Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    22-10-2021 00:21

General

  • Target

    ItroublveTSC.exe

  • Size

    3.0MB

  • MD5

    29bdae49dbc3bae32e0bfc48c3e1a071

  • SHA1

    33cad194388aed6cadef494d46c01464234f1f45

  • SHA256

    36265d5b64a71f6a4f94f327497250f5f918fd9f9b18b7151e643cdc3c6271a6

  • SHA512

    ebe5a9daf877f7db17df4dd4c090d03b93b63544d5cbf0b3dc46f4e96f070060dca23b1f8d1ae7cb23ecd7a1ab4730826c7ea3329c117fdeddadb65dd9ab117a

Score
9/10

Malware Config

Signatures

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Executes dropped EXE 7 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe
    "C:\Users\Admin\AppData\Local\Temp\ItroublveTSC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
      "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6okpArTsGIwSMHC64qxptwi+rj3Q/SaBS8jF2XXIjYK6sikMGYGr/nDY3hDgEtMK8KGQMhF/jdeLzDn2uwiblMvAIYqmFeQNQfFFNef5A/MX1IZrKTRwGDtxnSIXmtzVE=
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c compile.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1376
          • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
            C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
            5⤵
            • Executes dropped EXE
            PID:3452
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c compile.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
            C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2236
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c compile.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
            C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
            5⤵
            • Executes dropped EXE
            PID:2280
          • C:\Users\Admin\AppData\Local\Temp\splwow64.exe
            C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
            5⤵
            • Executes dropped EXE
            PID:1672
          • C:\Users\Admin\AppData\Local\Temp\hh.exe
            C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2428
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c compile.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Users\Admin\AppData\Local\Temp\xwizard.exe
            C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1976
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3872
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
            PID:2924

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Admin_History.txt
      MD5

      d3ed222b0011703ea61d6a31e522698c

      SHA1

      2a86aaa1223a0f6c40cca1561fb352193199e923

      SHA256

      82de907c0930e6d68990addd5eecd8e77dfa665c545d4b723105968b24d68544

      SHA512

      a8363fd950b70cba7f2b52ac9f3da34de2338e80210ec77dfd789c697b297b12b7facb3a690969383ae201646033ecc7c7bdfb6644cf6e06b6e72984d3450d81

    • C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt
      MD5

      5607a09fc866e8b1c39d38c0c9203c19

      SHA1

      d8d31295162fe66ff99426de635a0fb9e7247fd2

      SHA256

      2bb09a6f9850fd5353a5732b3909c92714d2b156fd30925ba8dee908a545fea9

      SHA512

      66ae386094b396e0f50c6bacea88360b04339843f91e843082802727711ebd425551297fb320564a2285ab4199e18eff97a70d60a9f9903fed4111244a205565

    • C:\Users\Admin\AppData\Local\Temp\Cookies1
      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\Temp\Cookies3
      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
      MD5

      88ab0bb59b0b20816a833ba91c1606d3

      SHA1

      72c09b7789a4bac8fee41227d101daed8437edeb

      SHA256

      f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312

      SHA512

      05cff2ca00ba940d9371c469bce6ffb4795c845d77525b8a1d4919f708296e66c0a6f3143c5964f5e963955e4f527a70624651113e72dc977f5ef40fa0276857

    • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
      MD5

      88ab0bb59b0b20816a833ba91c1606d3

      SHA1

      72c09b7789a4bac8fee41227d101daed8437edeb

      SHA256

      f4fb42c8312a6002a8783e2a1ab4571eb89e92cd192b1a21e8c4582205c37312

      SHA512

      05cff2ca00ba940d9371c469bce6ffb4795c845d77525b8a1d4919f708296e66c0a6f3143c5964f5e963955e4f527a70624651113e72dc977f5ef40fa0276857

    • C:\Users\Admin\AppData\Local\Temp\bfsvc.cfg
      MD5

      5242530a2b65089696f3cf8e5ee02ff7

      SHA1

      d604293148cdd953b3368c54920c043cffe9e1c1

      SHA256

      239a1d9844ddbd0e650f8e5de69a2a40067106a79878fa4948a8039f1573b781

      SHA512

      7aafe122d3b7b9d377f689a872c2306c3b04d5a8a7e4df69b65370e48356db416b5cacc6681a1f7315d0ad730fd12b651115a81bd4c880033e5ef89fa605c39a

    • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
      MD5

      899d3ed011eb58459b8a4fc2b81f0924

      SHA1

      80361f1e0b93143ec1ddfee156760f5938c85791

      SHA256

      5e3f311ae67f046b56435067bcdd39fbf836fa0421fbc8c8b0e43e8e47524954

      SHA512

      802ee4f8d25417589c7e62f0acc9dc2dc8f1d32654ca435f6aeae2926e6900373648790451c9143856a772a49c2a8f3c8659c5b8260f0f67559aeef875825f05

    • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
      MD5

      899d3ed011eb58459b8a4fc2b81f0924

      SHA1

      80361f1e0b93143ec1ddfee156760f5938c85791

      SHA256

      5e3f311ae67f046b56435067bcdd39fbf836fa0421fbc8c8b0e43e8e47524954

      SHA512

      802ee4f8d25417589c7e62f0acc9dc2dc8f1d32654ca435f6aeae2926e6900373648790451c9143856a772a49c2a8f3c8659c5b8260f0f67559aeef875825f05

    • C:\Users\Admin\AppData\Local\Temp\compile.bat
      MD5

      d90accebb3f79fe65cd938425c07b0ae

      SHA1

      9df3812a88d87dd419cd9e89afa5fb1d71be0dc9

      SHA256

      aca74cefaef4b7a32338c9c63187cffa1e808b54ab218a064007683ad1bd3a0e

      SHA512

      44013bfda1dbe5b217d4872e8d550cd00471cb8b969ffd6b07f83b0c59ac20ec2512d275a4603cc00e5de3a04666f66e897601ba51a5e02af622e5139ac04560

    • C:\Users\Admin\AppData\Local\Temp\compile.bat
      MD5

      808099bfbd62ec04f0ed44959bbc6160

      SHA1

      f4b6853d958c2c4416f6e4a5be8a11d86f64c023

      SHA256

      f465a1bd2f9a3efcf0589f0b1c234d285f2bebf7416b324271d987a282915ca8

      SHA512

      e4f75253a402f0f5d5c651cde045757dad0d4312be023fabf279d7c053fde6ba63cf387551a0451585a87f929634e0bfa73a06dac85ecd1bb5bc0b72bb98e1f0

    • C:\Users\Admin\AppData\Local\Temp\compile.bat
      MD5

      eb51755b637423154d1341c6ee505f50

      SHA1

      d71d27e283b26e75e58c0d02f91d91a2e914c959

      SHA256

      db903aae119dc795581080a528ba04286be11be7e9d417305d77123545fbf0f9

      SHA512

      e23463fe0a3719c2700826b55f375f60e5e67f3e432aa8e90c5afc8f449fc635aa4c031f9b6fa71344a8da9542585b74e4c812383043868a10a1065d477acee5

    • C:\Users\Admin\AppData\Local\Temp\compile.bat
      MD5

      91128da441ad667b8c54ebeadeca7525

      SHA1

      24b5c77fb68db64cba27c338e4373a455111a8cc

      SHA256

      50801c4db374acec11831bf7602cd2635bc8964800c67217b25683dce4a45873

      SHA512

      bd2a8bc4458b1bc85c5a59db872278197bb0a2a2086a1a9aa5b6b876965b9f5586959171f334237588cc6b0f9643f580db2e959f82e451f4a3043a27e4a95cdd

