Analysis

  • max time kernel
    152s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 16:58

General

Malware Config

Extracted

Family

formbook

Version

4.0

C2

http://www.worstig.com/w9z/

Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

Extracted

Family

gozi_rm3

Attributes
  • exe_type

    loader

Extracted

Family

gozi_rm3

Botnet

86920224

C2

https://sibelikinciel.xyz

Attributes
  • build

    300869

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Extracted

Family

danabot

C2

92.204.160.54

2.56.213.179

45.153.186.47

93.115.21.29

185.45.193.50

193.34.166.247

rsa_pubkey.plain

Extracted

Family

formbook

Version

4.1

C2

http://www.joomlas123.com/i0qi/

http://www.norjax.com/app/

Decoy

mytakeawaybox.com

goutaihuo.com

kuzey.site

uppertenpiercings.amsterdam

honeygrandpa.com

jenniferabramslaw.com

ncarian.com

heavilymeditatedhouston.com

gsbjyzx.com

akisanblog.com

taoyuanreed.com

jasperrvservices.com

yabbanet.com

myhealthfuldiet.com

flipdigitalcoins.com

toes.photos

shoottillyoumiss.com

maserental.com

smarteacher.net

hamdimagdeco.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot x86 payload 5 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • AgentTesla Payload 12 IoCs
  • CryptOne packer 5 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Formbook Payload 9 IoCs
  • ReZer0 packer 3 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Executes dropped EXE 11 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\31.exe
      "C:\Users\Admin\AppData\Local\Temp\31.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ADD9.tmp\ADDA.tmp\ADDB.bat C:\Users\Admin\AppData\Local\Temp\31.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          4⤵
            PID:1376
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Users\Admin\AppData\Roaming\2.exe
              C:\Users\Admin\AppData\Roaming\2.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:3972
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2480
          • C:\Users\Admin\AppData\Roaming\4.exe
            C:\Users\Admin\AppData\Roaming\4.exe
            4⤵
            • Executes dropped EXE
            PID:1520
          • C:\Users\Admin\AppData\Roaming\5.exe
            C:\Users\Admin\AppData\Roaming\5.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2556
          • C:\Users\Admin\AppData\Roaming\6.exe
            C:\Users\Admin\AppData\Roaming\6.exe
            4⤵
            • Executes dropped EXE
            PID:3956
          • C:\Users\Admin\AppData\Roaming\7.exe
            C:\Users\Admin\AppData\Roaming\7.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2416
          • C:\Users\Admin\AppData\Roaming\8.exe
            C:\Users\Admin\AppData\Roaming\8.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1444
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
                PID:1796
            • C:\Users\Admin\AppData\Roaming\9.exe
              C:\Users\Admin\AppData\Roaming\9.exe
              4⤵
              • Executes dropped EXE
              PID:2672
            • C:\Users\Admin\AppData\Roaming\10.exe
              C:\Users\Admin\AppData\Roaming\10.exe
              4⤵
              • Executes dropped EXE
              PID:1912
            • C:\Users\Admin\AppData\Roaming\11.exe
              C:\Users\Admin\AppData\Roaming\11.exe
              4⤵
              • Executes dropped EXE
              PID:3176
        • C:\Windows\SysWOW64\cscript.exe
          "C:\Windows\SysWOW64\cscript.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Roaming\2.exe"
            3⤵
              PID:3500

