Analysis

  • max time kernel
    14s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    21/11/2021, 15:16

General

  • Target

    b16504e25ef918a88c54371fea0e49aa.exe

  • Size

    13.8MB

  • MD5

    b16504e25ef918a88c54371fea0e49aa

  • SHA1

    786cb7fa904b8c19c055b6a49527f7e9d907307a

  • SHA256

    4066a70177c5b8a86458e8727efaa599b0de0e342fd709eec5d3b78ed066cd67

  • SHA512

    7a549cf81e37f2c52ecd87b3827f99da8c3bc175a029c0387964a26005dd0fbc918de3261d1e3bd42104bc53eca16325817d85be60bd78688be16118e23ad102

Malware Config

Extracted

Family

socelars

C2

http://www.gianninidesign.com/

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32
rc4.i32

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 3 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 36 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b16504e25ef918a88c54371fea0e49aa.exe
    "C:\Users\Admin\AppData\Local\Temp\b16504e25ef918a88c54371fea0e49aa.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS464510D5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1216
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
              PID:1332
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1320
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
                PID:1452
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Wed05ecd67738969.exe
              4⤵
              • Loads dropped DLL
              PID:1980
              • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05ecd67738969.exe
                Wed05ecd67738969.exe
                5⤵
                • Executes dropped EXE
                PID:1680
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                    PID:2620
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      PID:2656
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed0534fdcb003d1e565.exe
                4⤵
                • Loads dropped DLL
                PID:284
                • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed0534fdcb003d1e565.exe
                  Wed0534fdcb003d1e565.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  PID:892
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed05c754f5b2a7ed96.exe
                4⤵
                • Loads dropped DLL
                PID:1732
                • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05c754f5b2a7ed96.exe
                  Wed05c754f5b2a7ed96.exe
                  5⤵
                  • Executes dropped EXE
                  PID:1448
                  • C:\Users\Admin\AppData\Local\Temp\is-6FBKR.tmp\Wed05c754f5b2a7ed96.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-6FBKR.tmp\Wed05c754f5b2a7ed96.tmp" /SL5="$10164,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05c754f5b2a7ed96.exe"
                    6⤵
                      PID:2104
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed05530159d4f285214.exe
                  4⤵
                  • Loads dropped DLL
                  PID:1952
                  • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05530159d4f285214.exe
                    Wed05530159d4f285214.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:360
                    • C:\Users\Admin\Pictures\Adobe Films\hUh13tCBfm__2vh7MhWlI63i.exe
                      "C:\Users\Admin\Pictures\Adobe Films\hUh13tCBfm__2vh7MhWlI63i.exe"
                      6⤵
                        PID:3032
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 1496
                        6⤵
                        • Program crash
                        PID:2228
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Wed055e29ac05f0e14.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1884
                    • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed055e29ac05f0e14.exe
                      Wed055e29ac05f0e14.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1072
                      • C:\Users\Admin\AppData\Local\Temp\is-19245.tmp\Wed055e29ac05f0e14.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-19245.tmp\Wed055e29ac05f0e14.tmp" /SL5="$70152,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed055e29ac05f0e14.exe"
                        6⤵
                          PID:1720
                          • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed055e29ac05f0e14.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed055e29ac05f0e14.exe" /SILENT
                            7⤵
                              PID:2056
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed058c3464dcf6606b1.exe
                        4⤵
                        • Loads dropped DLL
                        PID:568
                        • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed058c3464dcf6606b1.exe
                          Wed058c3464dcf6606b1.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1168
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed058cca47ea86cc0b.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1328
                        • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed058cca47ea86cc0b.exe
                          Wed058cca47ea86cc0b.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:572
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed05cb54d5272ed03.exe
                        4⤵
                        • Loads dropped DLL
                        PID:948
                        • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05cb54d5272ed03.exe
                          Wed05cb54d5272ed03.exe
                          5⤵
                          • Executes dropped EXE
                          PID:884
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Wed05572ff115815bed.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1724
                        • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05572ff115815bed.exe
                          Wed05572ff115815bed.exe
                          5⤵
                            PID:964
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed059ecd633701f3.exe
                          4⤵
                            PID:860
                            • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059ecd633701f3.exe
                              Wed059ecd633701f3.exe
                              5⤵
                                PID:300
                                • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059ecd633701f3.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059ecd633701f3.exe
                                  6⤵
                                    PID:2604
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Wed05b5c2705a.exe
                                4⤵
                                  PID:968
                                  • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05b5c2705a.exe
                                    Wed05b5c2705a.exe
                                    5⤵
                                      PID:1548
                                      • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05b5c2705a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05b5c2705a.exe"
                                        6⤵
                                          PID:992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed0504ce1fce545657.exe
                                      4⤵
                                        PID:1972
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Wed0507640eb5b.exe
                                        4⤵
                                          PID:1872
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Wed059a025cf2a.exe
                                          4⤵
                                            PID:760
                                            • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059a025cf2a.exe
                                              Wed059a025cf2a.exe
                                              5⤵
                                                PID:1340
                                                • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059a025cf2a.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed059a025cf2a.exe
                                                  6⤵
                                                    PID:2612
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Wed05c770a4470c.exe /mixtwo
                                                4⤵
                                                  PID:1608
                                          • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05c770a4470c.exe
                                            Wed05c770a4470c.exe /mixtwo
                                            1⤵
                                              PID:1192
                                              • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05c770a4470c.exe
                                                Wed05c770a4470c.exe /mixtwo
                                                2⤵
                                                  PID:1756
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "Wed05c770a4470c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed05c770a4470c.exe" & exit
                                                    3⤵
                                                      PID:2444
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /im "Wed05c770a4470c.exe" /f
                                                        4⤵
                                                        • Kills process with taskkill
                                                        PID:2480
                                                • C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed058cca47ea86cc0b.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\7zS464510D5\Wed058cca47ea86cc0b.exe" -u
                                                  1⤵
                                                    PID:1536
                                                  • C:\Windows\system32\conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe "-97487681210869245971998247865-82461934-19493775528922442781294593980544010642"
                                                    1⤵
                                                      PID:1972
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                      1⤵
                                                        PID:2844
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                        1⤵
                                                          PID:2932
                                                        • C:\Windows\system32\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          PID:2820
                                                        • C:\Windows\system32\makecab.exe
                                                          "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20211121151357.log C:\Windows\Logs\CBS\CbsPersist_20211121151357.cab
                                                          1⤵
                                                            PID:1340
                                                          • C:\Windows\system32\conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe "-5176396942134570193-797381602866525544-1034347109-1121301744-867375015-1692247425"
                                                            1⤵
                                                              PID:760

