Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    28-09-2021 23:35

General

  • Target

    e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe

  • Size

    180KB

  • MD5

    e5cf31523f01f3791bf0d2dbf2a232c4

  • SHA1

    d992d4c7ff035d4dc730620924625d58be4bd4a6

  • SHA256

    e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e

  • SHA512

    83df9bc5351733b06adaa04f35bd3027c13ad995ea7bfde9c5ec60405c92bc5174718b80c54d1393917b3039efc26b09620807b5a995154902b3572ac3dda06c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

777777

C2

193.56.146.60:18243

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 10 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe
    "C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe
      "C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2380
  • C:\Users\Admin\AppData\Local\Temp\FE2C.exe
    C:\Users\Admin\AppData\Local\Temp\FE2C.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2772
  • C:\Users\Admin\AppData\Local\Temp\E5A.exe
    C:\Users\Admin\AppData\Local\Temp\E5A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvqav023\qvqav023.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F5C.tmp" "c:\Users\Admin\AppData\Local\Temp\qvqav023\CSC910D04A1CFB74B189A724FDF7928163.TMP"
          4⤵
            PID:1560
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
            PID:4960
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
              PID:4972
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
              3⤵
                PID:4544
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                3⤵
                • Modifies registry key
                PID:4600
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                3⤵
                  PID:4628
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                  3⤵
                    PID:4824
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                      4⤵
                        PID:4852
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                      3⤵
                        PID:4908
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net start rdpdr
                          4⤵
                            PID:4456
                            • C:\Windows\SysWOW64\net.exe
                              net start rdpdr
                              5⤵
                                PID:4916
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 start rdpdr
                                  6⤵
                                    PID:4340
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                              3⤵
                                PID:4992
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c net start TermService
                                  4⤵
                                    PID:4924
                                    • C:\Windows\SysWOW64\net.exe
                                      net start TermService
                                      5⤵
                                        PID:5024
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 start TermService
                                          6⤵
                                            PID:5044
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                                      3⤵
                                        PID:2772
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                        3⤵
                                          PID:4988
                                    • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                      C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Windows security modification
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2332
                                      • C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2328
                                        • C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe
                                          "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe" /SpecialRun 4101d8 2328
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3920
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\17A2.exe" -Force
                                        2⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3840
                                      • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\17A2.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:2360
                                      • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\17A2.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2512
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2200
                                        2⤵
                                        • Drops file in Windows directory
                                        • Program crash
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2240
                                    • C:\Users\Admin\AppData\Local\Temp\4952.exe
                                      C:\Users\Admin\AppData\Local\Temp\4952.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      • Modifies system certificate store
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2468
                                      • C:\Windows\SysWOW64\msiexec.exe
                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4952.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632871995 " AI_EUIMSI=""
                                        2⤵
                                        • Enumerates connected drives
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4648
                                    • C:\Windows\system32\msiexec.exe
                                      C:\Windows\system32\msiexec.exe /V
                                      1⤵
                                      • Enumerates connected drives
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4276
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 3EEAA976552A483B3E3EF6D886ECBA20 C
                                        2⤵
                                        • Loads dropped DLL
                                        PID:4444
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 174C41CFE0FB8E18375AF88AF883D32B
                                        2⤵
                                        • Loads dropped DLL
                                        PID:4936
                                      • C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe
                                        "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        PID:4388
                                        • C:\ProgramData\Zenar_protected\Zenar_protected.exe
                                          "C:\ProgramData\Zenar_protected\Zenar_protected.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Checks BIOS information in registry
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          PID:2892
                                    • C:\Users\Admin\AppData\Local\Temp\6528.exe
                                      C:\Users\Admin\AppData\Local\Temp\6528.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:4112
                                      • C:\Users\Admin\AppData\Local\Temp\is-621I7.tmp\6528.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-621I7.tmp\6528.tmp" /SL5="$80118,4844586,831488,C:\Users\Admin\AppData\Local\Temp\6528.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:4148
                                        • C:\Users\Admin\AppData\Local\Temp\6528.exe
                                          "C:\Users\Admin\AppData\Local\Temp\6528.exe" /VERYSILENT
                                          3⤵
                                          • Executes dropped EXE
                                          PID:4320
                                          • C:\Users\Admin\AppData\Local\Temp\is-8L012.tmp\6528.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-8L012.tmp\6528.tmp" /SL5="$90118,4844586,831488,C:\Users\Admin\AppData\Local\Temp\6528.exe" /VERYSILENT
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4408
                                            • C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe
                                              "C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4920

