skuld | f31b0285f3bccd657e9b591732186a807584901d2ab8924897fa679ed1b39a1b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EzFN-Manager.exe
Size

3.8MB
MD5

2edfa42f0313ebe2b05d0d3961deaf3b
SHA1

82ba26770f8a59297e668a6ca95b4049c82b67e3
SHA256

f31b0285f3bccd657e9b591732186a807584901d2ab8924897fa679ed1b39a1b
SHA512

4bfe9e9766677aaf6e630ec8e653f9d61a75677e34b15661f3f04889b5c1397d9e06fb2e81bf7cda1e46fd00139528a4412278b6882ffcf78278ab0a69714378
SSDEEP

49152:GQyw/FgZl3Vslwr1ymub72iQkxDonnrxxxqNWN/l4itPBFGsDJjr6uas4:yw/K33VslU8zQkxkrhNzXZDFFZ4

Score

10^/10

skuld xworm discovery execution persistence rat stealer trojan upx

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1309150098055495793/k9e9xgOw-6_C2plzzrJuXKnk0n6rjOfFwyNN15kYdvJC528Av5hMa6QHDC_kqeEBzjsS

Extracted

Family

xworm

Version

5.0

ezfn57.serveo.net:4782

Mutex

s6QNsQsMG6xRRrJT

Attributes

Install_directory
%ProgramData%
install_file
WinRar.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1620-27-0x0000000000400000-0x0000000000438000-memory.dmp	family_xworm

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4012	powershell.exe
212	powershell.exe
2952	powershell.exe
2540	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	EzFN-Manager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRar.lnk	WinRAR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinRar.lnk	WinRAR.exe

Executes dropped EXE 7 IoCs

pid	Process
3752	WinRAR.exe
1788	Microsoft Teams.exe
1620	WinRAR.exe
2676	WinRar.exe
3172	WinRar.exe
3988	WinRar.exe
4824	WinRar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	Microsoft Teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinRar = "C:\\ProgramData\\WinRar.exe"	WinRAR.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 1620	3752	WinRAR.exe	100
PID 2676 set thread context of 3172	2676	WinRar.exe	117
PID 3988 set thread context of 4824	3988	WinRar.exe	119

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b71-17.dat	upx
behavioral2/memory/1788-22-0x0000000000960000-0x00000000013C5000-memory.dmp	upx
behavioral2/memory/1788-26-0x0000000000960000-0x00000000013C5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2540	powershell.exe
2540	powershell.exe
4012	powershell.exe
4012	powershell.exe
212	powershell.exe
212	powershell.exe
2952	powershell.exe
2952	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	WinRAR.exe
Token: SeDebugPrivilege	1788	Microsoft Teams.exe
Token: SeDebugPrivilege	1620	WinRAR.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1620	WinRAR.exe
Token: SeDebugPrivilege	2676	WinRar.exe
Token: SeDebugPrivilege	3172	WinRar.exe
Token: SeDebugPrivilege	3988	WinRar.exe
Token: SeDebugPrivilege	4824	WinRar.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3752	4748	EzFN-Manager.exe	83
PID 4748 wrote to memory of 3752	4748	EzFN-Manager.exe	83
PID 4748 wrote to memory of 3752	4748	EzFN-Manager.exe	83
PID 4748 wrote to memory of 1788	4748	EzFN-Manager.exe	84
PID 4748 wrote to memory of 1788	4748	EzFN-Manager.exe	84
PID 1788 wrote to memory of 1476	1788	Microsoft Teams.exe	86
PID 1788 wrote to memory of 1476	1788	Microsoft Teams.exe	86
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 3752 wrote to memory of 1620	3752	WinRAR.exe	100
PID 1620 wrote to memory of 2540	1620	WinRAR.exe	102
PID 1620 wrote to memory of 2540	1620	WinRAR.exe	102
PID 1620 wrote to memory of 2540	1620	WinRAR.exe	102
PID 1620 wrote to memory of 4012	1620	WinRAR.exe	104
PID 1620 wrote to memory of 4012	1620	WinRAR.exe	104
PID 1620 wrote to memory of 4012	1620	WinRAR.exe	104
PID 1620 wrote to memory of 212	1620	WinRAR.exe	106
PID 1620 wrote to memory of 212	1620	WinRAR.exe	106
PID 1620 wrote to memory of 212	1620	WinRAR.exe	106
PID 1620 wrote to memory of 2952	1620	WinRAR.exe	108
PID 1620 wrote to memory of 2952	1620	WinRAR.exe	108
PID 1620 wrote to memory of 2952	1620	WinRAR.exe	108
PID 1620 wrote to memory of 3244	1620	WinRAR.exe	110
PID 1620 wrote to memory of 3244	1620	WinRAR.exe	110
PID 1620 wrote to memory of 3244	1620	WinRAR.exe	110
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 2676 wrote to memory of 3172	2676	WinRar.exe	117
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119
PID 3988 wrote to memory of 4824	3988	WinRar.exe	119

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1476	attrib.exe

C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe
"C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Roaming\WinRAR.exe
  "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Roaming\WinRAR.exe
    "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRAR.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2540
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRAR.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4012
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WinRar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:212
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRar" /tr "C:\ProgramData\WinRar.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3244
- C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
    3⤵
    - Views/modifies file attributes
    PID:1476

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3172

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988
- C:\ProgramData\WinRar.exe
  "C:\ProgramData\WinRar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinRAR.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
5f7bc1c55c7c3e60e8129a9fbba4ab53

