Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    06-12-2021 10:34

General

  • Target

    3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446.exe

  • Size

    279KB

  • MD5

    d02702e7d72098036ee78811328527ac

  • SHA1

    296ee6b97e48d2a03fbe2b5a4cf55d651a621f75

  • SHA256

    3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446

  • SHA512

    da13584c42940e25af8b94056e3904e0831164fe89b165559bc43c76efaa1f582347d6e43b0c81c48a6480ed6e17de2fcb37936b3a674f1007db20d576ca974d

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

b620be4c85b4051a92040003edbc322be4eb082d

Attributes
  • url4cnc

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446.exe
    "C:\Users\Admin\AppData\Local\Temp\3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446.exe
      "C:\Users\Admin\AppData\Local\Temp\3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3808
  • C:\Users\Admin\AppData\Local\Temp\F57C.exe
    C:\Users\Admin\AppData\Local\Temp\F57C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\F57C.exe
      C:\Users\Admin\AppData\Local\Temp\F57C.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2884
  • C:\Users\Admin\AppData\Local\Temp\5A04.exe
    C:\Users\Admin\AppData\Local\Temp\5A04.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\5A04.exe
      C:\Users\Admin\AppData\Local\Temp\5A04.exe
      2⤵
      • Executes dropped EXE
      PID:1484
  • C:\Users\Admin\AppData\Local\Temp\632D.exe
    C:\Users\Admin\AppData\Local\Temp\632D.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\632D.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\SysWOW64\timeout.exe
        timeout 4
        3⤵
        • Delays execution with timeout.exe
        PID:3252
  • C:\Users\Admin\AppData\Local\Temp\6D7E.exe
    C:\Users\Admin\AppData\Local\Temp\6D7E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:716
  • C:\Users\Admin\AppData\Local\Temp\734C.exe
    C:\Users\Admin\AppData\Local\Temp\734C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\734C.exe
      C:\Users\Admin\AppData\Local\Temp\734C.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2332

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\734C.exe.log
    MD5

    4de34ae26d6f8e75b21ca785fe848774

    SHA1

    0899d1dd34e6d8b7e513a30a57aa4bfaa4d17090

    SHA256

    0b9b31708187948cb3e445afc11c88cf4c34c00423e31bd83cc330012d8127f8

    SHA512

    aa08459ff6948555ca3f48b1537b222a56f33fba103a1b4e688667660a2b692bda2d7943f5b2d26232d5c87a0651c3e7e0c5437a78e9723d25b26036cb1c1f2b

  • C:\Users\Admin\AppData\Local\Temp\5A04.exe
    MD5

    45cf4ea0f9268e7306da20dea9d14210

    SHA1

    3574746d1d089f9989ee2c9e2048f014a61100ca

    SHA256

    919ccc1f90bae8d58cc6ef51359e15af853de90a7083c640b5c2a99eb1a61281

    SHA512

    3996f207a4973428f7ecb419f16fdafb7fa6213cb0a9a7b48405baae10f85a4a381664291f4c59d5c6bc7158335ca07944fb712dc7dc14a3a393f9af490dfe6d

  • C:\Users\Admin\AppData\Local\Temp\5A04.exe
    MD5

    45cf4ea0f9268e7306da20dea9d14210

    SHA1

    3574746d1d089f9989ee2c9e2048f014a61100ca

    SHA256

    919ccc1f90bae8d58cc6ef51359e15af853de90a7083c640b5c2a99eb1a61281

    SHA512

    3996f207a4973428f7ecb419f16fdafb7fa6213cb0a9a7b48405baae10f85a4a381664291f4c59d5c6bc7158335ca07944fb712dc7dc14a3a393f9af490dfe6d

  • C:\Users\Admin\AppData\Local\Temp\5A04.exe
    MD5

    45cf4ea0f9268e7306da20dea9d14210

    SHA1

    3574746d1d089f9989ee2c9e2048f014a61100ca

    SHA256

    919ccc1f90bae8d58cc6ef51359e15af853de90a7083c640b5c2a99eb1a61281

    SHA512

    3996f207a4973428f7ecb419f16fdafb7fa6213cb0a9a7b48405baae10f85a4a381664291f4c59d5c6bc7158335ca07944fb712dc7dc14a3a393f9af490dfe6d