    • C:\Users\Admin\AppData\Local\Temp\compile.vbs
      MD5

      ca906422a558f4bc9e471709f62ec1a9

      SHA1

      e3da070007fdeae52779964df6f71fcb697ffb06

      SHA256

      abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

      SHA512

      661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

    • C:\Users\Admin\AppData\Local\Temp\compile.vbs
      MD5

      ca906422a558f4bc9e471709f62ec1a9

      SHA1

      e3da070007fdeae52779964df6f71fcb697ffb06

      SHA256

      abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

      SHA512

      661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

    • C:\Users\Admin\AppData\Local\Temp\compile.vbs
      MD5

      ca906422a558f4bc9e471709f62ec1a9

      SHA1

      e3da070007fdeae52779964df6f71fcb697ffb06

      SHA256

      abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

      SHA512

      661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

    • C:\Users\Admin\AppData\Local\Temp\compile.vbs
      MD5

      ca906422a558f4bc9e471709f62ec1a9

      SHA1

      e3da070007fdeae52779964df6f71fcb697ffb06

      SHA256

      abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

      SHA512

      661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

    • C:\Users\Admin\AppData\Local\Temp\config
      MD5

      5cf0b95f68c3304427f858db1cdde895

      SHA1

      a0c5c3872307e9497f8868b9b8b956b9736a9cdf

      SHA256

      353de1200b65a2e89e84b32067a908103cca22ad2e51ba62c171eef3c25b73aa

      SHA512

      5c11c4ebcd4663d02ee3ffc19b7ec83b953dca7a7a1d2b63edaab72425a61e926ac940d99f2faa6b1baba0d28068e8f3ae64105990e0a0626ba02d8f979b455b

    • C:\Users\Admin\AppData\Local\Temp\hh.exe
      MD5

      4d4c98eca32b14aeb074db34cd0881e4

      SHA1

      92f213d609bba05d41d6941652a88c44936663a4

      SHA256

      4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

      SHA512

      959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

    • C:\Users\Admin\AppData\Local\Temp\hh.exe
      MD5

      4d4c98eca32b14aeb074db34cd0881e4

      SHA1

      92f213d609bba05d41d6941652a88c44936663a4

      SHA256

      4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

      SHA512

      959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

    • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
      MD5

      053778713819beab3df309df472787cd

      SHA1

      99c7b5827df89b4fafc2b565abed97c58a3c65b8

      SHA256

      f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

      SHA512

      35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

    • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
      MD5

      053778713819beab3df309df472787cd

      SHA1

      99c7b5827df89b4fafc2b565abed97c58a3c65b8

      SHA256

      f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

      SHA512

      35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

    • C:\Users\Admin\AppData\Local\Temp\splwow64.exe
      MD5

      0d8360781e488e250587a17fbefa646c

      SHA1

      29bc9b438efd70defa8fc45a6f8ee524143f6d04

      SHA256

      ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64

      SHA512

      940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e

    • C:\Users\Admin\AppData\Local\Temp\splwow64.exe
      MD5

      0d8360781e488e250587a17fbefa646c

      SHA1

      29bc9b438efd70defa8fc45a6f8ee524143f6d04

      SHA256

      ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64

      SHA512

      940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e

    • C:\Users\Admin\AppData\Local\Temp\whysosad
      MD5

      fc3c88c2080884d6c995d48e172fbc4f

      SHA1

      cb1dcc479ad2533f390786b0480f66296b847ad3

      SHA256

      1637ce704a463bd3c91a38aa02d1030107670f91ee3f0dd4fa13d07a77ba2664

      SHA512

      4807d3bd44a3197d1a9dcf709a1e70e1cf3bf71fe1a9fa1479441b598154c282a620208557a4415a34d23ceb4fd32dda41edbb940b46acb2f00c696648703bf1

    • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
      MD5

      a776e68f497c996788b406a3dc5089eb

      SHA1

      45bf5e512752389fe71f20b64aa344f6ca0cad50

      SHA256

      071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1

      SHA512

      02b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073

    • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
      MD5

      a776e68f497c996788b406a3dc5089eb

      SHA1

      45bf5e512752389fe71f20b64aa344f6ca0cad50

      SHA256

      071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1

      SHA512

      02b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073

    • C:\Users\Admin\AppData\Local\Temp\xwizard.cfg
      MD5

      ae8eed5a6b1470aec0e7fece8b0669ef

      SHA1

      ca0e896f90c38f3a8bc679ea14c808726d8ef730

      SHA256

      3f6ca2bc068c8436044daab867f8ff8f75060048b29882cb2ac9fdef1800df9e

      SHA512

      e79d04f4041edb867fd6bdf4485f78352292782d9405ba81888a1bc62f5039cc46c6cc786ba1fd53284baafa7128e0f875390cb573584ed2d03c3b33c7f93eb6

