Analysis

  • max time kernel
    147s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14/05/2021, 10:02

General

  • Target

    fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe

  • Size

    745KB

  • MD5

    4f47f2fa563304efe9fffb13b32427f4

  • SHA1

    97cc4db66c9636bd47031cb9e4a667643be9ee89

  • SHA256

    fe68a629898384bb2edf90406da4c9d6764fd04e5337514e7edd9c2c608d2242

  • SHA512

    a359e40931c6124e6b2dfce44b107fdad8e439d10dc1dba018d4c62c9bbca88f8bb2788249d810c3c91dd542461dd659b0472af746fd79455c246b7e5dddec03

Malware Config

Extracted

Family

cryptbot

C2

remdny42.top

morpgr04.top

Attributes
  • payload_url

    http://sulnom06.top/download.php?file=lv.exe

Extracted

Family

danabot

Version

1827

Botnet

3

C2

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot Payload 4 IoCs
  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe
    "C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\SfPFs.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\SfPFs.exe
        "C:\Users\Admin\AppData\Local\Temp\SfPFs.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
          "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c IEupGZtiGuhYLuXTzhQLTFqwaOOuZUNPiXjCGSSBCwddKCJqvZSswXKrDtQRkYoManQNUcjBcfoRgKsQyNJZwvOljoY
            5⤵
              PID:1176
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c wqfETEXjLVywMsVMOSOTMqMbfoKWJGBLvKmxZEYKNytlIHjJAevzxyPwgRfKUwCyxxEeSBMpUtuHVBPHVqcHl
              5⤵
                PID:2428
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c ssVbyofhQLCZQhelRYdjmfZiuNwIO
                5⤵
                  PID:2756
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c FVUjrhucvEUGgxyWLCELpvsYHwsOsauGnWuHtDlPrcCLsSwFepwmtrKoDWEwWartbgisgbRisOINUFGOqMMidHCcjXtiYpSKsngrLJsEaUifxWgYdQwpGWNQLLydzJooVXvv
                  5⤵
                    PID:736
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c DrdciOcmhwdIyRoiJtcKnsZEqkIMZzbASGMMKOmiadnKOHhRZqjSqLSj
                    5⤵
                      PID:2040
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c LxVuJATDQQnycvUFhso
                      5⤵
                        PID:3244
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c fQaXQMYuEmuOmJZzDwIPFuYQOMEDahNzKxNVeXfXCNZdKKFMbBwkJzhoRBptoxOdLMryVrsFMLjSiHuriRuQkBKsuFtAOlPiYIEYHmQzlvmXucwpcyXdgXylwLZdZQRBW
                        5⤵
                          PID:184
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c TmeovHqMGPeMkLDUyIhnSqDx
                          5⤵
                            PID:2972
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c VAAzzFXwqBCuhJffCsfigAhMyLogbjSVIkAiAahlyLlpwORYXpdJhjHcjNgHvIDOJGnepoOpryeDftLdTpdgWpIcDtUNrFNvovAxfPPPxuFiltuieXNhafRmYenthwunsGcSEdqtxBUQ
                            5⤵
                              PID:1200
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c AknYMKyRArSEqvhdKBaqiQDJhDLWJTRcwWbRquBdqGRDCgDUNNJZBQcKHOLoZooHjbDtYcdEqwZBYqiYqQpVpRTkA
                              5⤵
                                PID:2436
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c lkcadRbldtLnWavyZmQULHHMopZjbxEsDkkypIKirOJrhBUQmrSzcGwDEIpiSkMVmzVKisWsOIQXXDnHgpNxClWXpIBAnDfSeNDUGpJiiBFMPrFqlCS
                                5⤵
                                  PID:3996
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c bazfbXAmPvSkzXVpqEqyAFjwFloyeBdWKGcJxhvJIpsLIzaRovZFBNoRyaKhPcvgyWBMCkOMisvdhBakRdXFBKxXbDEeDpThNrFMSGf
                                  5⤵
                                    PID:2080
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c HjnldSDDZncnbRMcCDgYGMpXboClWFzlwqYfklGFZqetNxQWdplgsdfVeAMifzHzykbvTbpaXJZGKypeaGTMctSKLejKbnfGzIYCXxrTqSdIsJkXsJPImVYqaNLQlnUmzahwuGyYDqLDN
                                    5⤵
                                      PID:1760
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c zwRgzNJGibKXlpIjIBXRgYvpRKEQympxhizJZV
                                      5⤵
                                        PID:772
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c iPNkPsovVfsspGVVxEHbJpS
                                        5⤵
                                          PID:732
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c HhfKeQYhMbQeBNHSIhIANoqNskYysncXWjDCwbzydrEMQTxGXPOcAsNmhCzQRTWgwSyglyRlUCpKEhXbRai
                                          5⤵
                                            PID:684
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c JZbEntgmtCgbifLYOuvSXDBXoeVZEWZmLzEwxAPyQausgMDgCZIKVfEunmvcofUiDPLNLJDgddeFvlJcmHbFhg
                                            5⤵
                                              PID:3028