  • C:\Users\Admin\AppData\Local\Temp\632D.exe
    MD5

    863355ba1dd127f6e9773970ba2fa10c

    SHA1

    0514cc30e318062b58eb6ab80e7b1a3f2e4b5425

    SHA256

    d033936fc89fe40b0d769d101e13936c738de6ecfbc6eade4be3297293d77d44

    SHA512

    b6a92c6d4f566650de3f960a3aed1547758564906ac30c774879285a73fbbe08dd2f8442e80c87dd7ffdd83b36336cb601bae5854204db3444ae3269bb5261ad

  • C:\Users\Admin\AppData\Local\Temp\632D.exe
    MD5

    863355ba1dd127f6e9773970ba2fa10c

    SHA1

    0514cc30e318062b58eb6ab80e7b1a3f2e4b5425

    SHA256

    d033936fc89fe40b0d769d101e13936c738de6ecfbc6eade4be3297293d77d44

    SHA512

    b6a92c6d4f566650de3f960a3aed1547758564906ac30c774879285a73fbbe08dd2f8442e80c87dd7ffdd83b36336cb601bae5854204db3444ae3269bb5261ad

  • C:\Users\Admin\AppData\Local\Temp\6D7E.exe
    MD5

    b863582bafa8cf3d912c52aefd8f8b8c

    SHA1

    f272e8102fde54145d8da7ad1aa8b51fd6b691ef

    SHA256

    4bb2e211a3844b88fd193fb121208c3a95c83af1c649f2d654461fcec7441b50

    SHA512

    84561aeb00867b009738954d8f0f4cc254555d8e7f6830b03f61d8113a531df2ebe29479b29f623308cd39651adb954cd4d4a60a1f992eec3337233a3b38d4f1

  • C:\Users\Admin\AppData\Local\Temp\6D7E.exe
    MD5

    b863582bafa8cf3d912c52aefd8f8b8c

    SHA1

    f272e8102fde54145d8da7ad1aa8b51fd6b691ef

    SHA256

    4bb2e211a3844b88fd193fb121208c3a95c83af1c649f2d654461fcec7441b50

    SHA512

    84561aeb00867b009738954d8f0f4cc254555d8e7f6830b03f61d8113a531df2ebe29479b29f623308cd39651adb954cd4d4a60a1f992eec3337233a3b38d4f1

  • C:\Users\Admin\AppData\Local\Temp\734C.exe
    MD5

    418d67bdccc7c74875e0bc6c222a556e

    SHA1

    7f24f43e0de601467c5dcc6b654623dbe8151e49

    SHA256

    a5a8bd220d25a52cb97b7aaeffca5ab4c8d47f5d53302411f10348f0fa1a6aa2

    SHA512

    bc260724449b64c2a231d20c8b967b8ed51fe0d534127d84a33def4440869fad43af6be88a9eb22653bf9556662ea1dd0258af34ed0c44865304835f806a0064

  • C:\Users\Admin\AppData\Local\Temp\734C.exe
    MD5

    418d67bdccc7c74875e0bc6c222a556e

    SHA1

    7f24f43e0de601467c5dcc6b654623dbe8151e49

    SHA256

    a5a8bd220d25a52cb97b7aaeffca5ab4c8d47f5d53302411f10348f0fa1a6aa2

    SHA512

    bc260724449b64c2a231d20c8b967b8ed51fe0d534127d84a33def4440869fad43af6be88a9eb22653bf9556662ea1dd0258af34ed0c44865304835f806a0064

  • C:\Users\Admin\AppData\Local\Temp\734C.exe
    MD5

    418d67bdccc7c74875e0bc6c222a556e

    SHA1

    7f24f43e0de601467c5dcc6b654623dbe8151e49

    SHA256

    a5a8bd220d25a52cb97b7aaeffca5ab4c8d47f5d53302411f10348f0fa1a6aa2

    SHA512

    bc260724449b64c2a231d20c8b967b8ed51fe0d534127d84a33def4440869fad43af6be88a9eb22653bf9556662ea1dd0258af34ed0c44865304835f806a0064

  • C:\Users\Admin\AppData\Local\Temp\F57C.exe
    MD5

    d02702e7d72098036ee78811328527ac

    SHA1

    296ee6b97e48d2a03fbe2b5a4cf55d651a621f75

    SHA256

    3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446

    SHA512

    da13584c42940e25af8b94056e3904e0831164fe89b165559bc43c76efaa1f582347d6e43b0c81c48a6480ed6e17de2fcb37936b3a674f1007db20d576ca974d

