Resubmissions

02-12-2021 07:35

211202-je6zgsfge4 10

10-09-2021 20:31

210910-za2rzaaeh3 10

10-09-2021 19:40

210910-ydvmdsdffp 10

10-09-2021 12:06

210910-n9s4bsdbep 10

10-09-2021 05:37

210910-gbjcxahdh2 10

09-09-2021 22:16

210909-17av7aghb7 10

09-09-2021 22:12

210909-14mqksgha9 10

09-09-2021 22:12

210909-14l42sgha8 10

09-09-2021 22:11

210909-14e1qsgha7 10

09-09-2021 22:11

210909-138lnacacn 10

Analysis

  • max time kernel
    157s
  • max time network
    624s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    02-12-2021 07:35

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.3MB

  • MD5

    6d18c8e8ab9051f7a70b89ff7bb0ec35

  • SHA1

    265311e2afd9f59e824f4b77162cf3dfa278eb7e

  • SHA256

    8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

  • SHA512

    249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 16 IoCs
  • Sets service image path in registry 2 TTPs
  • Loads dropped DLL 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks processor information in registry 2 TTPs 44 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Users\Admin\AppData\Local\Temp\7zS00590814\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS00590814\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2280
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu219d5fe8cf316.exe
            Thu219d5fe8cf316.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1452
          • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21624565bb917a.exe
            Thu21624565bb917a.exe
            5⤵
            • Executes dropped EXE
            PID:1864
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 328
              6⤵
              • Program crash
              PID:3060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2948
          • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu2164f292a11ce.exe
            Thu2164f292a11ce.exe
            5⤵
            • Executes dropped EXE
            PID:3052
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 296
              6⤵
              • Program crash
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21a1ef054cac78a.exe
            Thu21a1ef054cac78a.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 2360
              6⤵
              • Program crash
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:5052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu21b93295136197.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21b93295136197.exe
            Thu21b93295136197.exe
            5⤵
            • Executes dropped EXE
            PID:4132
            • C:\Users\Admin\AppData\Local\Temp\is-SH94Q.tmp\Thu21b93295136197.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-SH94Q.tmp\Thu21b93295136197.tmp" /SL5="$20160,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21b93295136197.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:1900
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe
          4⤵
            PID:2200
            • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21b9847cb6727.exe
              Thu21b9847cb6727.exe
              5⤵
              • Executes dropped EXE
              PID:3056
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe
            4⤵
              PID:2044
              • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu214ce31cede21.exe
                Thu214ce31cede21.exe
                5⤵
                • Executes dropped EXE
                PID:1908
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 296
                  6⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4888
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone
              4⤵
                PID:2536
                • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21df5caa1b78de6.exe
                  Thu21df5caa1b78de6.exe /mixone
                  5⤵
                  • Executes dropped EXE
                  PID:2284
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 288
                    6⤵
                    • Program crash
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4796
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu214aaca5625.exe
                4⤵
                  PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu214aaca5625.exe
                    Thu214aaca5625.exe
                    5⤵
                    • Executes dropped EXE
                    PID:4876
                    • C:\Users\Admin\AppData\Local\Temp\is-3JB6Q.tmp\Thu214aaca5625.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-3JB6Q.tmp\Thu214aaca5625.tmp" /SL5="$2013C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu214aaca5625.exe"
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2340
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 612
                  4⤵
                  • Program crash
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3924
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe
                  4⤵
                    PID:3132
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe
                    4⤵
                      PID:4984
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2168
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2152 -ip 2152
                1⤵
                  PID:4888
                • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu21568b0ab8.exe
                  Thu21568b0ab8.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4608
                • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu2102ff6cfe07c.exe
                  Thu2102ff6cfe07c.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2156
                • C:\Users\Admin\AppData\Local\Temp\7zS00590814\Thu2156de5489c19.exe
                  Thu2156de5489c19.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4532
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2284 -ip 2284
                  1⤵
                    PID:828
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1864 -ip 1864
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    PID:3932
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3052 -ip 3052
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    PID:4480
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1908 -ip 1908
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    PID:3180
                  • C:\Windows\System32\WaaSMedicAgent.exe
                    C:\Windows\System32\WaaSMedicAgent.exe c61265bb6cba470d04f10ee0b33dbbed DJqj+un2mEGVfmz4p1bGGA.0.1.0.3.0
                    1⤵
                    • Modifies data under HKEY_USERS
                    PID:2856
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                    1⤵
                      PID:1456
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3200 -ip 3200
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      PID:3040
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                      1⤵
                      • Drops file in Windows directory
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3060
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                      1⤵
                      • Checks processor information in registry
                      PID:1148
                      • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                        C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                        2⤵
                          PID:880
                      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
                        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
                        1⤵
                        • Drops file in Windows directory
                        PID:2460
                      • C:\Windows\System32\WaaSMedicAgent.exe
                        C:\Windows\System32\WaaSMedicAgent.exe c61265bb6cba470d04f10ee0b33dbbed DJqj+un2mEGVfmz4p1bGGA.0.1.0.3.0
                        1⤵
                          PID:1880
                        • C:\Windows\System32\WaaSMedicAgent.exe
                          C:\Windows\System32\WaaSMedicAgent.exe c61265bb6cba470d04f10ee0b33dbbed DJqj+un2mEGVfmz4p1bGGA.0.1.0.3.0
                          1⤵
                            PID:3288
                          • C:\Windows\System32\WaaSMedicAgent.exe
                            C:\Windows\System32\WaaSMedicAgent.exe c61265bb6cba470d04f10ee0b33dbbed DJqj+un2mEGVfmz4p1bGGA.0.1.0.3.0
                            1⤵
                              PID:4216