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c vPnDVrzXBbYNmqPCTcxxEhZJhPwWBSgUgkfYjyHkWzBibvlxKtDlTTZoPPfyebcIptmgKQfNNpnlMRkRFGkbgtqxki
                                              5⤵
                                                PID:2132
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c bQConYSYzXWKTOQvKcOcYDnmcjXxtryeD
                                                5⤵
                                                  PID:2484
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c SWkqqjUTSUJWsJbHdZvLlTseNjwbTfSTukWTkJcCBtLEQmUgWvNyFSbYFojNkvZCePPuMEvGEUpuiNjhaMBvBMggOYgevHsyypCqJ
                                                  5⤵
                                                    PID:2976
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c BsquBLIsQRWZcnVCqfBBsOdxpWCtqYkkEElpvclCGbivybkTpCojnovNwFWEoDdRGKxRhLyFyYVTGTgLLJUnQYNcibiRnFzeidQcrzFnvCumhDuoslTmI
                                                    5⤵
                                                      PID:2044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c QTiOfHdCBoHxLdwvwNIQbnNnOoEJqH & LsYakXYEXnGEvHrLYMdqwJpJayIqurHBTfWeNYPnroKaRTsQKbGWKGReogZufXnUQtKuLqYZWRXSYRSnNRfJvKRhbTUnYJpyKQBNpkyJnGZSJZtscBabHPnujvIRumwhIRi & fygCMGlPKZDnPDrbdMnVscAMCgDZFMpS & VwdjPLwEIchTlwDvEWWzjQUFBZbrkpYPLHTBMlAqvdIqhTajZCwPjnEyuLKPhYamvbiDowJzcVWViUsIHkrJioDjeOcwmLNnXpDQMPtYSIzsCJXjzeowUJshUUAzGI & KonXYsBWRiyQmPjKzRpIbCMDgSfWRgKalPJotLYVRudTPTRnIpiBbZcovUJywFtCvNFKurGHShQskSOxqRgIipVlzBMpwSTkeNbwhiaECmIpptWDygylsvchScsFdvGZzEfn & MiTnJyHALwgEptMNJUFslpSQNguTIPEPnoaijLIsOMuzeqiaTjKKJulDgeLxYOSWbm & qLEBYjgDbrnNNiNZvyTysXPTpqh & ZUpWDTiHfLMnxCNAQfXhkOcRDzOeVLsXYWDDTBlTquKLzcLPlfeUequkna & pttLDzOmbYpGftthytKniHZRFJbUYPayBiwOVxisEWhQwINPYNwuNTjByhyUVTB & FryirfsKXaTlxoQWVIWkOjsHUmJIgjcKcFlXDGLJcdpcZwiXvoYhXdTzMnjEGIvKWoPOXSzfWjPbrWHTsLkygoNyMRktzirMUnnRj & ZEPIdKAvdQRzjUbdcOcKeuGgWPpeCEbQGZLGdFReEfAchqUofEeKcBdTXAMB & nTMaqMhoQZQXauMFkwWUqMXBNxtISJQTfAyvOejhHZmFjNecDhMnQGALVlFGHEdioWHSqdRpOIhqhafZaJtE & seJZzAEvGFeJsvfulchvCKizAbCVGhYAMpRTYSGQhMirlsVWZTigRixHVfmWXJQaGCWoFvoaOvpQCtooBGVMuKIEPpYIaKTEWPvIcNsDLPmxYEtRudxdNtjWTsacbmZrDETNHANOgaqdlg & lyiCwdCQSCAOrcWyjPvQzKdlFDGecrVLFLifdXXNwOwkuMKaajOAOnjAOXWnKmcPGPpahGPgRIOFJyrTShKpgxWunHBzwmrCa & EsCsyLvAJuJHQITeFvPjAkSeTFychaFjhvBMdAiYMOL & bRRSmYTGMuLamAnAGqjdAvzxiiMtfQmMAwEeOjWfnZAuKojPeHaLBcdqbvLakOsVGZSbVcLxtXRBWhJYUWeHnOltLEFsADrJHEALdPUHVYGEDOrlMNbfMJvRONMsQ & TATiTaMYIyexLAiGBXAxENuOXYiIWCeDQBtyLcULbOyahsXWKokPQcPyxtlVltey & nElcwUuePWQIOBFqk & OdhNxMZLGlZAzMZfONNBIhyMqnYbGDFUZyhOOLpbvdgVrgDtInNRhJfAkBMVNBtrEtBhnkAeDfysYlJLVUOiPNHfPMDhZgKUjldYNfFbYKgXEYCqRqZSNWhRbjbLIjrgElyNTKYGgsptmJKRl & vYgRifXmAARUOLHZaxSOiiwzEcMosOBGBuQtqNrQQzpnOxDnbmddZvxgXUhLCOiMZkaIUDZFdwXNXDFpSgLRbk & tLBiymshejbnDwUDUALZXmHszftThrffNEgXzcTuZNVBAtwiXLRsMkIFrpNQcbZYWiLYNXpnHEqpDuRfhWWCjYDCVJTpIrLBN & EazrxZBaJikmwXanCnBbMXEpettqQETncHBmVpCWwTgcdvHWRpAjqdpGNlqdVBCyhNrxcTCaVEcTJpSFvooGtGbybULLpjqAspiCzjAYHiscUdXEsxTNaVwGfYXBiQpJEVBAwfjpHlYW & wluXuzOahiciAhcfZQQXHRYPbDwoJyiXtshNQDwvcdsNuaAeQTIx & ZHlksADaFJiqnrpZHmcPzCsAkJteYsP & NOyJrCmrbtPHpNHfsrpxhEObdKqHcAzhTKjJYmVyZssgMKdbwPLVoxpoqIaaCRIXLCNmAYs & ircVhmKGxCGGPnynArJfiCDoJxDlWRWrbUNyZgVBXMYZkwihbgYvgwKEAhkSVAJDFCoVKqmjiiaxEDWIjdNISAOvpoEMerFvecxITjCbPMgiIfqXdDFFNwKyNMLCcN & tCVsopgOqOdSukHNUiHcmbZJwLgUuAZwwCl & MXSNeOFQboEUuYRxOsKHDjdbVzHmOgQDqrwWfTzKRojSuzOoJEhKSCqAHcSJuywoawTeXVyUYZPxqndBEmQlwuKneBf & wKDMutAyAMkNnaMTNGAoystHgRukdcZvGkTgcrhVYlqShrLJxRKvquOJFWbfXgPtMPijnnbKzEpUdjzkyvRmKDcmbpImFYXKcWynVnlWzqevXUzaCjpBbfzoxIPgPYyxGmnxu & fHjVyKAYCDQdWaOvjyCXthJWuxVIQbcYkHWCfClJHcykbmeMFpjzSpReXfOKPSotoStfcjiKVSfIibnHaoeGlwyePUEZNmUOhqrFcNszeCbZTpUARuaGQBUuMwmBHoXvYAxuzSjFR & C:\Windows\system32\cmd < Sta.vssm
                                                      5⤵
                                                        PID:1336
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd
                                                          6⤵
                                                            PID:192
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr /V /R "^hSpSigSzxLDGSondFTKDkxVhNUxDcdcqRWsJEwXjjqzRIWcClcFKPiZTXVtjTfXtfCOWROMEVndkqrEQnSaqLLlJWbMIWL$" Cui.vssm
                                                              7⤵
                                                                PID:3928
                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com
                                                                Accostarmi.exe.com c
                                                                7⤵
                                                                • Executes dropped EXE
                                                                PID:3648