SHA1
24cfddd2418d1d1caedeac2279fd74beccc348e9

SHA256
0686f8a9f3c2ec3bbd0f18b22cc61fe2822df5a636f39a2cc54388e67cce67cb

SHA512
4a41093837a1784dbe62c6cbefc975731628b898931bb95d56cc5c13642538a3b30053cc9240c03171df181baae4e73279b666b9f0efc078f89182de864684ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ad3d3377fb133af67d5be3a4175446a5

SHA1
a21078ced9549c12889c06b2432337b6ee212f20

SHA256
5b25de0fb7da9862a5a806a34d7252b709f5648d6062e8e56d2d7d6aa9ac960b

SHA512
ae6cd3fef5038e7d49303167a35e00bc97375dc251865815b7ec9add1962052f1c7e7b66810f079f4f7cc30cd5be5fe40216485aa7b1f8572e8c329ab354d7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
fa82f01a5bbed55a5c9ff9db3ef133f4

SHA1
bc3dc3072aef579a576b3716332e611807ecff94

SHA256
7fce55f94ab146dcd96c91b5f1984dcd9e4458738f2b1974974cd4067f29dcbd

SHA512
a80bc4cab9d7a642e2e2dbc3a02b53d853f38c1378e48a8aba067f462030efe8f2801668288db0b5d8d04b187fd4b1c2cb8220b8ea821ba59cfa31955b493d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3imrfm1z.3h3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe

Filesize
3.3MB

MD5
ffa33049612a638a2f40c2a89722a6f4

SHA1
a453ea7f4c26dbe56d547988d8afe5fbf642e7df

SHA256
589e6cc7481b257d46466116096f4df95a41daaca908a661a528dd3b658e4ea2

SHA512
e7f05a846dd9cdf20f1330569974b4b2f677f34e74b32964836c6c38b6902c25109dea3259b64543a525a4af49bfb9011ad58365d6c597bc78f99f84aa79c927

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR.exe

Filesize
379KB

MD5
49129093416a454d99955d5ac0eea133

SHA1
587263d5c272c0a351aa5d2d5818e1c317c5f712

SHA256
fd1aa71f521f8d6bccda3129f55960d844e5b7dd2374476cc6693df4d1d7ebf7

SHA512
1958d9c48e1900d2854134c7df9772d3fca7af8020b22916d94931b814a0ca4f9b2e9a92cdefa1c5ff5338d72d122ee6485b649ef6db2268cccc105a42e9ff70

Download Submit
memory/212-98-0x0000000005A00000-0x0000000005D54000-memory.dmp

Filesize
3.3MB

Download
memory/212-107-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/1620-27-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1620-31-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/1620-32-0x0000000005200000-0x0000000005266000-memory.dmp

Filesize
408KB

Download
memory/1788-26-0x0000000000960000-0x00000000013C5000-memory.dmp

Filesize
10.4MB

Download
memory/1788-22-0x0000000000960000-0x00000000013C5000-memory.dmp

Filesize
10.4MB

Download
memory/2540-49-0x0000000006590000-0x00000000065C2000-memory.dmp

Filesize
200KB

Download
memory/2540-66-0x0000000007500000-0x0000000007511000-memory.dmp

Filesize
68KB

Download
memory/2540-46-0x0000000005B30000-0x0000000005E84000-memory.dmp

Filesize
3.3MB

Download
memory/2540-47-0x0000000005FF0000-0x000000000600E000-memory.dmp

Filesize
120KB

Download
memory/2540-48-0x0000000006010000-0x000000000605C000-memory.dmp

Filesize
304KB

Download
memory/2540-33-0x00000000026B0000-0x00000000026E6000-memory.dmp

Filesize
216KB

Download
memory/2540-50-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/2540-60-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/2540-61-0x00000000071F0000-0x0000000007293000-memory.dmp

Filesize
652KB

Download
memory/2540-62-0x0000000007940000-0x0000000007FBA000-memory.dmp

Filesize
6.5MB

Download
memory/2540-63-0x0000000007300000-0x000000000731A000-memory.dmp

Filesize
104KB

Download
memory/2540-64-0x0000000007370000-0x000000000737A000-memory.dmp

Filesize
40KB

Download
memory/2540-65-0x0000000007580000-0x0000000007616000-memory.dmp

Filesize
600KB

Download
memory/2540-36-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/2540-67-0x0000000007530000-0x000000000753E000-memory.dmp

Filesize
56KB

Download
memory/2540-68-0x0000000007540000-0x0000000007554000-memory.dmp

Filesize
80KB

Download
memory/2540-69-0x0000000007640000-0x000000000765A000-memory.dmp

Filesize
104KB

Download
memory/2540-70-0x0000000007620000-0x0000000007628000-memory.dmp

Filesize
32KB

Download
memory/2540-35-0x0000000005840000-0x0000000005862000-memory.dmp

Filesize
136KB

Download
memory/2540-34-0x00000000051E0000-0x0000000005808000-memory.dmp

Filesize
6.2MB

Download
memory/2952-128-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/3752-23-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

Filesize
4KB

Download
memory/3752-21-0x0000000000490000-0x00000000004F4000-memory.dmp

Filesize
400KB

Download
memory/4012-79-0x0000000006290000-0x00000000065E4000-memory.dmp

Filesize
3.3MB

Download
memory/4012-85-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/4748-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

Filesize
8KB

Download
memory/4748-1-0x00000000006B0000-0x0000000000A86000-memory.dmp

Filesize
3.8MB

Download