Resubmissions

23-04-2023 15:37

230423-s2h1lsfh4y 10

23-04-2023 15:33

230423-szlcysec39 7

Analysis

  • max time kernel
    62s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2023 15:33

General

  • Target

    Venom_Cracked_2.7.0.0.exe

  • Size

    33.2MB

  • MD5

    8111c089c5129f5c9735e76c57d31020

  • SHA1

    0d2ccd0c2fd34b78078c43ce7571fa91621223fa

  • SHA256

    b37423358c0e708701938d06e3aa121aaec6e9c1f57fefbc302e22489dd6639d

  • SHA512

    df99f76054278729a654e2af748030a39acf401975281462f7f673b45b640d2e1254f72865804bd5a89616e52972b2016242f5fb0c5f999adedec7962787e576

  • SSDEEP

    786432:PjGGIhIroPgwam6vSYjC2UXnAwLsu4J+QcFR5p4:7G9GUPgbXUXnAyY+QcXT4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 18 IoCs
  • Obfuscated with Agile.Net obfuscator 16 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Venom_Cracked_2.7.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Venom_Cracked_2.7.0.0.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Users\Admin\Desktop\27\crack.exe
      "C:\Users\Admin\Desktop\27\crack.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      PID:3168
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4628
    • C:\Users\Admin\Desktop\27\VenomRemote Crack.exe
      "C:\Users\Admin\Desktop\27\VenomRemote Crack.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4704

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\27\Bunifu.Licensing.dll
      Filesize

      952KB

      MD5

      e1ac1fb368968bc2b93ad0dce092feae

      SHA1

      ebbe3e24c92e6f48851b8baa31d3652d922f14eb

      SHA256

      2b14b242e1f07081406b24a032fb4d29413e10b9f9760d1c3d06bdcec0615c94

      SHA512

      f8b299a97cf67f8526b31ab86191e147c74a05bb664eea00a032b93f695199a82652470e121040721491993ec621c64158bade0d623b2eac7fb59982ffa346df

    • C:\Users\Admin\Desktop\27\Bunifu.Licensing.dll
      Filesize

      952KB

      MD5

      e1ac1fb368968bc2b93ad0dce092feae

      SHA1

      ebbe3e24c92e6f48851b8baa31d3652d922f14eb

      SHA256

      2b14b242e1f07081406b24a032fb4d29413e10b9f9760d1c3d06bdcec0615c94

      SHA512

      f8b299a97cf67f8526b31ab86191e147c74a05bb664eea00a032b93f695199a82652470e121040721491993ec621c64158bade0d623b2eac7fb59982ffa346df

    • C:\Users\Admin\Desktop\27\Bunifu.Licensing.dll
      Filesize

      952KB

      MD5

      e1ac1fb368968bc2b93ad0dce092feae

      SHA1

      ebbe3e24c92e6f48851b8baa31d3652d922f14eb

      SHA256

      2b14b242e1f07081406b24a032fb4d29413e10b9f9760d1c3d06bdcec0615c94

      SHA512

      f8b299a97cf67f8526b31ab86191e147c74a05bb664eea00a032b93f695199a82652470e121040721491993ec621c64158bade0d623b2eac7fb59982ffa346df

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.1.5.3.dll
      Filesize

      344KB

      MD5

      b4280d2898d92ab5c3911f0305d7672f

      SHA1

      0ef4d6fa24811cea3cb36fccbc45d71e1effb17d

      SHA256

      e2248459dcc95183d0f0c5f3abd3b0a2b93cd26cf8e130a1f43c8b32c58f4c8f

      SHA512

      2c719c32144ce2968123dc8e3a6f61f70460e463ba9b3681dc86e124af1343d08e574f7313339ecef4b88f95d2fd9ad56462f0f9e5f9f51ba5de6ba19559af2e

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.1.5.3.dll
      Filesize

      344KB

      MD5

      b4280d2898d92ab5c3911f0305d7672f

      SHA1

      0ef4d6fa24811cea3cb36fccbc45d71e1effb17d

      SHA256

      e2248459dcc95183d0f0c5f3abd3b0a2b93cd26cf8e130a1f43c8b32c58f4c8f

      SHA512

      2c719c32144ce2968123dc8e3a6f61f70460e463ba9b3681dc86e124af1343d08e574f7313339ecef4b88f95d2fd9ad56462f0f9e5f9f51ba5de6ba19559af2e

