Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    07/12/2021, 19:47

General

  • Target

    84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3.exe

  • Size

    341KB

  • MD5

    a0a201f098c95d71c7e2b64c6be9bc46

  • SHA1

    f317aa454ce83479ef95ebdecf767d11ea64e948

  • SHA256

    84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3

  • SHA512

    2c86329c8e7996bf33c22aab972635e18db4e173f590fa9edce7f3636c0b60bc1585f3c129f14832d3cf736886dcd68b930e76b084f6240cfe1ad0624963e3d0

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://94.158.245.167/capibar

    http://185.163.204.216/capibar

    http://185.225.19.238/capibar

    http://185.163.204.218/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes
  • url4cnc

    http://91.219.236.27/duglassa1

    http://94.158.245.167/duglassa1

    http://185.163.204.216/duglassa1

    http://185.225.19.238/duglassa1

    http://185.163.204.218/duglassa1

    https://t.me/duglassa1

rc4.plain
rc4.plain

Extracted

Family

arkei

Botnet

Default

C2

http://195.133.18.126/ZIaKfGwC3P.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Arkei Stealer Payload 1 IoCs
  • Bazar/Team9 Loader payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3.exe
    "C:\Users\Admin\AppData\Local\Temp\84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3.exe
      "C:\Users\Admin\AppData\Local\Temp\84e74384360d6d439ed3ed16141ae2d93355d4f0916c41f1a3226202850795e3.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2744
  • C:\Users\Admin\AppData\Local\Temp\47B3.exe
    C:\Users\Admin\AppData\Local\Temp\47B3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\47B3.exe
      C:\Users\Admin\AppData\Local\Temp\47B3.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3368
  • C:\Users\Admin\AppData\Local\Temp\C35D.exe
    C:\Users\Admin\AppData\Local\Temp\C35D.exe
    1⤵
    • Executes dropped EXE
    PID:1892
  • C:\Users\Admin\AppData\Local\Temp\C5EE.exe
    C:\Users\Admin\AppData\Local\Temp\C5EE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1888
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6C1.dll
    1⤵
    • Loads dropped DLL
    PID:1444
  • C:\Users\Admin\AppData\Local\Temp\B36.exe
    C:\Users\Admin\AppData\Local\Temp\B36.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2384
  • C:\Users\Admin\AppData\Local\Temp\DA8.exe
    C:\Users\Admin\AppData\Local\Temp\DA8.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping youtube.com
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\system32\PING.EXE
        "C:\Windows\system32\PING.EXE" youtube.com
        3⤵
        • Runs ping.exe
        PID:1532
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3304
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3304
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2204
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3764
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3764
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\DA8.exe" -Force
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Users\Admin\AppData\Local\Temp\DA8.exe
      C:\Users\Admin\AppData\Local\Temp\DA8.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
  • C:\Users\Admin\AppData\Local\Temp\1C30.exe
    C:\Users\Admin\AppData\Local\Temp\1C30.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:3252
        • C:\Windows\SysWOW64\cacls.exe
          CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
          3⤵
            PID:3384
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:680
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
            3⤵
              PID:2596
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:3444
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
                3⤵
                  PID:3372
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                2⤵
                  PID:3244
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                    3⤵
                      PID:1908
                  • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                    "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1872
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                      3⤵
                        PID:3588
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                          4⤵
                            PID:2140
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:1740
                    • C:\Users\Admin\AppData\Local\Temp\3A29.exe
                      C:\Users\Admin\AppData\Local\Temp\3A29.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1384
                    • C:\Users\Admin\AppData\Local\Temp\7B1B.exe
                      C:\Users\Admin\AppData\Local\Temp\7B1B.exe
                      1⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      PID:3556
                    • C:\Users\Admin\AppData\Roaming\eaetsdj
                      C:\Users\Admin\AppData\Roaming\eaetsdj
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2132
                      • C:\Users\Admin\AppData\Roaming\eaetsdj
                        C:\Users\Admin\AppData\Roaming\eaetsdj
                        2⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:2944
                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2140

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/1064-300-0x0000000000EA0000-0x0000000000EA2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1384-238-0x0000000000520000-0x000000000066A000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1384-237-0x00000000008C1000-0x0000000000910000-memory.dmp

                            Filesize

                            316KB

                          • memory/1384-239-0x0000000000400000-0x0000000000515000-memory.dmp

                            Filesize

                            1.1MB

                          • memory/1444-241-0x0000000001500000-0x0000000001502000-memory.dmp

                            Filesize

                            8KB

                          • memory/1444-242-0x0000000003280000-0x00000000032C0000-memory.dmp

                            Filesize

                            256KB

                          • memory/1444-240-0x0000000001500000-0x0000000001502000-memory.dmp

                            Filesize

                            8KB

                          • memory/1872-236-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/1872-227-0x0000000000808000-0x0000000000826000-memory.dmp

                            Filesize

                            120KB

                          • memory/1872-235-0x0000000000460000-0x00000000005AA000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/1888-189-0x00000000067E0000-0x00000000067E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-145-0x0000000005400000-0x0000000005401000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-157-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-156-0x0000000005BD0000-0x0000000005BD1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-155-0x0000000006010000-0x0000000006011000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-154-0x0000000005010000-0x0000000005011000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-190-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-153-0x0000000070130000-0x000000007017B000-memory.dmp