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/2176-117-0x0000000000490000-0x000000000053E000-memory.dmp

                                      Filesize

                                      696KB

                                    • memory/2332-142-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2332-144-0x0000000005730000-0x00000000057A9000-memory.dmp

                                      Filesize

                                      484KB

                                    • memory/2332-139-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2332-137-0x0000000000360000-0x0000000000361000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2380-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2512-169-0x0000000000400000-0x0000000000422000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2512-194-0x0000000004F60000-0x0000000005566000-memory.dmp

                                      Filesize

                                      6.0MB

                                    • memory/2772-166-0x00000000079A0000-0x00000000079A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-125-0x0000000005C00000-0x0000000005C01000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-130-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-129-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-128-0x0000000077CD0000-0x0000000077E5E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2772-127-0x0000000005C90000-0x0000000005C91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-126-0x0000000005D60000-0x0000000005D61000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-164-0x00000000077C0000-0x00000000077C1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-124-0x0000000006260000-0x0000000006261000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-122-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-161-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-160-0x00000000073F0000-0x00000000073F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3040-118-0x0000000000D30000-0x0000000000D46000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/3556-226-0x0000000009340000-0x0000000009341000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-201-0x0000000007F00000-0x0000000007F01000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-195-0x0000000006FA0000-0x0000000006FA1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-196-0x0000000006FA2000-0x0000000006FA3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-276-0x0000000006FA3000-0x0000000006FA4000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-222-0x0000000009CF0000-0x0000000009CF1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-1537-0x000000007F3B0000-0x000000007F3B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-228-0x0000000009390000-0x0000000009391000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-191-0x0000000004930000-0x0000000004931000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-175-0x00000000072C0000-0x00000000072C1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-238-0x0000000004933000-0x0000000004934000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-217-0x00000000093D0000-0x0000000009403000-memory.dmp

                                      Filesize

                                      204KB

                                    • memory/3840-189-0x0000000007A80000-0x0000000007A81000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-188-0x0000000007260000-0x0000000007261000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-237-0x000000007F3D0000-0x000000007F3D1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-174-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-193-0x0000000004932000-0x0000000004933000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-233-0x0000000009500000-0x0000000009501000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-192-0x0000000007D40000-0x0000000007D41000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-385-0x0000000007042000-0x0000000007043000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-383-0x0000000007040000-0x0000000007041000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-595-0x000000007E340000-0x000000007E341000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-140-0x0000000005DF0000-0x00000000061EF000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/4080-156-0x0000000001243000-0x0000000001244000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-143-0x00000000061F0000-0x00000000061F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-147-0x0000000003470000-0x0000000003471000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-151-0x0000000001700000-0x0000000001B02000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/4080-152-0x0000000008650000-0x0000000008651000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-154-0x0000000001240000-0x0000000001241000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-153-0x0000000000400000-0x0000000000C64000-memory.dmp

                                      Filesize

                                      8.4MB

                                    • memory/4080-157-0x0000000001244000-0x0000000001245000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-155-0x0000000001242000-0x0000000001243000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-146-0x00000000033A0000-0x00000000033A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4112-546-0x0000000000400000-0x00000000004D8000-memory.dmp

                                      Filesize

                                      864KB

                                    • memory/4148-547-0x0000000000880000-0x0000000000881000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4320-571-0x0000000000400000-0x00000000004D8000-memory.dmp

                                      Filesize

                                      864KB

                                    • memory/4408-574-0x0000000000890000-0x0000000000891000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1402-0x0000000002E00000-0x0000000005F00000-memory.dmp

                                      Filesize

                                      49.0MB

                                    • memory/4920-1404-0x00000000086A2000-0x00000000086A3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1405-0x00000000086A3000-0x00000000086A4000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1406-0x00000000086A4000-0x00000000086A5000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1403-0x00000000086A0000-0x00000000086A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-850-0x000000007E6E0000-0x000000007E6E1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-828-0x00000000047B2000-0x00000000047B3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-826-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1128-0x000000007EE90000-0x000000007EE91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1079-0x0000000007080000-0x0000000007081000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1080-0x0000000007082000-0x0000000007083000-memory.dmp

                                      Filesize

                                      4KB