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.1.5.3.dll
      Filesize

      344KB

      MD5

      b4280d2898d92ab5c3911f0305d7672f

      SHA1

      0ef4d6fa24811cea3cb36fccbc45d71e1effb17d

      SHA256

      e2248459dcc95183d0f0c5f3abd3b0a2b93cd26cf8e130a1f43c8b32c58f4c8f

      SHA512

      2c719c32144ce2968123dc8e3a6f61f70460e463ba9b3681dc86e124af1343d08e574f7313339ecef4b88f95d2fd9ad56462f0f9e5f9f51ba5de6ba19559af2e

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuLabel.dll
      Filesize

      421KB

      MD5

      16aba889da5f1d67170d1103408254e0

      SHA1

      9b23576dbd8397858fb2673d622f74cbb9e0f6a1

      SHA256

      e49b2ba7002bcdd1e3a16f13913b4816c262e3e40eeafbacc5981098c7a6f236

      SHA512

      c6baf41223ecb5df209b14e14b496d40a65a163d6c222efe0f71c606496239f7eaa2bbd7c55fac07b5fff6b7cf18ff3af78805a3ae95c828216f5e5469226b17

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuLabel.dll
      Filesize

      421KB

      MD5

      16aba889da5f1d67170d1103408254e0

      SHA1

      9b23576dbd8397858fb2673d622f74cbb9e0f6a1

      SHA256

      e49b2ba7002bcdd1e3a16f13913b4816c262e3e40eeafbacc5981098c7a6f236

      SHA512

      c6baf41223ecb5df209b14e14b496d40a65a163d6c222efe0f71c606496239f7eaa2bbd7c55fac07b5fff6b7cf18ff3af78805a3ae95c828216f5e5469226b17

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuLabel.dll
      Filesize

      421KB

      MD5

      16aba889da5f1d67170d1103408254e0

      SHA1

      9b23576dbd8397858fb2673d622f74cbb9e0f6a1

      SHA256

      e49b2ba7002bcdd1e3a16f13913b4816c262e3e40eeafbacc5981098c7a6f236

      SHA512

      c6baf41223ecb5df209b14e14b496d40a65a163d6c222efe0f71c606496239f7eaa2bbd7c55fac07b5fff6b7cf18ff3af78805a3ae95c828216f5e5469226b17

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuPictureBox.dll
      Filesize

      37KB

      MD5

      ac858624e0eb40339ee6a1f0218c9fb5

      SHA1

      74beefb858b8fafe433e563ad7c4aa3ffe708e57

      SHA256

      8fd5a954f45d3fa8b6d0b15667b225455ff425058efa44d5e31e0c082974d649

      SHA512

      bebb8e3a89ce77563e328eed3ad2acec58a8566b259dc145497f119da97efbdcc3bd13eea0bad57a365e4bd0844aee7fc5ec8a911459f2941804cca806917971

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuPictureBox.dll
      Filesize

      37KB

      MD5

      ac858624e0eb40339ee6a1f0218c9fb5

      SHA1

      74beefb858b8fafe433e563ad7c4aa3ffe708e57

      SHA256

      8fd5a954f45d3fa8b6d0b15667b225455ff425058efa44d5e31e0c082974d649

      SHA512

      bebb8e3a89ce77563e328eed3ad2acec58a8566b259dc145497f119da97efbdcc3bd13eea0bad57a365e4bd0844aee7fc5ec8a911459f2941804cca806917971

    • C:\Users\Admin\Desktop\27\Bunifu.UI.WinForms.BunifuPictureBox.dll
      Filesize

      37KB

      MD5

      ac858624e0eb40339ee6a1f0218c9fb5

      SHA1

      74beefb858b8fafe433e563ad7c4aa3ffe708e57

      SHA256

      8fd5a954f45d3fa8b6d0b15667b225455ff425058efa44d5e31e0c082974d649

      SHA512

      bebb8e3a89ce77563e328eed3ad2acec58a8566b259dc145497f119da97efbdcc3bd13eea0bad57a365e4bd0844aee7fc5ec8a911459f2941804cca806917971