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Yddl\fpxd408ilrlg0pp.exe
        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\18.exe.log
        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8.exe.log
        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9.exe.log
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db.id-58F13080.[Bit_decrypt@protonmail.com].BOMBO
        • C:\Users\Admin\AppData\Local\Temp\ADD9.tmp\ADDA.tmp\ADDB.bat
        • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
        • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
        • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
        • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
        • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
        • C:\Users\Admin\AppData\Local\Temp\tmp5842.tmp
        • C:\Users\Admin\AppData\Local\Temp\tmp5FF3.tmp
        • C:\Users\Admin\AppData\Roaming\1.jar
        • C:\Users\Admin\AppData\Roaming\10.exe
        • C:\Users\Admin\AppData\Roaming\10.exe
        • C:\Users\Admin\AppData\Roaming\11.exe
        • C:\Users\Admin\AppData\Roaming\11.exe
        • C:\Users\Admin\AppData\Roaming\11.exe
        • C:\Users\Admin\AppData\Roaming\12.exe
        • C:\Users\Admin\AppData\Roaming\12.exe
        • C:\Users\Admin\AppData\Roaming\13.exe
        • C:\Users\Admin\AppData\Roaming\13.exe
        • C:\Users\Admin\AppData\Roaming\13.exe
        • C:\Users\Admin\AppData\Roaming\14.exe
        • C:\Users\Admin\AppData\Roaming\14.exe
        • C:\Users\Admin\AppData\Roaming\15.exe
        • C:\Users\Admin\AppData\Roaming\15.exe
        • C:\Users\Admin\AppData\Roaming\16.exe
        • C:\Users\Admin\AppData\Roaming\16.exe
        • C:\Users\Admin\AppData\Roaming\17.exe
        • C:\Users\Admin\AppData\Roaming\17.exe
        • C:\Users\Admin\AppData\Roaming\18.exe
        • C:\Users\Admin\AppData\Roaming\18.exe
        • C:\Users\Admin\AppData\Roaming\19.exe
        • C:\Users\Admin\AppData\Roaming\19.exe
        • C:\Users\Admin\AppData\Roaming\2.exe
        • C:\Users\Admin\AppData\Roaming\2.exe
        • C:\Users\Admin\AppData\Roaming\2.exe
        • C:\Users\Admin\AppData\Roaming\20.exe
        • C:\Users\Admin\AppData\Roaming\20.exe
        • C:\Users\Admin\AppData\Roaming\21.exe
        • C:\Users\Admin\AppData\Roaming\21.exe
        • C:\Users\Admin\AppData\Roaming\21.exe
        • C:\Users\Admin\AppData\Roaming\22.exe
        • C:\Users\Admin\AppData\Roaming\22.exe
        • C:\Users\Admin\AppData\Roaming\23.exe
        • C:\Users\Admin\AppData\Roaming\23.exe
        • C:\Users\Admin\AppData\Roaming\24.exe
        • C:\Users\Admin\AppData\Roaming\24.exe
        • C:\Users\Admin\AppData\Roaming\24.exe
        • C:\Users\Admin\AppData\Roaming\25.exe
        • C:\Users\Admin\AppData\Roaming\25.exe
        • C:\Users\Admin\AppData\Roaming\26.exe
        • C:\Users\Admin\AppData\Roaming\26.exe
        • C:\Users\Admin\AppData\Roaming\27.exe
          MD5

          3d2c6861b6d0899004f8abe7362f45b7

          SHA1

          33855b9a9a52f9183788b169cc5d57e6ad9da994

          SHA256

          dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

          SHA512

          19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

        • C:\Users\Admin\AppData\Roaming\27.exe
          MD5

          3d2c6861b6d0899004f8abe7362f45b7

          SHA1

          33855b9a9a52f9183788b169cc5d57e6ad9da994

          SHA256

          dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

          SHA512

          19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

        • C:\Users\Admin\AppData\Roaming\27.exe
          MD5

          3d2c6861b6d0899004f8abe7362f45b7

          SHA1

          33855b9a9a52f9183788b169cc5d57e6ad9da994

          SHA256

          dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

          SHA512

          19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

        • C:\Users\Admin\AppData\Roaming\28.exe
        • C:\Users\Admin\AppData\Roaming\28.exe
        • C:\Users\Admin\AppData\Roaming\29.exe
        • C:\Users\Admin\AppData\Roaming\29.exe
        • C:\Users\Admin\AppData\Roaming\3.exe
        • C:\Users\Admin\AppData\Roaming\3.exe
        • C:\Users\Admin\AppData\Roaming\3.exe
        • C:\Users\Admin\AppData\Roaming\30.exe
        • C:\Users\Admin\AppData\Roaming\30.exe
        • C:\Users\Admin\AppData\Roaming\31.exe
        • C:\Users\Admin\AppData\Roaming\31.exe
        • C:\Users\Admin\AppData\Roaming\4.dll
          MD5

