Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    07/12/2021, 20:13

General

  • Target

    b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13.exe

  • Size

    341KB

  • MD5

    44c534a25397b6e564f7a1f1ade5c018

  • SHA1

    8e2ae659ed82c0b586566a1aa5e5456931764d51

  • SHA256

    b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13

  • SHA512

    f978b21f92ccf860955c11a2d7caf30a597a28fdea32d4e41b8c62970ec86a2583a592a54ec5bd881119dcbed546bda1d4c456ad315cee23c51860887f57fd80

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://94.158.245.167/capibar

    http://185.163.204.216/capibar

    http://185.225.19.238/capibar

    http://185.163.204.218/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes
  • url4cnc

    http://91.219.236.27/duglassa1

    http://94.158.245.167/duglassa1

    http://185.163.204.216/duglassa1

    http://185.225.19.238/duglassa1

    http://185.163.204.218/duglassa1

    https://t.me/duglassa1

rc4.plain
rc4.plain

Extracted

Family

arkei

Botnet

Default

C2

http://195.133.18.126/ZIaKfGwC3P.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Arkei Stealer Payload 1 IoCs
  • Bazar/Team9 Loader payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13.exe
    "C:\Users\Admin\AppData\Local\Temp\b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13.exe
      "C:\Users\Admin\AppData\Local\Temp\b2241fb99698ea3522b5222c80c6ebf5f2ed8f22484f453dc1d9a59d6ab1ca13.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3104
  • C:\Users\Admin\AppData\Local\Temp\9074.exe
    C:\Users\Admin\AppData\Local\Temp\9074.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\9074.exe
      C:\Users\Admin\AppData\Local\Temp\9074.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3488
  • C:\Users\Admin\AppData\Local\Temp\A229.exe
    C:\Users\Admin\AppData\Local\Temp\A229.exe
    1⤵
    • Executes dropped EXE
    PID:3680
  • C:\Users\Admin\AppData\Local\Temp\A4BA.exe
    C:\Users\Admin\AppData\Local\Temp\A4BA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:4048
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DFDF.dll
    1⤵
    • Loads dropped DLL
    PID:1292
  • C:\Users\Admin\AppData\Local\Temp\E3E8.exe
    C:\Users\Admin\AppData\Local\Temp\E3E8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1488
  • C:\Users\Admin\AppData\Local\Temp\E715.exe
    C:\Users\Admin\AppData\Local\Temp\E715.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping youtube.com
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\system32\PING.EXE
        "C:\Windows\system32\PING.EXE" youtube.com
        3⤵
        • Runs ping.exe
        PID:1936
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3904
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3904
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:816
    • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3056
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\E715.exe" -Force
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3416
    • C:\Users\Admin\AppData\Local\Temp\E715.exe
      C:\Users\Admin\AppData\Local\Temp\E715.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:1992
  • C:\Users\Admin\AppData\Local\Temp\F484.exe
    C:\Users\Admin\AppData\Local\Temp\F484.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:3696
        • C:\Windows\SysWOW64\cacls.exe
          CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
          3⤵
            PID:2660
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
            3⤵
              PID:2436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3040
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:1580
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
                3⤵
                  PID:2828
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                2⤵
                  PID:1208
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                    3⤵
                      PID:1708
                  • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                    "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:3544
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                      3⤵
                        PID:1636
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                          4⤵
                            PID:2976
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:2540
                    • C:\Users\Admin\AppData\Local\Temp\F31.exe
                      C:\Users\Admin\AppData\Local\Temp\F31.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3016
                    • C:\Users\Admin\AppData\Local\Temp\4D73.exe
                      C:\Users\Admin\AppData\Local\Temp\4D73.exe
                      1⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      PID:2476
                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3776

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/1292-242-0x00000000011D0000-0x00000000011D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1292-243-0x0000000000E80000-0x0000000000EC0000-memory.dmp

                            Filesize

                            256KB

                          • memory/1292-241-0x00000000011D0000-0x00000000011D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1488-185-0x00000000754D0000-0x0000000076818000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/1488-174-0x0000000073AF0000-0x0000000073B70000-memory.dmp

                            Filesize

                            512KB

                          • memory/1488-189-0x000000006FD20000-0x000000006FD6B000-memory.dmp

                            Filesize

                            300KB

                          • memory/1488-186-0x00000000054E0000-0x00000000054E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1488-184-0x0000000074C00000-0x0000000075184000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/1488-187-0x0000000005460000-0x0000000005461000-memory.dmp

                            Filesize

                            4KB

                          • memory/1488-167-0x0000000000C50000-0x0000000000D02000-memory.dmp

                            Filesize

                            712KB

                          • memory/1488-168-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1488-169-0x0000000077110000-0x00000000772D2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/1488-170-0x00000000027E0000-0x0000000002825000-memory.dmp

                            Filesize

                            276KB

                          • memory/1488-171-0x0000000074B00000-0x0000000074BF1000-memory.dmp

                            Filesize

                            964KB

                          • memory/1488-172-0x0000000000C50000-0x0000000000C51000-memory.dmp

                            Filesize

                            4KB

                          • memory/1580-123-0x00000000006F1000-0x0000000000702000-memory.dmp

                            Filesize

                            68KB

                          • memory/1852-308-0x000000001BEF4000-0x000000001BEF5000-memory.dmp

                            Filesize

                            4KB

                          • memory/1852-223-0x000000001BEF2000-0x000000001BEF4000-memory.dmp

                            Filesize

                            8KB

                          • memory/1852-188-0x000000001BEF0000-0x000000001BEF2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1852-182-0x0000000000260000-0x0000000000261000-memory.dmp