                            Filesize

                            300KB

                          • memory/1888-152-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-151-0x00000000744E0000-0x0000000075828000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/1888-150-0x0000000075AD0000-0x0000000076054000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/1888-149-0x0000000002C90000-0x0000000002C91000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-148-0x00000000009E0000-0x00000000009E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-147-0x0000000004F00000-0x0000000004F01000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-146-0x0000000002620000-0x0000000002621000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-158-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-144-0x0000000071EC0000-0x0000000071F40000-memory.dmp

                            Filesize

                            512KB

                          • memory/1888-142-0x0000000000C90000-0x0000000000C91000-memory.dmp

                            Filesize

                            4KB

                          • memory/1888-141-0x0000000076430000-0x0000000076521000-memory.dmp

                            Filesize

                            964KB

                          • memory/1888-135-0x0000000000C90000-0x0000000000CF9000-memory.dmp

                            Filesize

                            420KB

                          • memory/1888-139-0x0000000002640000-0x0000000002685000-memory.dmp

                            Filesize

                            276KB

                          • memory/1888-137-0x00000000760B0000-0x0000000076272000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/1888-136-0x0000000000050000-0x0000000000051000-memory.dmp

                            Filesize

                            4KB

                          • memory/1892-138-0x00000000020D0000-0x000000000215F000-memory.dmp

                            Filesize

                            572KB

                          • memory/1892-133-0x0000000000529000-0x0000000000579000-memory.dmp

                            Filesize

                            320KB

                          • memory/1892-140-0x0000000000400000-0x0000000000491000-memory.dmp

                            Filesize

                            580KB

                          • memory/2104-207-0x0000000001F70000-0x0000000001FA9000-memory.dmp

                            Filesize

                            228KB

                          • memory/2104-209-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/2104-206-0x00000000005E8000-0x0000000000606000-memory.dmp

                            Filesize

                            120KB

                          • memory/2140-310-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/2384-165-0x0000000000870000-0x0000000000922000-memory.dmp

                            Filesize

                            712KB

                          • memory/2384-168-0x0000000076430000-0x0000000076521000-memory.dmp

                            Filesize

                            964KB

                          • memory/2384-169-0x0000000000870000-0x0000000000871000-memory.dmp

                            Filesize

                            4KB

                          • memory/2384-171-0x0000000071EC0000-0x0000000071F40000-memory.dmp

                            Filesize

                            512KB

                          • memory/2384-166-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2384-178-0x0000000001250000-0x000000000139A000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/2384-167-0x00000000760B0000-0x0000000076272000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/2384-186-0x0000000070130000-0x000000007017B000-memory.dmp

                            Filesize

                            300KB

                          • memory/2384-184-0x00000000744E0000-0x0000000075828000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/2384-183-0x0000000075AD0000-0x0000000076054000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/2384-179-0x00000000058A0000-0x00000000058A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2744-117-0x0000000000400000-0x0000000000409000-memory.dmp

                            Filesize

                            36KB

                          • memory/2812-200-0x0000023653900000-0x0000023653902000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-195-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-194-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-193-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-192-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-191-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-219-0x0000023653906000-0x0000023653908000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-201-0x0000023653903000-0x0000023653905000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-199-0x00000236542A0000-0x00000236542A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2812-215-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-196-0x000002363B260000-0x000002363B261000-memory.dmp

                            Filesize

                            4KB

                          • memory/2812-216-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-198-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/2812-197-0x0000023639700000-0x0000023639702000-memory.dmp

                            Filesize

                            8KB

                          • memory/3004-181-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3004-292-0x000000001C6F4000-0x000000001C6F5000-memory.dmp

                            Filesize

                            4KB

                          • memory/3004-220-0x000000001C6F2000-0x000000001C6F4000-memory.dmp

                            Filesize

                            8KB

                          • memory/3004-217-0x000000001EE80000-0x000000001EF48000-memory.dmp

                            Filesize

                            800KB

                          • memory/3004-187-0x000000001C6F0000-0x000000001C6F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3040-326-0x00000000046C0000-0x00000000046D6000-memory.dmp

                            Filesize

                            88KB

                          • memory/3040-127-0x00000000027D0000-0x00000000027E6000-memory.dmp

                            Filesize

                            88KB

                          • memory/3040-119-0x0000000000940000-0x0000000000956000-memory.dmp

                            Filesize

                            88KB

                          • memory/3048-116-0x00000000001C0000-0x00000000001C9000-memory.dmp

                            Filesize

                            36KB

                          • memory/3512-290-0x00000218B12F0000-0x00000218B12F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3512-291-0x00000218B12F3000-0x00000218B12F5000-memory.dmp

                            Filesize

                            8KB

                          • memory/3512-324-0x00000218B12F6000-0x00000218B12F8000-memory.dmp

                            Filesize

                            8KB

                          • memory/3512-325-0x00000218B12F8000-0x00000218B12F9000-memory.dmp

                            Filesize

                            4KB

                          • memory/3556-252-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-250-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3556-255-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-254-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-259-0x00000000778C0000-0x0000000077A4E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/3556-253-0x00000000760B0000-0x0000000076272000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/3556-251-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-260-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-249-0x0000000002CB0000-0x0000000002CF6000-memory.dmp

                            Filesize

                            280KB

                          • memory/3556-248-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-247-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/3556-246-0x0000000000EE0000-0x00000000012AB000-memory.dmp

                            Filesize

                            3.8MB