  • C:\Users\Admin\AppData\Local\Temp\F57C.exe
    MD5

    d02702e7d72098036ee78811328527ac

    SHA1

    296ee6b97e48d2a03fbe2b5a4cf55d651a621f75

    SHA256

    3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446

    SHA512

    da13584c42940e25af8b94056e3904e0831164fe89b165559bc43c76efaa1f582347d6e43b0c81c48a6480ed6e17de2fcb37936b3a674f1007db20d576ca974d

  • C:\Users\Admin\AppData\Local\Temp\F57C.exe
    MD5

    d02702e7d72098036ee78811328527ac

    SHA1

    296ee6b97e48d2a03fbe2b5a4cf55d651a621f75

    SHA256

    3b8c6778cdcc8b60c941cfd512072fa5a97c3df3f0bfb5ed5b9696e8f107c446

    SHA512

    da13584c42940e25af8b94056e3904e0831164fe89b165559bc43c76efaa1f582347d6e43b0c81c48a6480ed6e17de2fcb37936b3a674f1007db20d576ca974d

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\OEGVWB~1.ZIP
    MD5

    02af1e6bf5ce65978ed260215a67e31e

    SHA1

    dcb98621817c40bf4c2e453472e695e0609dd3e4

    SHA256

    0948dacc48fee1681d302699535ee99371c57dd313eeb33f2804c89c948ad26f

    SHA512

    ac687e92f3500913eb68e629d447544849a83d5974613a9f5ac584bc5b798bed1d2eeaaf5bf59351a0fb3e9f4bf6afb0525d054a2ec81160d2fd87f7796124e8

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\XUBORU~1.ZIP
    MD5

    cc339e3ba4579e7eea133d831c5c02ac

    SHA1

    8ecaf802ec88306db84e7328b8d8f71249293ffc

    SHA256

    747f1c23cf09a9e4a6e0092bb29d3b8f43ea043e6e1f180f9a55adf8b30edff4

    SHA512

    f11535430add427d081f4f2fbb5beaf4a5ba73c0ad82dac9b9f02cc36e9c4f24d5a0ab3592673a2f22f92d23ea1250779aa23ce233ab31cbb8444214ee2d61e6

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_Chrome\DEFAUL~1.BIN
    MD5

    b963abf9a7967b3a22da64c9193fc932

    SHA1

    0831556392b56c00b07f04deb5474c4202c545e8

    SHA256

    6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

    SHA512

    64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_Chrome\DEFAUL~1.DB
    MD5

    b608d407fc15adea97c26936bc6f03f6

    SHA1

    953e7420801c76393902c0d6bb56148947e41571

    SHA256

    b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

    SHA512

    cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_Chrome\DEFAUL~2.DB
    MD5

    055c8c5c47424f3c2e7a6fc2ee904032

    SHA1

    5952781d22cff35d94861fac25d89a39af6d0a87

    SHA256

    531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

    SHA512

    c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_Chrome\DEFAUL~3.DB
    MD5

    8ee018331e95a610680a789192a9d362

    SHA1

    e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

    SHA256

    94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

    SHA512

    4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_INFOR~1.TXT
    MD5

    6f06d1014a52092ec114c1e439adea3f

    SHA1

    d5d39e346852e876b360e8191e2eb0dae69c5e47

    SHA256

    0e86ac22712a939c87c70c3be7aa0a39efacaf5415cb008d114a8a9c7759183d

    SHA512

    5acd7e7897f710fc553534fcf9659284b2039cee5b63c433e5e863b37083b004de6563471d6304804cee1d8545af39b9a1ab00116088f5c4241426728b8dc44d

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\_Files\_SCREE~1.JPE
    MD5

    995f01a4436802f1c07bf03511716e20

    SHA1

    ebe64500ecb70fa58539a4ee1bd0d21ba8ebc36e

    SHA256

    94776637d2dca2a6f6c9ad304609cb87a76ae490b60e92740f96be5657358cfd

    SHA512

    3fc80827747373f362b67c7fce566ef78c58cde4c988323b68fa23fa4e9ff95d7174b0e82093015c1e11ff7a7d97a63bbe939840ec412c39f66b4ed7f1b952ce

