              • Adds Run key to start application
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2388
                                          • C:\Users\Admin\Documents\jDpoi_dezL2SdIAV2hYBq4VH.exe
                                            "C:\Users\Admin\Documents\jDpoi_dezL2SdIAV2hYBq4VH.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2832
                                            • C:\Users\Admin\AppData\Local\Temp\7zS822B.tmp\Install.exe
                                              .\Install.exe
                                              7⤵
                                              • Executes dropped EXE
                                              PID:3040
                                              • C:\Users\Admin\AppData\Local\Temp\7zSAC56.tmp\Install.exe
                                                .\Install.exe /S /site_id "525403"
                                                8⤵
                                                • Executes dropped EXE
                                                • Checks BIOS information in registry
                                                • Enumerates system info in registry
                                                PID:2320
                                          • C:\Users\Admin\Documents\zudJqmhe9iFEps8VIlBmKYDx.exe
                                            "C:\Users\Admin\Documents\zudJqmhe9iFEps8VIlBmKYDx.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2884
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sonia_5.exe
                                        4⤵
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:1544
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_5.exe
                                          sonia_5.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1804
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sonia_4.exe
                                        4⤵
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:1088
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC36D2F86\sonia_4.exe
                                          sonia_4.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:796
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 412
                                        4⤵
                                        • Loads dropped DLL
                                        • Program crash
                                        PID:1616
                                • C:\Windows\system32\rUNdlL32.eXe
                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                  1⤵
                                  • Process spawned unexpected child process
                                  PID:2016
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                    2⤵
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1792

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • memory/796-130-0x0000000000940000-0x0000000000948000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1296-142-0x0000000000060000-0x00000000000AC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1596-331-0x0000000002870000-0x000000000298D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1596-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1620-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                  Filesize

                                  572KB

                                • memory/1620-84-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/1620-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/1620-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/1620-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/1620-351-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                  Filesize

                                  572KB

                                • memory/1620-74-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                  Filesize

                                  572KB

                                • memory/1620-85-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-81-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                  Filesize

                                  152KB

                                • memory/1620-87-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-86-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-82-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1620-83-0x0000000000400000-0x000000000051D000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1792-141-0x0000000001F90000-0x0000000002091000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/1792-144-0x0000000000330000-0x000000000038D000-memory.dmp

                                  Filesize

                                  372KB

                                • memory/1804-335-0x000007FEF4F30000-0x000007FEF591C000-memory.dmp

                                  Filesize

                                  9.9MB

                                • memory/1804-153-0x00000000003E0000-0x00000000003E6000-memory.dmp

                                  Filesize

                                  24KB

                                • memory/1804-152-0x0000000000500000-0x000000000052C000-memory.dmp

                                  Filesize

                                  176KB

                                • memory/1804-150-0x00000000003D0000-0x00000000003D6000-memory.dmp

                                  Filesize

                                  24KB

                                • memory/1804-129-0x0000000000B00000-0x0000000000B3E000-memory.dmp

                                  Filesize

                                  248KB

                                • memory/2252-234-0x0000000001E40000-0x0000000001E70000-memory.dmp

                                  Filesize

                                  192KB

                                • memory/2252-275-0x0000000002300000-0x000000000232E000-memory.dmp

                                  Filesize

                                  184KB

                                • memory/2260-215-0x0000000000400000-0x0000000000558000-memory.dmp

                                  Filesize

                                  1.3MB

                                • memory/2260-217-0x0000000001F00000-0x0000000001F60000-memory.dmp

                                  Filesize

                                  384KB

                                • memory/2288-349-0x000000001B680000-0x000000001B71C000-memory.dmp

                                  Filesize

                                  624KB

                                • memory/2288-334-0x0000000000A70000-0x0000000000ABC000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/2288-333-0x000000001B4D0000-0x000000001B584000-memory.dmp

