Overview

overview

10

Static

static

7

Aurora.exe

windows7-x64

10

Aurora.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 18:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Aurora.exe

  • Size

    21.3MB

  • MD5

    54b11d48df518b331d6e26e991cb7b07

  • SHA1

    ac4ac7f296744fef3bdba55600e99b7e50196b45

  • SHA256

    cad0ea7aa29ccb61cd2c595e27921c89e6fed8b0275d86c5560fcde21a1554bc

  • SHA512

    bf40e890b14162dbbb170579806a81293040dd7855eabf4cdaa14849aeb3cb5ea9f7b017cec7d9bc5a6f934f4f320e97aecb486eaea1aef8fda6fec0ad507b1b

  • SSDEEP

    393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF

Score
10/10
quasarredlinesectopratxmrigcheatthemdasdiscoveryevasionexecutioninfostealerminerpersistenceratspywarethemidatrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

154.81.220.233:28105

Extracted

Family

quasar

Version

1.4.1

Botnet

themdas

C2

auroraforge.art:55326

thesirenmika.com:55713
Mutex

0cbdfe7f-0215-41e8-a7b5-d4fbbc555089

Attributes
  • encryption_key

    A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1

  • install_name

    up2.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 11 IoCs
    miner
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Power Settings 1 TTPs 10 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1180
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:2948
        • C:\Users\Admin\AppData\Local\Temp\Aurora.exe
          "C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
            "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2632
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:2736
              • C:\Windows\system32\cmd.exe
                cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"
                5⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:2588
                • C:\Windows\system32\PING.EXE
                  ping localhost -n 1
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2656
                • C:\Windows\system32\attrib.exe
                  attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"
                  6⤵
                  • Sets file to hidden
                  • Views/modifies file attributes
                  PID:2516
                • C:\Windows\system32\icacls.exe
                  icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
                  6⤵
                  • Modifies file permissions
                  PID:2996
                • C:\Windows\system32\cmd.exe
                  cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe
                  6⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:2116
                  • C:\Users\Admin\AppData\Local\Msedge.exe
                    C:\Users\Admin\AppData\Local\Msedge.exe
                    7⤵
                    • Executes dropped EXE
                    PID:1780
          • C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2692
          • C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
            "C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
              4⤵
              • Adds Run key to start application
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1688
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:712
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:1812
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              #cmd
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1588
          • C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
            "C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1816
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Power Settings
          • Suspicious use of WriteProcessMemory
          PID:744
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2552
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:984
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2852
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2820
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2812
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"
          2⤵
            PID:2872
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
            2⤵
            • Power Settings
            PID:2968
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1552
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:940
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-ac 0
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2980
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-dc 0
              3⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3024
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2156
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe
            2⤵
              PID:1772
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:836
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {1A26D33A-DC73-4887-90A6-97674B90630B} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]
            1⤵
            • Loads dropped DLL
            PID:2808
            • C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
              C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              PID:2452

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Power Settings

                1
                T1653

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                File and Directory Permissions Modification

                1
                T1222

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Modify Registry

                1
                T1112

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Discovery

                Query Registry

                3
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Virtualization/Sandbox Evasion

                1
                T1497

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
                  Filesize

                  80KB

                  MD5

                  65f0a85c4b056d6bcee60c49e2372e35

                  SHA1

                  6af820a2030950617bf150777af4a43a06a17184

                  SHA256

                  d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e

                  SHA512

                  7a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\84MVDLRRDCVMHDKUZLHE.temp
                  Filesize

                  7KB

                  MD5

                  581189de7671aadc3fe5c076dabf0405

                  SHA1

                  f7b729d938665b99778e4153cd1bc3094aba3e16

                  SHA256

                  dea43dc2bc682a2e75b9b825953748214b99f4335745ed29d9fbb53fcea6d5ef

                  SHA512

                  32a35e7a3f3e6cc9fb8645e795bc2f384d1381ebf11c0d1c9e1006e6589319cf8d337036c162dbc71240a97c0b296e126d4d8610243e2faed45d35c8e1cbc095

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
                  Filesize

                  3.2MB

                  MD5

                  3b4f58cd4bca7274be25e885be00798b

                  SHA1

                  eb57c281d8324a1079db97c9da43483a65debbed

                  SHA256

                  a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80

                  SHA512

                  dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
                  Filesize

                  5.6MB

                  MD5

                  b9fc8581b52abfc6b563da731438e27d

                  SHA1

                  43111fe9b307c850a379fe2d64d279e994680de3

                  SHA256

                  e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058

                  SHA512

                  c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5

                  Download Submit

                • \Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
                  Filesize

                  95KB

                  MD5

                  c9a9d471428a5f92068c0823e6454254

                  SHA1

                  8b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2

                  SHA256

                  b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5

                  SHA512

                  ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af

                  Download Submit

                • memory/836-99-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-93-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-90-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-105-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-103-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-88-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-86-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-83-0x00000000000B0000-0x00000000000D0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/836-97-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-95-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/836-101-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/1072-63-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/1072-64-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/1588-52-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-54-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1588-56-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-55-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-57-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-46-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-49-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1588-50-0x0000000000400000-0x0000000000724000-memory.dmp

                  Filesize

                  3.1MB

                  Download

                • memory/1772-85-0x0000000140000000-0x0000000140029000-memory.dmp

                  Filesize

                  164KB

                  Download

                • memory/1772-89-0x0000000140000000-0x0000000140029000-memory.dmp

                  Filesize

                  164KB

                  Download

                • memory/1816-67-0x000000013F8A0000-0x000000013FE3A000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/1816-58-0x000000013F8A0000-0x000000013FE3A000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/1944-3-0x00000000764C0000-0x0000000076507000-memory.dmp

                  Filesize

                  284KB

                  Download

                • memory/1944-7-0x00000000764C0000-0x0000000076507000-memory.dmp

                  Filesize

                  284KB

                  Download

                • memory/1944-0-0x00000000000C0000-0x0000000001B8A000-memory.dmp

                  Filesize

                  26.8MB

                  Download

                • memory/1944-40-0x00000000000C0000-0x0000000001B8A000-memory.dmp

                  Filesize

                  26.8MB

                  Download

                • memory/1944-39-0x00000000764C0000-0x0000000076507000-memory.dmp

                  Filesize

                  284KB

                  Download

                • memory/1944-2-0x00000000764C0000-0x0000000076507000-memory.dmp

                  Filesize

                  284KB

                  Download

                • memory/1944-1-0x00000000764CE000-0x00000000764CF000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2452-84-0x000000013FF00000-0x000000014049A000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2452-71-0x000000013FF00000-0x000000014049A000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2636-32-0x0000000000360000-0x000000000068E000-memory.dmp

                  Filesize

                  3.2MB

                  Download

                • memory/2692-31-0x0000000000290000-0x00000000002AE000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/3024-78-0x00000000027B0000-0x00000000027B8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/3024-77-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                  Filesize

                  2.9MB

                  Download