                            Filesize

                            4KB

                          • memory/1852-219-0x000000001E7E0000-0x000000001E8A8000-memory.dmp

                            Filesize

                            800KB

                          • memory/1992-309-0x000000001C810000-0x000000001C812000-memory.dmp

                            Filesize

                            8KB

                          • memory/2476-255-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-248-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-256-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-254-0x0000000077110000-0x00000000772D2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/2476-252-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-253-0x00000000009A0000-0x00000000009A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2476-249-0x0000000000900000-0x00000000009AE000-memory.dmp

                            Filesize

                            696KB

                          • memory/2476-251-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-250-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-265-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-247-0x00000000011E0000-0x00000000015AB000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2476-264-0x00000000772E0000-0x000000007746E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2756-118-0x0000000000030000-0x0000000000039000-memory.dmp

                            Filesize

                            36KB

                          • memory/3016-240-0x0000000000400000-0x0000000000515000-memory.dmp

                            Filesize

                            1.1MB

                          • memory/3016-239-0x0000000000520000-0x00000000005AF000-memory.dmp

                            Filesize

                            572KB

                          • memory/3020-119-0x0000000000820000-0x0000000000836000-memory.dmp

                            Filesize

                            88KB

                          • memory/3020-152-0x0000000002A10000-0x0000000002A26000-memory.dmp

                            Filesize

                            88KB

                          • memory/3104-116-0x0000000000400000-0x0000000000409000-memory.dmp

                            Filesize

                            36KB

                          • memory/3416-324-0x00000238F4A98000-0x00000238F4A99000-memory.dmp

                            Filesize

                            4KB

                          • memory/3416-323-0x00000238F4A96000-0x00000238F4A98000-memory.dmp

                            Filesize

                            8KB

                          • memory/3416-295-0x00000238F4A93000-0x00000238F4A95000-memory.dmp

                            Filesize

                            8KB

                          • memory/3416-294-0x00000238F4A90000-0x00000238F4A92000-memory.dmp

                            Filesize

                            8KB

                          • memory/3544-230-0x0000000000508000-0x0000000000526000-memory.dmp

                            Filesize

                            120KB

                          • memory/3544-235-0x0000000000460000-0x000000000050E000-memory.dmp

                            Filesize

                            696KB

                          • memory/3544-236-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3680-142-0x0000000000400000-0x0000000000491000-memory.dmp

                            Filesize

                            580KB

                          • memory/3680-135-0x0000000002060000-0x00000000020EF000-memory.dmp

                            Filesize

                            572KB

                          • memory/3680-132-0x00000000006D8000-0x0000000000727000-memory.dmp

                            Filesize

                            316KB

                          • memory/3776-263-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3980-203-0x0000025773B80000-0x0000025773B81000-memory.dmp

                            Filesize

                            4KB

                          • memory/3980-195-0x0000025770F50000-0x0000025770F52000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-217-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-191-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-192-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-202-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-201-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-200-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-199-0x0000025770E60000-0x0000025770E61000-memory.dmp

                            Filesize

                            4KB

                          • memory/3980-197-0x0000025770F53000-0x0000025770F55000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-198-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-196-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-218-0x0000025770F56000-0x0000025770F58000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-194-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/3980-193-0x0000025757060000-0x0000025757062000-memory.dmp

                            Filesize

                            8KB

                          • memory/4032-209-0x0000000001F80000-0x0000000001FB9000-memory.dmp

                            Filesize

                            228KB

                          • memory/4032-210-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/4048-158-0x0000000006A40000-0x0000000006A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-148-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-160-0x0000000007C40000-0x0000000007C41000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-157-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-156-0x0000000005F40000-0x0000000005F41000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-155-0x0000000005E20000-0x0000000005E21000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-154-0x0000000006B70000-0x0000000006B71000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-153-0x000000006FB50000-0x000000006FB9B000-memory.dmp

                            Filesize

                            300KB

                          • memory/4048-151-0x0000000005B10000-0x0000000005B11000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-150-0x00000000754D0000-0x0000000076818000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/4048-149-0x0000000074C00000-0x0000000075184000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/4048-159-0x0000000007540000-0x0000000007541000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-147-0x0000000003920000-0x0000000003921000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-146-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-145-0x0000000005A70000-0x0000000005A71000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-144-0x0000000006060000-0x0000000006061000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-143-0x00000000718E0000-0x0000000071960000-memory.dmp

                            Filesize

                            512KB

                          • memory/4048-140-0x00000000011F0000-0x00000000011F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-139-0x0000000074B00000-0x0000000074BF1000-memory.dmp

                            Filesize

                            964KB

                          • memory/4048-138-0x0000000077110000-0x00000000772D2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/4048-137-0x0000000001350000-0x0000000001351000-memory.dmp

                            Filesize

                            4KB

                          • memory/4048-136-0x00000000011F0000-0x0000000001259000-memory.dmp

                            Filesize

                            420KB

                          • memory/4048-134-0x0000000003010000-0x0000000003055000-memory.dmp

                            Filesize

                            276KB