    • C:\Users\Admin\Desktop\27\Guna.UI.dll
      Filesize

      1.1MB

      MD5

      8673eae95d67e5eb19f0eca3111408e8

      SHA1

      ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb

      SHA256

      576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d

      SHA512

      65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239

    • C:\Users\Admin\Desktop\27\Guna.UI.dll
      Filesize

      1.1MB

      MD5

      8673eae95d67e5eb19f0eca3111408e8

      SHA1

      ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb

      SHA256

      576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d

      SHA512

      65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239

    • C:\Users\Admin\Desktop\27\Guna.UI.dll
      Filesize

      1.1MB

      MD5

      8673eae95d67e5eb19f0eca3111408e8

      SHA1

      ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb

      SHA256

      576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d

      SHA512

      65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239

    • C:\Users\Admin\Desktop\27\Lizard.dll
      Filesize

      60KB

      MD5

      dbb1422d126136762b21068ce1b5a9a2

      SHA1

      22d376f516f578ebcb24f58aefd22cdae266dfe8

      SHA256

      819e2c74401bbed1c6a653299e5a3a6bf7451de708e845420a71b8a55d199a44

      SHA512

      c74a9a7335c144ae8e45d0329d0f2066385fed60d2be265c2ee6b1cfcf926bd5dbf4861afe64410ce083f7b27d7452cbd04b98b13f0185b63fb917f695e95f87

    • C:\Users\Admin\Desktop\27\Lizard.dll
      Filesize

      60KB

      MD5

      dbb1422d126136762b21068ce1b5a9a2

      SHA1

      22d376f516f578ebcb24f58aefd22cdae266dfe8

      SHA256

      819e2c74401bbed1c6a653299e5a3a6bf7451de708e845420a71b8a55d199a44

      SHA512

      c74a9a7335c144ae8e45d0329d0f2066385fed60d2be265c2ee6b1cfcf926bd5dbf4861afe64410ce083f7b27d7452cbd04b98b13f0185b63fb917f695e95f87

    • C:\Users\Admin\Desktop\27\Lizard.dll
      Filesize

      60KB

      MD5

      dbb1422d126136762b21068ce1b5a9a2

      SHA1

      22d376f516f578ebcb24f58aefd22cdae266dfe8

      SHA256

      819e2c74401bbed1c6a653299e5a3a6bf7451de708e845420a71b8a55d199a44

      SHA512

      c74a9a7335c144ae8e45d0329d0f2066385fed60d2be265c2ee6b1cfcf926bd5dbf4861afe64410ce083f7b27d7452cbd04b98b13f0185b63fb917f695e95f87

    • C:\Users\Admin\Desktop\27\LizardEditor.dll
      Filesize

      27KB

      MD5

      efca64b3ee07c75874568c51e40b8709

      SHA1

      4f617f831bd5687648076ba01463388050cc44cb

      SHA256

      63bde565533b7138a023cda8d4170efe55f6fd3a34750da45a7a2037bd4b4544

      SHA512

      6213fafe65f1293c65c3cc93abab698f41f6a8d8de79c75a9f4d3987f2b5d6a49a5627bef87695090edda7173ad905dfbfa02ba59ad6dcb12010c31371685be7

    • C:\Users\Admin\Desktop\27\LizardEditor.dll
      Filesize

      27KB

      MD5

      efca64b3ee07c75874568c51e40b8709

      SHA1

      4f617f831bd5687648076ba01463388050cc44cb

      SHA256

      63bde565533b7138a023cda8d4170efe55f6fd3a34750da45a7a2037bd4b4544

      SHA512

      6213fafe65f1293c65c3cc93abab698f41f6a8d8de79c75a9f4d3987f2b5d6a49a5627bef87695090edda7173ad905dfbfa02ba59ad6dcb12010c31371685be7

    • C:\Users\Admin\Desktop\27\LizardEditor.dll
      Filesize

      27KB

      MD5

      efca64b3ee07c75874568c51e40b8709

      SHA1

      4f617f831bd5687648076ba01463388050cc44cb

      SHA256

      63bde565533b7138a023cda8d4170efe55f6fd3a34750da45a7a2037bd4b4544

      SHA512

      6213fafe65f1293c65c3cc93abab698f41f6a8d8de79c75a9f4d3987f2b5d6a49a5627bef87695090edda7173ad905dfbfa02ba59ad6dcb12010c31371685be7