                                                            Network

                                                                  MITRE ATT&CK Enterprise v6

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • memory/300-253-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/360-291-0x0000000003ED0000-0x000000000401C000-memory.dmp

                                                                    Filesize

                                                                    1.3MB

                                                                  • memory/548-55-0x0000000075731000-0x0000000075733000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/872-287-0x00000000008B0000-0x00000000008FD000-memory.dmp

                                                                    Filesize

                                                                    308KB

                                                                  • memory/872-289-0x0000000002610000-0x0000000002682000-memory.dmp

                                                                    Filesize

                                                                    456KB

                                                                  • memory/884-228-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-223-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-227-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-232-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-221-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-230-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-220-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-222-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-224-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/884-225-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/892-197-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                    Filesize

                                                                    168KB

                                                                  • memory/892-195-0x00000000003F0000-0x00000000003F9000-memory.dmp

                                                                    Filesize

                                                                    36KB

                                                                  • memory/892-194-0x0000000000260000-0x0000000000268000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/1072-214-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                    Filesize

                                                                    80KB

                                                                  • memory/1168-252-0x0000000007220000-0x0000000007221000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1272-250-0x0000000003A80000-0x0000000003A96000-memory.dmp

                                                                    Filesize

                                                                    88KB

                                                                  • memory/1332-305-0x00000000021A0000-0x0000000002DEA000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1332-303-0x00000000021A0000-0x0000000002DEA000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1332-304-0x00000000021A0000-0x0000000002DEA000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1340-254-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1448-219-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                    Filesize

                                                                    864KB

                                                                  • memory/1452-263-0x00000000021D0000-0x0000000002E1A000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1452-249-0x00000000021D0000-0x0000000002E1A000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1452-295-0x00000000021D0000-0x0000000002E1A000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1548-247-0x0000000000400000-0x0000000000CBD000-memory.dmp

                                                                    Filesize

                                                                    8.7MB

                                                                  • memory/1548-245-0x0000000002B60000-0x0000000002F6F000-memory.dmp

                                                                    Filesize

                                                                    4.1MB

                                                                  • memory/1548-246-0x0000000002F70000-0x0000000003812000-memory.dmp

                                                                    Filesize

                                                                    8.6MB

                                                                  • memory/1720-238-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1756-203-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/1756-211-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/1756-216-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/1756-204-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/1932-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/1932-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/1932-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    Filesize

                                                                    152KB

                                                                  • memory/1932-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/1932-93-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/1932-96-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/1932-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/1932-103-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    Filesize

                                                                    152KB

                                                                  • memory/1932-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/1932-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/1932-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/1932-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/1932-100-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/1932-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/1932-92-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/2104-248-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2228-298-0x0000000000470000-0x0000000000471000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2604-293-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2612-292-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2844-284-0x0000000000B80000-0x0000000000C81000-memory.dmp

                                                                    Filesize

                                                                    1.0MB

                                                                  • memory/2844-285-0x00000000002C0000-0x000000000031D000-memory.dmp

                                                                    Filesize

                                                                    372KB

                                                                  • memory/2932-302-0x0000000003330000-0x0000000003435000-memory.dmp

                                                                    Filesize

                                                                    1.0MB

                                                                  • memory/2932-300-0x0000000001C50000-0x0000000001C79000-memory.dmp

                                                                    Filesize

                                                                    164KB

                                                                  • memory/2932-299-0x0000000000300000-0x000000000031B000-memory.dmp

                                                                    Filesize

                                                                    108KB

                                                                  • memory/2932-290-0x00000000004B0000-0x0000000000522000-memory.dmp

                                                                    Filesize

                                                                    456KB