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\SCREEN~1.JPG
    MD5

    995f01a4436802f1c07bf03511716e20

    SHA1

    ebe64500ecb70fa58539a4ee1bd0d21ba8ebc36e

    SHA256

    94776637d2dca2a6f6c9ad304609cb87a76ae490b60e92740f96be5657358cfd

    SHA512

    3fc80827747373f362b67c7fce566ef78c58cde4c988323b68fa23fa4e9ff95d7174b0e82093015c1e11ff7a7d97a63bbe939840ec412c39f66b4ed7f1b952ce

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\SYSTEM~1.TXT
    MD5

    6f06d1014a52092ec114c1e439adea3f

    SHA1

    d5d39e346852e876b360e8191e2eb0dae69c5e47

    SHA256

    0e86ac22712a939c87c70c3be7aa0a39efacaf5415cb008d114a8a9c7759183d

    SHA512

    5acd7e7897f710fc553534fcf9659284b2039cee5b63c433e5e863b37083b004de6563471d6304804cee1d8545af39b9a1ab00116088f5c4241426728b8dc44d

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\_Chrome\DEFAUL~1.BIN
    MD5

    b963abf9a7967b3a22da64c9193fc932

    SHA1

    0831556392b56c00b07f04deb5474c4202c545e8

    SHA256

    6c0930a55e2b55dc01dbbcf1b43f4ceae3bd4b25bdde062953292427bdcb18f5

    SHA512

    64514a43b52786e09676bec07e15bc7224309c06c0ea5f691933ca3164c57a3e33d748fa8bd4596cf7deb64cbcd1e49ca75be4c22d79789d7ac3b1df45c19af2

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\_Chrome\DEFAUL~1.DB
    MD5

    b608d407fc15adea97c26936bc6f03f6

    SHA1

    953e7420801c76393902c0d6bb56148947e41571

    SHA256

    b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

    SHA512

    cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\_Chrome\DEFAUL~2.DB
    MD5

    055c8c5c47424f3c2e7a6fc2ee904032

    SHA1

    5952781d22cff35d94861fac25d89a39af6d0a87

    SHA256

    531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

    SHA512

    c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

  • C:\Users\Admin\AppData\Local\Temp\RWOwexDPeMF\files_\_Chrome\DEFAUL~3.DB
    MD5

    8ee018331e95a610680a789192a9d362

    SHA1

    e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

    SHA256

    94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

    SHA512

    4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

  • memory/716-166-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
    Filesize

    4KB

  • memory/716-196-0x0000000007020000-0x0000000007021000-memory.dmp
    Filesize

    4KB

  • memory/716-149-0x0000000000000000-mapping.dmp
  • memory/716-194-0x00000000070A0000-0x00000000070A1000-memory.dmp
    Filesize

    4KB

  • memory/716-193-0x00000000065C0000-0x00000000065C1000-memory.dmp
    Filesize

    4KB

  • memory/716-192-0x0000000005AA0000-0x0000000005AA1000-memory.dmp
    Filesize

    4KB

  • memory/716-153-0x0000000000840000-0x00000000009A2000-memory.dmp
    Filesize

    1.4MB

  • memory/716-154-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
    Filesize