    • C:\Users\Admin\Desktop\27\Mono.Nat.dll
      Filesize

      40KB

      MD5

      bf929442b12d4b5f9906b29834bf7db1

      SHA1

      810a2b3c8e548d1df931538bc304cc1405f7a32b

      SHA256

      b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0

      SHA512

      9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828

    • C:\Users\Admin\Desktop\27\Mono.Nat.dll
      Filesize

      40KB

      MD5

      bf929442b12d4b5f9906b29834bf7db1

      SHA1

      810a2b3c8e548d1df931538bc304cc1405f7a32b

      SHA256

      b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0

      SHA512

      9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828

    • C:\Users\Admin\Desktop\27\Mono.Nat.dll
      Filesize

      40KB

      MD5

      bf929442b12d4b5f9906b29834bf7db1

      SHA1

      810a2b3c8e548d1df931538bc304cc1405f7a32b

      SHA256

      b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0

      SHA512

      9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828

    • C:\Users\Admin\Desktop\27\Siticone.UI.dll
      Filesize

      1.3MB

      MD5

      750c58af2e56b6addecffcf152520ab8

      SHA1

      14995e7f1d12498606d9d209d78d55fe6fd87802

      SHA256

      27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26

      SHA512

      2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5

    • C:\Users\Admin\Desktop\27\Siticone.UI.dll
      Filesize

      1.3MB

      MD5

      750c58af2e56b6addecffcf152520ab8

      SHA1

      14995e7f1d12498606d9d209d78d55fe6fd87802

      SHA256

      27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26

      SHA512

      2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5

    • C:\Users\Admin\Desktop\27\Siticone.UI.dll
      Filesize

      1.3MB

      MD5

      750c58af2e56b6addecffcf152520ab8

      SHA1

      14995e7f1d12498606d9d209d78d55fe6fd87802

      SHA256

      27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26

      SHA512

      2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5

    • C:\Users\Admin\Desktop\27\VenomRemote Crack.exe
      Filesize

      31.1MB

      MD5

      db903965c52af774d289195dca43c4f0

      SHA1

      3dfc35def11c626a573f499991e63c853d06d94f

      SHA256

      71a41259ae1af738009b67f8941abda7d0c4d4a718cfbe1e9139241b99870ce9

      SHA512

      b424a5245eeb937a28607b35e3549f9169f65bf73b7baf790deb081e7894ea17cc7c30f42c6084f01b6a1b46ae76efe62fb12252f23f1ff641440718f40a7155

    • C:\Users\Admin\Desktop\27\VenomRemote Crack.exe
      Filesize

      31.1MB

      MD5

      db903965c52af774d289195dca43c4f0

      SHA1

      3dfc35def11c626a573f499991e63c853d06d94f

      SHA256

      71a41259ae1af738009b67f8941abda7d0c4d4a718cfbe1e9139241b99870ce9

      SHA512

      b424a5245eeb937a28607b35e3549f9169f65bf73b7baf790deb081e7894ea17cc7c30f42c6084f01b6a1b46ae76efe62fb12252f23f1ff641440718f40a7155

    • C:\Users\Admin\Desktop\27\crack.exe
      Filesize

      18KB

      MD5

      b441b71b1ce23257d6f40bd7555703ac

      SHA1

      961d3ae7e69b7a39edda340e93986c5a7f89c097

      SHA256

      eeaacd0b7e68cc5e5a183dc5f6e8b489cf267a73ebd772b338873f9e04e2b7a4

      SHA512

      e4f67e81e8f83b211a8c4bbaa0ff96d02341ff3fe6a83ffac0aefb62507afb0fa823fe43e3d4e3dd0b4a680393e6980adc92cea5286998109c828faf657c4a8b