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/1864-194-0x0000000002DED000-0x0000000002E10000-memory.dmp

                              Filesize

                              140KB

                            • memory/1864-287-0x0000000002D90000-0x0000000002DC0000-memory.dmp

                              Filesize

                              192KB

                            • memory/1900-272-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-285-0x0000000005C70000-0x0000000005C71000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-268-0x0000000005B90000-0x0000000005B91000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-269-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-271-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-292-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-291-0x0000000005C90000-0x0000000005C91000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-270-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-254-0x0000000003300000-0x000000000333C000-memory.dmp

                              Filesize

                              240KB

                            • memory/1900-288-0x0000000005C80000-0x0000000005C81000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-274-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-284-0x0000000005C60000-0x0000000005C61000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-283-0x0000000005C50000-0x0000000005C51000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-273-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-282-0x0000000005C40000-0x0000000005C41000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-281-0x0000000005C30000-0x0000000005C31000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-278-0x0000000005C20000-0x0000000005C21000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-276-0x0000000005C00000-0x0000000005C01000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-277-0x0000000005C10000-0x0000000005C11000-memory.dmp

                              Filesize

                              4KB

                            • memory/1900-259-0x00000000020A0000-0x00000000020A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1908-297-0x00000000048F0000-0x00000000049C1000-memory.dmp

                              Filesize

                              836KB

                            • memory/1908-235-0x0000000002DAC000-0x0000000002E26000-memory.dmp

                              Filesize

                              488KB

                            • memory/2152-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/2152-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/2152-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

                              Filesize

                              572KB

                            • memory/2152-165-0x000000006B440000-0x000000006B4CF000-memory.dmp

                              Filesize

                              572KB

                            • memory/2152-193-0x0000000064940000-0x0000000064959000-memory.dmp

                              Filesize

                              100KB

                            • memory/2152-167-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/2152-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

                              Filesize

                              572KB

                            • memory/2152-169-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/2152-170-0x000000006B280000-0x000000006B2A6000-memory.dmp

                              Filesize

                              152KB

                            • memory/2152-202-0x0000000064940000-0x0000000064959000-memory.dmp

                              Filesize

                              100KB

                            • memory/2152-198-0x0000000064940000-0x0000000064959000-memory.dmp

                              Filesize

                              100KB

                            • memory/2152-191-0x0000000064940000-0x0000000064959000-memory.dmp

                              Filesize

                              100KB

                            • memory/2280-260-0x00000000076E0000-0x00000000076E1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-204-0x0000000000F40000-0x0000000000F41000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-201-0x0000000000F40000-0x0000000000F41000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-319-0x0000000000F40000-0x0000000000F41000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-315-0x00000000097F0000-0x00000000097F1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-314-0x0000000009560000-0x0000000009561000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-313-0x00000000094F0000-0x00000000094F1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-312-0x0000000009B30000-0x0000000009B31000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-311-0x0000000009390000-0x0000000009391000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-310-0x0000000009370000-0x0000000009371000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-305-0x000000007EEB0000-0x000000007EEB1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-262-0x0000000007810000-0x0000000007811000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-301-0x0000000008780000-0x00000000087B4000-memory.dmp