                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com
                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.com c
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Checks processor information in registry
                                                                  • Modifies registry class
                                                                  PID:1492
                                                                  • C:\Users\Admin\AppData\Local\Temp\fkwvufq.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\fkwvufq.exe"
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    PID:2432
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\FKWVUF~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\fkwvufq.exe
                                                                      10⤵
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2072
                                                                      • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                                        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\FKWVUF~1.DLL,VUwJLDbbBYw=
                                                                        11⤵
                                                                        • Blocklisted process makes network request
                                                                        • Loads dropped DLL
                                                                        • Checks processor information in registry
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:416
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp8444.tmp.ps1"
                                                                          12⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2268
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9945.tmp.ps1"
                                                                          12⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:196
                                                                          • C:\Windows\SysWOW64\nslookup.exe
                                                                            "C:\Windows\system32\nslookup.exe" -type=any localhost
                                                                            13⤵
                                                                              PID:2272
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                                                                            12⤵
                                                                              PID:3524
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                                                                              12⤵
                                                                                PID:2348
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exuirdymvtr.vbs"
                                                                          9⤵
                                                                            PID:4020
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sycamsasstse.vbs"
                                                                            9⤵
                                                                            • Blocklisted process makes network request
                                                                            • Modifies system certificate store
                                                                            PID:3968
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        ping 127.0.0.1 -n 30
                                                                        7⤵
                                                                        • Runs ping.exe
                                                                        PID:684
                                                                • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops startup file
                                                                  PID:2768
                                                                  • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                    PID:3296
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\npjIgdZuyT & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\fe68a629898384bb2edf90406da4c9d6764fd04e53375.exe"
                                                              2⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2848
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 3
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:2120