    • C:\Users\Admin\Desktop\27\crack.exe
      Filesize

      18KB

      MD5

      b441b71b1ce23257d6f40bd7555703ac

      SHA1

      961d3ae7e69b7a39edda340e93986c5a7f89c097

      SHA256

      eeaacd0b7e68cc5e5a183dc5f6e8b489cf267a73ebd772b338873f9e04e2b7a4

      SHA512

      e4f67e81e8f83b211a8c4bbaa0ff96d02341ff3fe6a83ffac0aefb62507afb0fa823fe43e3d4e3dd0b4a680393e6980adc92cea5286998109c828faf657c4a8b

    • C:\Users\Admin\Desktop\27\crack.exe
      Filesize

      18KB

      MD5

      b441b71b1ce23257d6f40bd7555703ac

      SHA1

      961d3ae7e69b7a39edda340e93986c5a7f89c097

      SHA256

      eeaacd0b7e68cc5e5a183dc5f6e8b489cf267a73ebd772b338873f9e04e2b7a4

      SHA512

      e4f67e81e8f83b211a8c4bbaa0ff96d02341ff3fe6a83ffac0aefb62507afb0fa823fe43e3d4e3dd0b4a680393e6980adc92cea5286998109c828faf657c4a8b

    • C:\Users\Admin\Desktop\27\settings.xml
      Filesize

      468B

      MD5

      506428df61b7b40e268a0ec3122b98d0

      SHA1

      c9a8211bf2b24e107606cfa97715c206ea27df5a

      SHA256

      0337aca93f77f6547cc57240f09ea13bfd0fe438528f9172cd9af306cce8cbaa

      SHA512

      d2a01da9d9ad477d8f00403fdd343b05fc83347886a95f768f68e28b0d229cad323133d32508c6df4ce3c40159e1b5e2f872b7eadfb73a2b94ba47b07ec48529

    • memory/3168-498-0x0000000000800000-0x000000000080C000-memory.dmp
      Filesize

      48KB

    • memory/3168-501-0x0000000002880000-0x0000000002890000-memory.dmp
      Filesize

      64KB

    • memory/3168-502-0x0000000002880000-0x0000000002890000-memory.dmp
      Filesize

      64KB

    • memory/4704-513-0x0000000007590000-0x00000000075A0000-memory.dmp
      Filesize

      64KB

    • memory/4704-523-0x000000000CF20000-0x000000000CFBC000-memory.dmp
      Filesize

      624KB

    • memory/4704-512-0x00000000076F0000-0x000000000783E000-memory.dmp
      Filesize

      1.3MB

    • memory/4704-508-0x0000000007300000-0x000000000730A000-memory.dmp
      Filesize

      40KB

    • memory/4704-507-0x0000000007320000-0x00000000073B2000-memory.dmp
      Filesize

      584KB

    • memory/4704-538-0x000000000CDE0000-0x000000000CDEE000-memory.dmp
      Filesize

      56KB

    • memory/4704-506-0x00000000078D0000-0x0000000007E74000-memory.dmp
      Filesize

      5.6MB

    • memory/4704-505-0x0000000000A30000-0x000000000294C000-memory.dmp
      Filesize

      31.1MB

    • memory/4704-542-0x000000000D390000-0x000000000D39E000-memory.dmp
      Filesize

      56KB

    • memory/4704-533-0x000000000D3B0000-0x000000000D41E000-memory.dmp
      Filesize

      440KB

    • memory/4704-529-0x0000000007590000-0x00000000075A0000-memory.dmp
      Filesize

      64KB

    • memory/4704-528-0x0000000007590000-0x00000000075A0000-memory.dmp
      Filesize

      64KB

    • memory/4704-546-0x000000000D990000-0x000000000DA84000-memory.dmp
      Filesize

      976KB

    • memory/4704-514-0x0000000007590000-0x00000000075A0000-memory.dmp
      Filesize

      64KB

    • memory/4704-527-0x000000000D320000-0x000000000D336000-memory.dmp
      Filesize

      88KB

    • memory/4704-518-0x000000000CC80000-0x000000000CCDA000-memory.dmp
      Filesize

      360KB

    • memory/4704-552-0x0000000011240000-0x0000000011250000-memory.dmp
      Filesize

      64KB

    • memory/4704-522-0x000000000CE00000-0x000000000CF1A000-memory.dmp
      Filesize

      1.1MB