    4KB

  • memory/716-155-0x00000000770D0000-0x0000000077292000-memory.dmp
    Filesize

    1.8MB

  • memory/716-157-0x0000000002B90000-0x0000000002BD5000-memory.dmp
    Filesize

    276KB

  • memory/716-156-0x0000000074510000-0x0000000074601000-memory.dmp
    Filesize

    964KB

  • memory/716-190-0x00000000059A0000-0x00000000059A1000-memory.dmp
    Filesize

    4KB

  • memory/716-158-0x0000000000840000-0x0000000000841000-memory.dmp
    Filesize

    4KB

  • memory/716-189-0x00000000066D0000-0x00000000066D1000-memory.dmp
    Filesize

    4KB

  • memory/716-180-0x000000006F480000-0x000000006F4CB000-memory.dmp
    Filesize

    300KB

  • memory/716-164-0x0000000073200000-0x0000000073280000-memory.dmp
    Filesize

    512KB

  • memory/716-179-0x0000000005680000-0x0000000005681000-memory.dmp
    Filesize

    4KB

  • memory/716-176-0x0000000074CF0000-0x0000000076038000-memory.dmp
    Filesize

    19.3MB

  • memory/716-167-0x00000000055E0000-0x00000000055E1000-memory.dmp
    Filesize

    4KB

  • memory/716-168-0x0000000005710000-0x0000000005711000-memory.dmp
    Filesize

    4KB

  • memory/716-169-0x0000000005640000-0x0000000005641000-memory.dmp
    Filesize

    4KB

  • memory/716-174-0x00000000746F0000-0x0000000074C74000-memory.dmp
    Filesize

    5.5MB

  • memory/716-175-0x00000000055A0000-0x00000000055A1000-memory.dmp
    Filesize

    4KB

  • memory/1072-172-0x00000000055E0000-0x00000000055E1000-memory.dmp
    Filesize

    4KB

  • memory/1072-173-0x00000000028B0000-0x00000000028B1000-memory.dmp
    Filesize

    4KB

  • memory/1072-170-0x0000000004D60000-0x0000000004D61000-memory.dmp
    Filesize

    4KB

  • memory/1072-171-0x0000000004D50000-0x0000000004D51000-memory.dmp
    Filesize

    4KB

  • memory/1072-177-0x0000000005280000-0x0000000005281000-memory.dmp
    Filesize

    4KB

  • memory/1072-178-0x0000000005B10000-0x0000000005B11000-memory.dmp
    Filesize

    4KB

  • memory/1072-159-0x0000000000000000-mapping.dmp
  • memory/1072-163-0x0000000000370000-0x0000000000371000-memory.dmp
    Filesize

    4KB

  • memory/1484-146-0x00000000047E0000-0x000000000486F000-memory.dmp
    Filesize

    572KB

  • memory/1484-145-0x0000000004790000-0x00000000047DF000-memory.dmp
    Filesize

    316KB

  • memory/1484-143-0x0000000000400000-0x0000000002BB9000-memory.dmp
    Filesize

    39.7MB

  • memory/1484-152-0x0000000000400000-0x0000000002BB9000-memory.dmp
    Filesize

    39.7MB

  • memory/1484-142-0x0000000000400000-0x0000000002BB9000-memory.dmp
    Filesize

    39.7MB

  • memory/1484-136-0x0000000000401E7A-mapping.dmp
  • memory/1484-135-0x0000000000400000-0x0000000002BB9000-memory.dmp
    Filesize

    39.7MB

  • memory/1556-139-0x0000000000000000-mapping.dmp
  • memory/1556-144-0x00000000007C8000-0x00000000007EE000-memory.dmp
    Filesize

    152KB

  • memory/1556-148-0x0000000000400000-0x0000000000469000-memory.dmp
    Filesize

    420KB

  • memory/1556-147-0x00000000006A0000-0x00000000006E7000-memory.dmp
    Filesize

    284KB

  • memory/1764-197-0x0000000000000000-mapping.dmp
  • memory/2156-122-0x0000000001130000-0x0000000001146000-memory.dmp
    Filesize

    88KB

  • memory/2156-130-0x00000000030E0000-0x00000000030F6000-memory.dmp
    Filesize

    88KB

  • memory/2332-181-0x0000000000400000-0x000000000045C000-memory.dmp
    Filesize

    368KB

  • memory/2332-182-0x0000000000457EDE-mapping.dmp
  • memory/2332-188-0x0000000002E30000-0x0000000002E31000-memory.dmp
    Filesize

    4KB

  • memory/2332-187-0x00000000056F0000-0x00000000056F1000-memory.dmp
    Filesize

    4KB

  • memory/2672-121-0x00000000001E0000-0x00000000001E9000-memory.dmp
    Filesize

    36KB

  • memory/2672-118-0x00000000005E9000-0x00000000005F2000-memory.dmp
    Filesize

    36KB

  • memory/2788-134-0x0000000000768000-0x00000000007D8000-memory.dmp
    Filesize

    448KB

  • memory/2788-131-0x0000000000000000-mapping.dmp
  • memory/2788-138-0x0000000001FF0000-0x0000000002072000-memory.dmp
    Filesize

    520KB

  • memory/2884-128-0x0000000000402F47-mapping.dmp
  • memory/3252-212-0x0000000000000000-mapping.dmp
  • memory/3808-119-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/3808-120-0x0000000000402F47-mapping.dmp
  • memory/4092-126-0x0000000000768000-0x0000000000771000-memory.dmp
    Filesize

    36KB

  • memory/4092-123-0x0000000000000000-mapping.dmp