          986d769a639a877a9b8f4fb3c8616911

          SHA1

          ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

          SHA256

          c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

          SHA512

          3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

        • C:\Users\Admin\AppData\Roaming\4.exe
        • C:\Users\Admin\AppData\Roaming\4.exe
        • C:\Users\Admin\AppData\Roaming\5.exe
        • C:\Users\Admin\AppData\Roaming\5.exe
        • C:\Users\Admin\AppData\Roaming\6.exe
          MD5

          cf04c482d91c7174616fb8e83288065a

          SHA1

          6444eb10ec9092826d712c1efad73e74c2adae14

          SHA256

          7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

          SHA512

          3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

        • C:\Users\Admin\AppData\Roaming\6.exe
          MD5

          cf04c482d91c7174616fb8e83288065a

          SHA1

          6444eb10ec9092826d712c1efad73e74c2adae14

          SHA256

          7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

          SHA512

          3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

        • C:\Users\Admin\AppData\Roaming\7.exe
        • C:\Users\Admin\AppData\Roaming\7.exe
        • C:\Users\Admin\AppData\Roaming\8.exe
          MD5

          dea5598aaf3e9dcc3073ba73d972ab17

          SHA1

          51da8356e81c5acff3c876dffbf52195fe87d97f

          SHA256

          8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

          SHA512

          a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

        • C:\Users\Admin\AppData\Roaming\8.exe
          MD5

          dea5598aaf3e9dcc3073ba73d972ab17

          SHA1

          51da8356e81c5acff3c876dffbf52195fe87d97f

          SHA256

          8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

          SHA512

          a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

        • C:\Users\Admin\AppData\Roaming\9.exe
        • C:\Users\Admin\AppData\Roaming\9.exe
        • C:\Users\Admin\AppData\Roaming\9.exe
        • C:\Users\Admin\AppData\Roaming\9.exe
        • C:\Users\Admin\AppData\Roaming\9.exe
        • C:\Users\Admin\AppData\Roaming\AnLKhBlJfQ.exe
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3341490333-719741536-2920803124-1000\83aa4cc77f591dfc2374580bbd95f6ba_4a1d5b5d-6336-41a4-a4da-b4af65e6deff
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
        • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogim.jpeg
        • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogri.ini
        • C:\Users\Admin\AppData\Roaming\O5N16ST5\O5Nlogrv.ini
        • C:\Users\Admin\AppData\Roaming\feeed.exe
          MD5

          dea5598aaf3e9dcc3073ba73d972ab17

          SHA1

          51da8356e81c5acff3c876dffbf52195fe87d97f

          SHA256

          8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

          SHA512

          a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

        • C:\Users\Admin\AppData\Roaming\feeed.exe
          MD5

          dea5598aaf3e9dcc3073ba73d972ab17

          SHA1

          51da8356e81c5acff3c876dffbf52195fe87d97f

          SHA256

          8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

          SHA512

          a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

        • C:\Users\Admin\AppData\Roaming\wWTxgR.exe
        • \Users\Admin\AppData\Roaming\4.dll
          MD5

          986d769a639a877a9b8f4fb3c8616911

          SHA1

          ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

          SHA256

          c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

          SHA512

          3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

        • \Users\Admin\AppData\Roaming\4.dll
          MD5

          986d769a639a877a9b8f4fb3c8616911

          SHA1

          ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

          SHA256

          c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

          SHA512

          3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

        • \Users\Admin\AppData\Roaming\4.dll
          MD5

          986d769a639a877a9b8f4fb3c8616911

          SHA1

          ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

          SHA256

          c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

          SHA512

          3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

        • \Users\Admin\AppData\Roaming\4.dll
          MD5

          986d769a639a877a9b8f4fb3c8616911

          SHA1

          ba1cc29d845d958bd60c989eaa36fdaf9db7ea41

          SHA256

          c94374155dded12d9f90d16f03470b12b14c4df109a9cf8dbf26e9cd66850457

          SHA512

          3a1e2a6b57278071906ee2d7b1f9ca6d1ed98084c80512da854e5c1f73e480b92f2b1cceccf87523184bf34250e3cb6a0e1172d7f5478777570f807820d9a187