                              Filesize

                              208KB

                            • memory/2280-298-0x0000000006985000-0x0000000006987000-memory.dmp

                              Filesize

                              8KB

                            • memory/2280-296-0x0000000008550000-0x0000000008551000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-295-0x00000000080D0000-0x00000000080D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-293-0x0000000008100000-0x0000000008101000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-256-0x0000000007900000-0x0000000007901000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-227-0x0000000006980000-0x0000000006981000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-265-0x0000000007B90000-0x0000000007B91000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-230-0x0000000006982000-0x0000000006983000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-275-0x0000000007C70000-0x0000000007C71000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-267-0x0000000007C00000-0x0000000007C01000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-216-0x00000000069D0000-0x00000000069D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2280-219-0x0000000007040000-0x0000000007041000-memory.dmp

                              Filesize

                              4KB

                            • memory/2284-280-0x0000000002E90000-0x0000000002ED8000-memory.dmp

                              Filesize

                              288KB

                            • memory/2284-234-0x0000000002EF9000-0x0000000002F22000-memory.dmp

                              Filesize

                              164KB

                            • memory/2340-266-0x0000000002100000-0x0000000002101000-memory.dmp

                              Filesize

                              4KB

                            • memory/3052-213-0x0000000002CCC000-0x0000000002CDC000-memory.dmp

                              Filesize

                              64KB

                            • memory/3052-294-0x0000000004720000-0x0000000004729000-memory.dmp

                              Filesize

                              36KB

                            • memory/3060-322-0x000001CAF7480000-0x000001CAF7481000-memory.dmp

                              Filesize

                              4KB

                            • memory/3060-316-0x000001CAF4620000-0x000001CAF4630000-memory.dmp

                              Filesize

                              64KB

                            • memory/3060-317-0x000001CAF4860000-0x000001CAF4870000-memory.dmp

                              Filesize

                              64KB

                            • memory/3060-321-0x000001CAF7510000-0x000001CAF7514000-memory.dmp

                              Filesize

                              16KB

                            • memory/3060-318-0x000001CAF6D90000-0x000001CAF6D94000-memory.dmp

                              Filesize

                              16KB

                            • memory/4132-236-0x0000000000400000-0x0000000000414000-memory.dmp

                              Filesize

                              80KB

                            • memory/4488-217-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

                              Filesize

                              4KB

                            • memory/4488-233-0x0000000003030000-0x0000000003031000-memory.dmp

                              Filesize

                              4KB

                            • memory/4488-255-0x0000000003070000-0x0000000003071000-memory.dmp

                              Filesize

                              4KB

                            • memory/4488-246-0x0000000003040000-0x000000000305C000-memory.dmp

                              Filesize

                              112KB

                            • memory/4488-263-0x000000001B9E0000-0x000000001B9E2000-memory.dmp

                              Filesize

                              8KB

                            • memory/4532-286-0x000001F6E0562000-0x000001F6E0564000-memory.dmp

                              Filesize

                              8KB

                            • memory/4532-231-0x000001F6DE850000-0x000001F6DE851000-memory.dmp

                              Filesize

                              4KB

                            • memory/4532-250-0x000001F6E0530000-0x000001F6E053B000-memory.dmp

                              Filesize

                              44KB

                            • memory/4532-290-0x000001F6E0565000-0x000001F6E0567000-memory.dmp

                              Filesize

                              8KB

                            • memory/4532-289-0x000001F6E0564000-0x000001F6E0565000-memory.dmp

                              Filesize

                              4KB

                            • memory/4532-279-0x000001F6FBBF0000-0x000001F6FBC6E000-memory.dmp

                              Filesize

                              504KB

                            • memory/4532-245-0x000001F6E0560000-0x000001F6E0562000-memory.dmp

                              Filesize

                              8KB

                            • memory/4608-261-0x000000001AFB0000-0x000000001AFB2000-memory.dmp

                              Filesize

                              8KB

                            • memory/4608-249-0x0000000000320000-0x0000000000321000-memory.dmp

                              Filesize

                              4KB

                            • memory/4876-242-0x0000000000400000-0x000000000046D000-memory.dmp

                              Filesize

                              436KB