Analysis

  • max time kernel
    153s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    30-11-2021 18:06

General

  • Target

    457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c.exe

  • Size

    159KB

  • MD5

    b77452e66cb2a9ce335c34ee7dba9330

  • SHA1

    c34e20a0f94510f34eaaead204b61f330728da4c

  • SHA256

    457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c

  • SHA512

    3b4279cd04e9fe708447df0fc1dd81e5f0f1200c7b647d0fddd7ae33a4a6c4d293aaaa8ef3980b8e7b67d12716f1cc51afd3c8c167dd4a82f8adabe130b591a0

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

C2

92.255.76.197:38637

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

amadey

Version

2.85

C2

185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • Arkei Stealer Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c.exe
    "C:\Users\Admin\AppData\Local\Temp\457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Users\Admin\AppData\Local\Temp\457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c.exe
      "C:\Users\Admin\AppData\Local\Temp\457776b0fbd43171ddf075234cac859af510bca064d3e48ebcf2ab2718c9c67c.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1044
  • C:\Users\Admin\AppData\Local\Temp\CB6A.exe
    C:\Users\Admin\AppData\Local\Temp\CB6A.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\CB6A.exe
      C:\Users\Admin\AppData\Local\Temp\CB6A.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1204
  • C:\Users\Admin\AppData\Local\Temp\D25D.exe
    C:\Users\Admin\AppData\Local\Temp\D25D.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1948
  • C:\Users\Admin\AppData\Local\Temp\D5F7.exe
    C:\Users\Admin\AppData\Local\Temp\D5F7.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:1216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D5F7.exe" & exit
      2⤵
        PID:1908
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:1900
    • C:\Users\Admin\AppData\Local\Temp\DAD8.exe
      C:\Users\Admin\AppData\Local\Temp\DAD8.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Users\Admin\AppData\Local\Temp\DAD8.exe
        C:\Users\Admin\AppData\Local\Temp\DAD8.exe
        2⤵
        • Executes dropped EXE
        PID:1772
    • C:\Users\Admin\AppData\Local\Temp\E802.exe
      C:\Users\Admin\AppData\Local\Temp\E802.exe
      1⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KmlWkSlPeSM & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E802.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Windows\SysWOW64\timeout.exe
          timeout 4
          3⤵
          • Delays execution with timeout.exe
          PID:1516
    • C:\Windows\system32\regsvr32.exe
      regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EFC1.dll
      1⤵
      • Loads dropped DLL
      PID:1744
    • C:\Users\Admin\AppData\Local\Temp\F869.exe
      C:\Users\Admin\AppData\Local\Temp\F869.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Users\Admin\AppData\Local\Temp\F869.exe
        C:\Users\Admin\AppData\Local\Temp\F869.exe
        2⤵
        • Executes dropped EXE
        PID:568

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    5
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CB6A.exe
      MD5

      5115e5dab211559a85cd0154e8100f53

      SHA1

      347800b72ac53ec6e2c87e433763b20282a2c06d

      SHA256

      ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

      SHA512

      d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

    • C:\Users\Admin\AppData\Local\Temp\CB6A.exe
      MD5

      5115e5dab211559a85cd0154e8100f53

      SHA1

      347800b72ac53ec6e2c87e433763b20282a2c06d

      SHA256

      ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

      SHA512

      d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

    • C:\Users\Admin\AppData\Local\Temp\CB6A.exe
      MD5

      5115e5dab211559a85cd0154e8100f53

      SHA1

      347800b72ac53ec6e2c87e433763b20282a2c06d

      SHA256

      ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

      SHA512

      d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

    • C:\Users\Admin\AppData\Local\Temp\D25D.exe
      MD5

      df13fac0d8b182e4d8b9a02ba87a9571

      SHA1

      b2187debc6fde96e08d5014ce4f1af5cf568bce5

      SHA256

      af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3

      SHA512

      bc842a80509bda8afff6e12f5b5c64ccf7f1d7360f99f63cebbc1f21936a15487ec16bde3c2acff22c49ebcedf5c426621d6f69503f4968aacc8e75611e3a816