        • memory/136-481-0x0000000000000000-mapping.dmp
        • memory/196-501-0x00000000004015B4-mapping.dmp
        • memory/416-428-0x0000000000000000-mapping.dmp
        • memory/416-427-0x0000000000000000-mapping.dmp
        • memory/560-253-0x0000000000000000-mapping.dmp
        • memory/560-256-0x0000000000000000-mapping.dmp
        • memory/640-353-0x0000000000000000-mapping.dmp
        • memory/728-508-0x0000000000000000-mapping.dmp
        • memory/908-0-0x0000000000000000-mapping.dmp
        • memory/1376-3-0x0000000000000000-mapping.dmp
        • memory/1392-345-0x0000000000000000-mapping.dmp
        • memory/1392-343-0x0000000000000000-mapping.dmp
        • memory/1444-43-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
          Filesize

          4KB

        • memory/1444-37-0x0000000000000000-mapping.dmp
        • memory/1444-53-0x0000000005590000-0x000000000559F000-memory.dmp
          Filesize

          60KB

        • memory/1444-77-0x00000000065B0000-0x00000000065B1000-memory.dmp
          Filesize

          4KB

        • memory/1444-75-0x00000000058C0000-0x00000000058C2000-memory.dmp
          Filesize

          8KB

        • memory/1444-42-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/1444-38-0x0000000000000000-mapping.dmp
        • memory/1444-78-0x00000000058D0000-0x00000000058D2000-memory.dmp
          Filesize

          8KB

        • memory/1444-57-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
          Filesize

          4KB

        • memory/1444-60-0x00000000057B0000-0x00000000057B1000-memory.dmp
          Filesize

          4KB

        • memory/1444-58-0x00000000056A0000-0x00000000056A2000-memory.dmp
          Filesize

          8KB

        • memory/1516-99-0x0000000000000000-mapping.dmp
        • memory/1516-100-0x0000000000000000-mapping.dmp
        • memory/1520-16-0x0000000000000000-mapping.dmp
        • memory/1520-105-0x00000000036B0000-0x00000000036B1000-memory.dmp
          Filesize

          4KB

        • memory/1520-18-0x0000000000000000-mapping.dmp
        • memory/1564-380-0x0000000005430000-0x00000000055C2000-memory.dmp
          Filesize

          1.6MB

        • memory/1564-336-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
          Filesize

          4KB

        • memory/1564-329-0x0000000000810000-0x0000000000811000-memory.dmp
          Filesize

          4KB

        • memory/1564-324-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/1564-407-0x0000000005960000-0x0000000005961000-memory.dmp
          Filesize

          4KB

        • memory/1564-406-0x00000000051C0000-0x00000000051C1000-memory.dmp
          Filesize

          4KB

        • memory/1564-320-0x0000000000000000-mapping.dmp
        • memory/1564-318-0x0000000000000000-mapping.dmp
        • memory/1796-81-0x0000000000000000-mapping.dmp
        • memory/1836-467-0x0000000006CD0000-0x0000000006CD1000-memory.dmp
          Filesize

          4KB

        • memory/1836-237-0x0000000000000000-mapping.dmp
        • memory/1836-244-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/1912-68-0x0000000000000000-mapping.dmp
        • memory/1912-131-0x00000000030D3000-0x00000000030D4000-memory.dmp
          Filesize

          4KB

        • memory/1912-133-0x0000000003360000-0x0000000003361000-memory.dmp
          Filesize

          4KB

        • memory/1912-70-0x0000000000000000-mapping.dmp
        • memory/2068-471-0x0000000000000000-mapping.dmp
        • memory/2068-469-0x0000000000000000-mapping.dmp
        • memory/2080-458-0x0000000000000000-mapping.dmp
        • memory/2080-460-0x0000000000000000-mapping.dmp
        • memory/2412-45-0x0000000000000000-mapping.dmp
        • memory/2412-479-0x0000000006330000-0x0000000006442000-memory.dmp
          Filesize

          1.1MB

        • memory/2412-46-0x0000000000D00000-0x0000000000D27000-memory.dmp
          Filesize

          156KB

        • memory/2412-48-0x0000000000D00000-0x0000000000D27000-memory.dmp
          Filesize

          156KB

        • memory/2412-147-0x00000000056A0000-0x000000000580F000-memory.dmp
          Filesize