                                                          Network

                                                                MITRE ATT&CK Enterprise v6

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • memory/196-236-0x00000000080A0000-0x00000000080A1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/196-255-0x0000000004C93000-0x0000000004C94000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/196-239-0x0000000008510000-0x0000000008511000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/196-243-0x0000000004C92000-0x0000000004C93000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/196-242-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/416-240-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/416-198-0x00000000050D1000-0x0000000005730000-memory.dmp

                                                                  Filesize

                                                                  6.4MB

                                                                • memory/416-197-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/416-194-0x0000000004500000-0x0000000004AC5000-memory.dmp

                                                                  Filesize

                                                                  5.8MB

                                                                • memory/1492-177-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2072-196-0x0000000003320000-0x0000000003321000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2072-195-0x0000000005631000-0x0000000005C90000-memory.dmp

                                                                  Filesize

                                                                  6.4MB

                                                                • memory/2268-219-0x0000000009C30000-0x0000000009C31000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-226-0x0000000004933000-0x0000000004934000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-211-0x00000000085A0000-0x00000000085A1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-210-0x0000000008040000-0x0000000008041000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-209-0x0000000004932000-0x0000000004933000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-220-0x00000000091C0000-0x00000000091C1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-221-0x0000000009490000-0x0000000009491000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-208-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-207-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-214-0x0000000008570000-0x0000000008571000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-206-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-205-0x0000000007C80000-0x0000000007C81000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-212-0x0000000008450000-0x0000000008451000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-202-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-203-0x0000000007390000-0x0000000007391000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2268-204-0x0000000007A00000-0x0000000007A01000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/2432-183-0x0000000002F10000-0x0000000003617000-memory.dmp

                                                                  Filesize

                                                                  7.0MB

                                                                • memory/2432-188-0x0000000000B20000-0x0000000000BCE000-memory.dmp

                                                                  Filesize

                                                                  696KB

                                                                • memory/2432-187-0x0000000000400000-0x0000000000B14000-memory.dmp

                                                                  Filesize

                                                                  7.1MB

                                                                • memory/2768-172-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                  Filesize

                                                                  388KB

                                                                • memory/2768-171-0x00000000004F0000-0x000000000063A000-memory.dmp

                                                                  Filesize

                                                                  1.3MB

                                                                • memory/3296-174-0x0000000000470000-0x00000000005BA000-memory.dmp

                                                                  Filesize

                                                                  1.3MB

                                                                • memory/3296-175-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                  Filesize

                                                                  388KB

                                                                • memory/3984-114-0x0000000002170000-0x0000000002251000-memory.dmp

                                                                  Filesize

                                                                  900KB

                                                                • memory/3984-115-0x0000000000400000-0x00000000004E5000-memory.dmp

                                                                  Filesize

                                                                  916KB