    • C:\Users\Admin\AppData\Local\Temp\D5F7.exe
      MD5

      7b850ae233aa579d9c1d962dc2a39fae

      SHA1

      cf12091c956bdbbaf0fbd71f272b16dcd1eb9c9a

      SHA256

      811fafb9aaa96c1360cc5bc2168eb4f3f8bfd0de46c0325bb7c10a549702e847

      SHA512

      0a1c10a6bff18a7490b8192f1298d3d8cf46414e53794c33aeee7751b9cc5e579aad1ed2837610bacd1deed43acf304fca152d6072220a0687f9aa44db1b7917

    • C:\Users\Admin\AppData\Local\Temp\D5F7.exe
      MD5

      7b850ae233aa579d9c1d962dc2a39fae

      SHA1

      cf12091c956bdbbaf0fbd71f272b16dcd1eb9c9a

      SHA256

      811fafb9aaa96c1360cc5bc2168eb4f3f8bfd0de46c0325bb7c10a549702e847

      SHA512

      0a1c10a6bff18a7490b8192f1298d3d8cf46414e53794c33aeee7751b9cc5e579aad1ed2837610bacd1deed43acf304fca152d6072220a0687f9aa44db1b7917

    • C:\Users\Admin\AppData\Local\Temp\DAD8.exe
      MD5

      e7b16611fc1f56f505afdb2a64a3d683

      SHA1

      7f9084300db4692be60f711139c6d1a7a8eca43b

      SHA256

      e866aa57312aa8610e1d06333945b622224b8d24134c35a7ed61e70695536f29

      SHA512

      e1cf12d6fc7c6d3bcdaa0460898c55c2c98dbb082a84fdd8e0a8397413f3c2123e1bf5bc891b114b27a47af8e7850140db551575693990b15743e83127c7a4cf

    • C:\Users\Admin\AppData\Local\Temp\DAD8.exe
      MD5

      e7b16611fc1f56f505afdb2a64a3d683

      SHA1

      7f9084300db4692be60f711139c6d1a7a8eca43b

      SHA256

      e866aa57312aa8610e1d06333945b622224b8d24134c35a7ed61e70695536f29

      SHA512

      e1cf12d6fc7c6d3bcdaa0460898c55c2c98dbb082a84fdd8e0a8397413f3c2123e1bf5bc891b114b27a47af8e7850140db551575693990b15743e83127c7a4cf

    • C:\Users\Admin\AppData\Local\Temp\DAD8.exe
      MD5

      e7b16611fc1f56f505afdb2a64a3d683

      SHA1

      7f9084300db4692be60f711139c6d1a7a8eca43b

      SHA256

      e866aa57312aa8610e1d06333945b622224b8d24134c35a7ed61e70695536f29

      SHA512

      e1cf12d6fc7c6d3bcdaa0460898c55c2c98dbb082a84fdd8e0a8397413f3c2123e1bf5bc891b114b27a47af8e7850140db551575693990b15743e83127c7a4cf

    • C:\Users\Admin\AppData\Local\Temp\E802.exe
      MD5

      ca16ca4aa9cf9777274447c9f4ba222e

      SHA1

      1025ed93e5f44d51b96f1a788764cc4487ee477e

      SHA256

      0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

      SHA512

      72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

    • C:\Users\Admin\AppData\Local\Temp\E802.exe
      MD5

      ca16ca4aa9cf9777274447c9f4ba222e

      SHA1

      1025ed93e5f44d51b96f1a788764cc4487ee477e

      SHA256

      0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

      SHA512

      72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

    • C:\Users\Admin\AppData\Local\Temp\EFC1.dll
      MD5

      2ee33ef3b24574c9fb54fd75e29fdf6e

      SHA1

      158a048f5f5feac85eb5791fbb25ba6aaf262712

      SHA256

      46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

      SHA512

      0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

    • C:\Users\Admin\AppData\Local\Temp\F869.exe
      MD5

      720265970b5c7d143eb22c485ca3535c

      SHA1

      874a36dc9b35eb61a44e2655c5a29cfb6599cdbe

      SHA256

      9820500aae4c3b3b5ab38a63f9776a75cfb2203a20798682207aee9e6526aba8

      SHA512

      3bf82abb3ce8eff9d80ec3c5c2103aa8120be17cecbcb8fa8c056e123f1e7f1cb7d3bba580cbd52de123868d07dfab97c458d320b77e6eaa60ebbd7ece74eb79