                                  Filesize

                                  720KB

                                • memory/2288-293-0x000000001AE10000-0x000000001AF0C000-memory.dmp

                                  Filesize

                                  1008KB

                                • memory/2288-330-0x000000001B300000-0x000000001B3B8000-memory.dmp

                                  Filesize

                                  736KB

                                • memory/2288-208-0x0000000000F00000-0x0000000001026000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2288-346-0x000000001ACC6000-0x000000001ACC7000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2288-350-0x000000001B720000-0x000000001B76E000-memory.dmp

                                  Filesize

                                  312KB

                                • memory/2288-332-0x000000001AC10000-0x000000001ACC4000-memory.dmp

                                  Filesize

                                  720KB

                                • memory/2288-347-0x0000000000620000-0x0000000000621000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2288-348-0x000000001BAA0000-0x000000001BB2C000-memory.dmp

                                  Filesize

                                  560KB

                                • memory/2288-345-0x000000001BEC0000-0x000000001BF48000-memory.dmp

                                  Filesize

                                  544KB

                                • memory/2296-205-0x000007FEFB5A1000-0x000007FEFB5A3000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2304-216-0x00000000013E0000-0x0000000001513000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2304-226-0x0000000074C70000-0x0000000074CB7000-memory.dmp

                                  Filesize

                                  284KB

                                • memory/2304-209-0x00000000735D0000-0x000000007361A000-memory.dmp

                                  Filesize

                                  296KB

                                • memory/2304-218-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2304-231-0x0000000073330000-0x00000000733B4000-memory.dmp

                                  Filesize

                                  528KB

                                • memory/2304-222-0x0000000075F70000-0x000000007601C000-memory.dmp

                                  Filesize

                                  688KB

                                • memory/2304-227-0x0000000076630000-0x0000000076687000-memory.dmp

                                  Filesize

                                  348KB

                                • memory/2600-344-0x0000000001F44000-0x0000000001F47000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/2600-343-0x000007FEED810000-0x000007FEEE1AD000-memory.dmp

                                  Filesize

                                  9.6MB

                                • memory/2600-341-0x0000000001F4B000-0x0000000001F6A000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/2632-233-0x0000000000D30000-0x0000000000D50000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/2632-342-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2720-326-0x000000000058F000-0x00000000005B6000-memory.dmp

                                  Filesize

                                  156KB

                                • memory/2720-327-0x0000000000400000-0x000000000048F000-memory.dmp

                                  Filesize

                                  572KB

                                • memory/2736-251-0x0000000000400000-0x000000000055A000-memory.dmp

                                  Filesize

                                  1.4MB

                                • memory/2736-254-0x00000000003A0000-0x0000000000400000-memory.dmp

                                  Filesize

                                  384KB

                                • memory/2752-239-0x00000000735D0000-0x000000007361A000-memory.dmp

                                  Filesize

                                  296KB

                                • memory/2752-249-0x0000000000110000-0x0000000000111000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2752-245-0x00000000009C0000-0x0000000000AF1000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2752-246-0x00000000009C0000-0x0000000000AF1000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/2752-256-0x0000000075F70000-0x000000007601C000-memory.dmp

                                  Filesize

                                  688KB

                                • memory/2764-261-0x0000000001F10000-0x0000000001F70000-memory.dmp

                                  Filesize

                                  384KB

                                • memory/2764-259-0x0000000000400000-0x000000000055B000-memory.dmp

                                  Filesize

                                  1.4MB

                                • memory/2792-311-0x0000000000400000-0x000000000055E000-memory.dmp

                                  Filesize

                                  1.4MB

                                • memory/2792-307-0x00000000003E0000-0x00000000003F5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2792-308-0x0000000000560000-0x0000000000588000-memory.dmp

                                  Filesize

                                  160KB

                                • memory/2844-296-0x0000000000400000-0x000000000046F000-memory.dmp

                                  Filesize

                                  444KB

                                • memory/2844-292-0x000000000055F000-0x000000000056F000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2844-294-0x0000000000240000-0x0000000000252000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2884-252-0x00000000735D0000-0x000000007361A000-memory.dmp

                                  Filesize

                                  296KB

                                • memory/2884-255-0x0000000000E80000-0x0000000000FAC000-memory.dmp

                                  Filesize

                                  1.2MB