          1.4MB

        • memory/2416-32-0x0000000000000000-mapping.dmp
        • memory/2416-31-0x0000000000000000-mapping.dmp
        • memory/2480-9-0x0000000000000000-mapping.dmp
        • memory/2480-8-0x0000000000000000-mapping.dmp
        • memory/2556-22-0x0000000000000000-mapping.dmp
        • memory/2556-21-0x0000000000000000-mapping.dmp
        • memory/2672-85-0x00000000089F0000-0x00000000089F1000-memory.dmp
          Filesize

          4KB

        • memory/2672-79-0x0000000005640000-0x0000000005642000-memory.dmp
          Filesize

          8KB

        • memory/2672-69-0x00000000051F0000-0x00000000051F1000-memory.dmp
          Filesize

          4KB

        • memory/2672-61-0x0000000000900000-0x0000000000901000-memory.dmp
          Filesize

          4KB

        • memory/2672-56-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/2672-52-0x0000000000000000-mapping.dmp
        • memory/2672-83-0x00000000088E0000-0x0000000008933000-memory.dmp
          Filesize

          332KB

        • memory/2672-50-0x0000000000000000-mapping.dmp
        • memory/2880-5-0x0000000000000000-mapping.dmp
        • memory/2880-4-0x0000000000000000-mapping.dmp
        • memory/2900-295-0x0000000000000000-mapping.dmp
        • memory/2900-293-0x0000000000000000-mapping.dmp
        • memory/3176-86-0x0000000000000000-mapping.dmp
        • memory/3176-88-0x0000000000000000-mapping.dmp
        • memory/3500-74-0x0000000000000000-mapping.dmp
        • memory/3956-39-0x00000000006A0000-0x00000000006B0000-memory.dmp
          Filesize

          64KB

        • memory/3956-27-0x0000000000000000-mapping.dmp
        • memory/3956-26-0x0000000000000000-mapping.dmp
        • memory/3972-14-0x000000000041E2D0-mapping.dmp
        • memory/3972-13-0x0000000000400000-0x000000000042D000-memory.dmp
          Filesize

          180KB

        • memory/4032-340-0x0000000000449E3E-mapping.dmp
        • memory/4032-338-0x0000000000400000-0x000000000044E000-memory.dmp
          Filesize

          312KB

        • memory/4124-484-0x0000000000000000-mapping.dmp
        • memory/4156-108-0x0000000000000000-mapping.dmp
        • memory/4164-212-0x0000000000000000-mapping.dmp
        • memory/4164-215-0x0000000000000000-mapping.dmp
        • memory/4208-113-0x0000000000000000-mapping.dmp
        • memory/4208-111-0x0000000000000000-mapping.dmp
        • memory/4224-219-0x0000000000000000-mapping.dmp
        • memory/4284-286-0x0000000003240000-0x0000000003241000-memory.dmp
          Filesize

          4KB

        • memory/4284-279-0x0000000003013000-0x0000000003014000-memory.dmp
          Filesize

          4KB

        • memory/4284-122-0x0000000000000000-mapping.dmp
        • memory/4284-124-0x0000000000000000-mapping.dmp
        • memory/4324-411-0x0000000000000000-mapping.dmp
        • memory/4324-456-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
          Filesize

          64KB

        • memory/4324-443-0x0000000004BE0000-0x0000000004C3D000-memory.dmp
          Filesize

          372KB

        • memory/4324-417-0x0000000000290000-0x0000000000291000-memory.dmp
          Filesize

          4KB

        • memory/4324-414-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/4324-466-0x0000000008370000-0x00000000083C1000-memory.dmp
          Filesize

          324KB

        • memory/4324-410-0x0000000000000000-mapping.dmp
        • memory/4332-238-0x0000000000000000-mapping.dmp
        • memory/4376-134-0x0000000000000000-mapping.dmp
        • memory/4376-136-0x0000000000000000-mapping.dmp
        • memory/4412-139-0x00000000004015B0-mapping.dmp
        • memory/4480-248-0x0000000000000000-mapping.dmp
        • memory/4484-420-0x0000000000000000-mapping.dmp
        • memory/4484-421-0x0000000000000000-mapping.dmp
        • memory/4504-151-0x0000000000000000-mapping.dmp
        • memory/4504-150-0x0000000000000000-mapping.dmp
        • memory/4552-155-0x0000000000000000-mapping.dmp
        • memory/4568-453-0x000000000041E270-mapping.dmp
        • memory/4568-452-0x0000000000400000-0x000000000042D000-memory.dmp
          Filesize