    • C:\Users\Admin\AppData\Local\Temp\F869.exe
      MD5

      720265970b5c7d143eb22c485ca3535c

      SHA1

      874a36dc9b35eb61a44e2655c5a29cfb6599cdbe

      SHA256

      9820500aae4c3b3b5ab38a63f9776a75cfb2203a20798682207aee9e6526aba8

      SHA512

      3bf82abb3ce8eff9d80ec3c5c2103aa8120be17cecbcb8fa8c056e123f1e7f1cb7d3bba580cbd52de123868d07dfab97c458d320b77e6eaa60ebbd7ece74eb79

    • C:\Users\Admin\AppData\Local\Temp\F869.exe
      MD5

      720265970b5c7d143eb22c485ca3535c

      SHA1

      874a36dc9b35eb61a44e2655c5a29cfb6599cdbe

      SHA256

      9820500aae4c3b3b5ab38a63f9776a75cfb2203a20798682207aee9e6526aba8

      SHA512

      3bf82abb3ce8eff9d80ec3c5c2103aa8120be17cecbcb8fa8c056e123f1e7f1cb7d3bba580cbd52de123868d07dfab97c458d320b77e6eaa60ebbd7ece74eb79

    • \ProgramData\mozglue.dll
      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • \ProgramData\msvcp140.dll
      MD5

      109f0f02fd37c84bfc7508d4227d7ed5

      SHA1

      ef7420141bb15ac334d3964082361a460bfdb975

      SHA256

      334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

      SHA512

      46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

    • \ProgramData\nss3.dll
      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • \ProgramData\sqlite3.dll
      MD5

      e477a96c8f2b18d6b5c27bde49c990bf

      SHA1

      e980c9bf41330d1e5bd04556db4646a0210f7409

      SHA256

      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

      SHA512

      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

    • \ProgramData\vcruntime140.dll
      MD5

      7587bf9cb4147022cd5681b015183046

      SHA1

      f2106306a8f6f0da5afb7fc765cfa0757ad5a628

      SHA256

      c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

      SHA512

      0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

    • \Users\Admin\AppData\Local\Temp\CB6A.exe
      MD5

      5115e5dab211559a85cd0154e8100f53

      SHA1

      347800b72ac53ec6e2c87e433763b20282a2c06d

      SHA256

      ef156fb3a203fe197d89d63e2ea7805a1b9af505dfff5a58532dbfe34e7aabaa

      SHA512

      d03e58376be1e299a6da57a28ed5db176999baded713aa54ddb59cf8c82b97e8c0b028ce07bddb6989c7c77e518e151e112dde2f1d5244ac2572e4371fa68c12

    • \Users\Admin\AppData\Local\Temp\DAD8.exe
      MD5

      e7b16611fc1f56f505afdb2a64a3d683

      SHA1

      7f9084300db4692be60f711139c6d1a7a8eca43b

      SHA256

      e866aa57312aa8610e1d06333945b622224b8d24134c35a7ed61e70695536f29

      SHA512

      e1cf12d6fc7c6d3bcdaa0460898c55c2c98dbb082a84fdd8e0a8397413f3c2123e1bf5bc891b114b27a47af8e7850140db551575693990b15743e83127c7a4cf

    • \Users\Admin\AppData\Local\Temp\EFC1.dll
      MD5

      2ee33ef3b24574c9fb54fd75e29fdf6e

      SHA1

      158a048f5f5feac85eb5791fbb25ba6aaf262712

      SHA256

      46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

      SHA512

      0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

    • \Users\Admin\AppData\Local\Temp\F869.exe
      MD5

      720265970b5c7d143eb22c485ca3535c

      SHA1

      874a36dc9b35eb61a44e2655c5a29cfb6599cdbe

      SHA256

      9820500aae4c3b3b5ab38a63f9776a75cfb2203a20798682207aee9e6526aba8

      SHA512

      3bf82abb3ce8eff9d80ec3c5c2103aa8120be17cecbcb8fa8c056e123f1e7f1cb7d3bba580cbd52de123868d07dfab97c458d320b77e6eaa60ebbd7ece74eb79