    • C:\Users\Admin\AppData\Local\Temp\xwizard.exe
      MD5

      df991217f1cfadd9acfa56f878da5ee7

      SHA1

      0b03b34cfb2985a840db279778ca828e69813116

      SHA256

      deb1246347ce88e8cdd63a233a64bc2090b839f2d933a3097a2fd8fd913c4112

      SHA512

      175cde9e0def550f6380b4a9feb6845dfddbb641e2455d9d25dc6bfc7ffc08e654ea731946588961a5825dcc45c8b31972454a330fd97d7170f1991a8dac0316

    • C:\Users\Admin\AppData\Local\Temp\xwizard.exe
      MD5

      df991217f1cfadd9acfa56f878da5ee7

      SHA1

      0b03b34cfb2985a840db279778ca828e69813116

      SHA256

      deb1246347ce88e8cdd63a233a64bc2090b839f2d933a3097a2fd8fd913c4112

      SHA512

      175cde9e0def550f6380b4a9feb6845dfddbb641e2455d9d25dc6bfc7ffc08e654ea731946588961a5825dcc45c8b31972454a330fd97d7170f1991a8dac0316

    • memory/1376-141-0x0000000000000000-mapping.dmp
    • memory/1576-147-0x0000000000000000-mapping.dmp
    • memory/1672-162-0x0000000000000000-mapping.dmp
    • memory/1968-149-0x0000000000000000-mapping.dmp
    • memory/1976-174-0x0000000000000000-mapping.dmp
    • memory/2236-151-0x0000000000000000-mapping.dmp
    • memory/2280-159-0x0000000000000000-mapping.dmp
    • memory/2428-165-0x0000000000000000-mapping.dmp
    • memory/2840-139-0x0000000000000000-mapping.dmp
    • memory/2924-181-0x0000000000000000-mapping.dmp
    • memory/2940-157-0x0000000000000000-mapping.dmp
    • memory/3392-119-0x0000000005850000-0x0000000005851000-memory.dmp
      Filesize

      4KB

    • memory/3392-118-0x0000000005BE0000-0x0000000005BE1000-memory.dmp
      Filesize

      4KB

    • memory/3392-115-0x0000000000290000-0x0000000000291000-memory.dmp
      Filesize

      4KB

    • memory/3392-117-0x00000000056D0000-0x00000000056D1000-memory.dmp
      Filesize

      4KB

    • memory/3452-143-0x0000000000000000-mapping.dmp
    • memory/3472-172-0x0000000000000000-mapping.dmp
    • memory/3524-170-0x0000000000000000-mapping.dmp
    • memory/3872-180-0x0000000000000000-mapping.dmp
    • memory/3996-128-0x000001AC0E760000-0x000001AC0E762000-memory.dmp
      Filesize

      8KB

    • memory/3996-131-0x000001AC28CE0000-0x000001AC28CE1000-memory.dmp
      Filesize

      4KB

    • memory/3996-125-0x000001AC28970000-0x000001AC28CAB000-memory.dmp
      Filesize

      3.2MB

    • memory/3996-123-0x000001AC0E290000-0x000001AC0E291000-memory.dmp
      Filesize

      4KB

    • memory/3996-127-0x000001AC28D30000-0x000001AC28D31000-memory.dmp
      Filesize

      4KB

    • memory/3996-120-0x0000000000000000-mapping.dmp
    • memory/3996-129-0x000001AC28DB0000-0x000001AC28E5C000-memory.dmp
      Filesize

      688KB

    • memory/3996-126-0x000001AC0E770000-0x000001AC0E771000-memory.dmp
      Filesize

      4KB

    • memory/3996-132-0x000001AC10160000-0x000001AC1018A000-memory.dmp
      Filesize

      168KB

    • memory/3996-133-0x000001AC28CB0000-0x000001AC28CB6000-memory.dmp
      Filesize

      24KB

    • memory/3996-138-0x000001AC291A0000-0x000001AC291A1000-memory.dmp
      Filesize

      4KB

    • memory/3996-134-0x000001AC28D10000-0x000001AC28D11000-memory.dmp
      Filesize

      4KB

    • memory/3996-135-0x000001AC29090000-0x000001AC290BF000-memory.dmp
      Filesize

      188KB

    • memory/3996-136-0x000001AC290D0000-0x000001AC2916B000-memory.dmp
      Filesize

      620KB

    • memory/3996-137-0x000001AC290C0000-0x000001AC290C1000-memory.dmp
      Filesize

      4KB

    • memory/4004-155-0x0000000000000000-mapping.dmp