          180KB

        • memory/4796-377-0x0000000003073000-0x0000000003074000-memory.dmp
          Filesize

          4KB

        • memory/4796-164-0x0000000000000000-mapping.dmp
        • memory/4796-386-0x0000000003160000-0x0000000003161000-memory.dmp
          Filesize

          4KB

        • memory/4796-163-0x0000000000000000-mapping.dmp
        • memory/4820-333-0x0000000000000000-mapping.dmp
        • memory/4832-434-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/4832-431-0x000000000044C82E-mapping.dmp
        • memory/4832-429-0x0000000000400000-0x0000000000452000-memory.dmp
          Filesize

          328KB

        • memory/4872-415-0x00000000085A0000-0x00000000085F3000-memory.dmp
          Filesize

          332KB

        • memory/4872-374-0x0000000000A80000-0x0000000000A81000-memory.dmp
          Filesize

          4KB

        • memory/4872-369-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/4872-365-0x0000000000000000-mapping.dmp
        • memory/4872-363-0x0000000000000000-mapping.dmp
        • memory/4896-485-0x000000000044CF8E-mapping.dmp
        • memory/4896-490-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/4896-483-0x0000000000400000-0x0000000000452000-memory.dmp
          Filesize

          328KB

        • memory/4912-476-0x0000000000000000-mapping.dmp
        • memory/4912-478-0x0000000000F40000-0x0000000000F59000-memory.dmp
          Filesize

          100KB

        • memory/4912-477-0x0000000000F40000-0x0000000000F59000-memory.dmp
          Filesize

          100KB

        • memory/4932-186-0x0000000000000000-mapping.dmp
        • memory/4932-189-0x0000000000000000-mapping.dmp
        • memory/4932-210-0x0000000004F60000-0x0000000004FAD000-memory.dmp
          Filesize

          308KB

        • memory/4932-202-0x00000000005C0000-0x00000000005C1000-memory.dmp
          Filesize

          4KB

        • memory/4932-193-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/4932-213-0x0000000004FF0000-0x000000000502A000-memory.dmp
          Filesize

          232KB

        • memory/4936-503-0x0000000002760000-0x0000000002761000-memory.dmp
          Filesize

          4KB

        • memory/4936-461-0x0000000000000000-mapping.dmp
        • memory/4948-444-0x0000000000000000-mapping.dmp
        • memory/4948-446-0x0000000000000000-mapping.dmp
        • memory/4948-498-0x0000000003770000-0x0000000003771000-memory.dmp
          Filesize

          4KB

        • memory/4956-395-0x0000000000000000-mapping.dmp
        • memory/4956-398-0x0000000000000000-mapping.dmp
        • memory/4964-384-0x00000000004015B4-mapping.dmp
        • memory/5012-291-0x00000000712F0000-0x00000000719DE000-memory.dmp
          Filesize

          6.9MB

        • memory/5012-455-0x0000000005730000-0x0000000005731000-memory.dmp
          Filesize

          4KB

        • memory/5012-284-0x0000000000400000-0x0000000000452000-memory.dmp
          Filesize

          328KB

        • memory/5012-287-0x000000000044CCFE-mapping.dmp
        • memory/5044-198-0x0000000000000000-mapping.dmp
        • memory/5052-308-0x0000000000000000-mapping.dmp
        • memory/5052-480-0x0000000000000000-mapping.dmp
        • memory/5052-312-0x0000000000EB0000-0x00000000012EF000-memory.dmp
          Filesize

          4.2MB

        • memory/5052-315-0x0000000000EB0000-0x00000000012EF000-memory.dmp
          Filesize

          4.2MB

        • memory/5052-442-0x0000000004A90000-0x0000000004B6E000-memory.dmp
          Filesize

          888KB

        • memory/5080-201-0x0000000000000000-mapping.dmp