    • memory/556-58-0x0000000000220000-0x0000000000228000-memory.dmp
      Filesize

      32KB

    • memory/556-59-0x0000000000230000-0x0000000000239000-memory.dmp
      Filesize

      36KB

    • memory/568-122-0x0000000000400000-0x000000000043D000-memory.dmp
      Filesize

      244KB

    • memory/568-123-0x0000000000414C3C-mapping.dmp
    • memory/980-79-0x0000000000000000-mapping.dmp
    • memory/980-97-0x0000000000220000-0x0000000000229000-memory.dmp
      Filesize

      36KB

    • memory/1044-56-0x0000000000402F47-mapping.dmp
    • memory/1044-57-0x00000000754A1000-0x00000000754A3000-memory.dmp
      Filesize

      8KB

    • memory/1044-55-0x0000000000400000-0x0000000000409000-memory.dmp
      Filesize

      36KB

    • memory/1076-101-0x00000000012A0000-0x0000000001982000-memory.dmp
      Filesize

      6.9MB

    • memory/1076-102-0x00000000012A0000-0x0000000001982000-memory.dmp
      Filesize

      6.9MB

    • memory/1076-105-0x00000000012A0000-0x0000000001982000-memory.dmp
      Filesize

      6.9MB

    • memory/1076-103-0x00000000012A0000-0x0000000001982000-memory.dmp
      Filesize

      6.9MB

    • memory/1076-98-0x0000000000000000-mapping.dmp
    • memory/1204-85-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1204-84-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1204-93-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1204-90-0x0000000000418EE6-mapping.dmp
    • memory/1204-86-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1204-82-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1204-104-0x0000000000C90000-0x0000000000C91000-memory.dmp
      Filesize

      4KB

    • memory/1204-83-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/1216-81-0x0000000000400000-0x0000000002B6E000-memory.dmp
      Filesize

      39.4MB

    • memory/1216-78-0x0000000000270000-0x0000000000291000-memory.dmp
      Filesize

      132KB

    • memory/1216-75-0x0000000000220000-0x0000000000233000-memory.dmp
      Filesize

      76KB

    • memory/1216-70-0x0000000000000000-mapping.dmp
    • memory/1252-106-0x0000000004330000-0x0000000004346000-memory.dmp
      Filesize

      88KB

    • memory/1252-60-0x0000000002AE0000-0x0000000002AF6000-memory.dmp
      Filesize

      88KB

    • memory/1516-112-0x0000000000000000-mapping.dmp
    • memory/1660-66-0x0000000000590000-0x0000000000591000-memory.dmp
      Filesize

      4KB

    • memory/1660-61-0x0000000000000000-mapping.dmp
    • memory/1660-64-0x0000000000F60000-0x0000000000F61000-memory.dmp
      Filesize

      4KB

    • memory/1744-108-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp
      Filesize

      8KB

    • memory/1744-107-0x0000000000000000-mapping.dmp
    • memory/1772-91-0x0000000000402F47-mapping.dmp
    • memory/1880-118-0x00000000048A0000-0x00000000048A1000-memory.dmp
      Filesize

      4KB

    • memory/1880-119-0x00000000002B0000-0x00000000002B1000-memory.dmp
      Filesize

      4KB

    • memory/1880-113-0x0000000000000000-mapping.dmp
    • memory/1880-116-0x0000000000340000-0x0000000000341000-memory.dmp
      Filesize

      4KB

    • memory/1900-131-0x0000000000000000-mapping.dmp
    • memory/1908-130-0x0000000000000000-mapping.dmp
    • memory/1916-109-0x0000000000000000-mapping.dmp
    • memory/1948-77-0x0000000000400000-0x0000000002B64000-memory.dmp
      Filesize

      39.4MB

    • memory/1948-76-0x0000000000240000-0x0000000000249000-memory.dmp
      Filesize

      36KB

    • memory/1948-73-0x00000000001B0000-0x00000000001B9000-memory.dmp
      Filesize

      36KB

    • memory/1948-68-0x0000000000000000-mapping.dmp