Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    16-12-2021 03:40

General

  • Target

    4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4.exe

  • Size

    335KB

  • MD5

    8058a8d6986a1ce6b8eabc81b6b8acaf

  • SHA1

    7b79bb7ae73e5dd4d34f1e3ecfce3755be65388b

  • SHA256

    4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4

  • SHA512

    6f97ed7bce4f31020a84eca3b7e53e9ad604d998414e597947fc5a9ea38f5ea50e2b08d68d24e5a8e120ff36254c6cf6b4f1c1ed9a98c14d3f3145ccd961ddb8

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

3372020928

C2

jeliskvosh.com

Extracted

Family

redline

Botnet

22

C2

195.133.47.114:38127

Extracted

Family

tofsee

C2

mubrikych.top

oxxyfix.xyz

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.77.127.230:8888

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • VKeylogger

    A keylogger first seen in Nov 2020.

  • VKeylogger Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4.exe
    "C:\Users\Admin\AppData\Local\Temp\4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4.exe
      "C:\Users\Admin\AppData\Local\Temp\4b18d8ec4c4c5170be35e2074f81401d9c67276e5f1d83b4ff0f3eeffe775ba4.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3148
  • C:\Users\Admin\AppData\Local\Temp\3739.exe
    C:\Users\Admin\AppData\Local\Temp\3739.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:3504
  • C:\Users\Admin\AppData\Local\Temp\4052.exe
    C:\Users\Admin\AppData\Local\Temp\4052.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\4052.exe
      C:\Users\Admin\AppData\Local\Temp\4052.exe
      2⤵
      • Executes dropped EXE
      PID:400
  • C:\Users\Admin\AppData\Local\Temp\4B30.exe
    C:\Users\Admin\AppData\Local\Temp\4B30.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3144
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4FB5.dll
    1⤵
    • Loads dropped DLL
    PID:2704
  • C:\Users\Admin\AppData\Local\Temp\5D14.exe
    C:\Users\Admin\AppData\Local\Temp\5D14.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:3640
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5D14.exe" & exit
      2⤵
        PID:3216
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:1780
    • C:\Users\Admin\AppData\Local\Temp\6003.exe
      C:\Users\Admin\AppData\Local\Temp\6003.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1204
    • C:\Users\Admin\AppData\Local\Temp\692C.exe
      C:\Users\Admin\AppData\Local\Temp\692C.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ziraydwt\
        2⤵
          PID:1820
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fboailmt.exe" C:\Windows\SysWOW64\ziraydwt\
          2⤵
            PID:1916
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create ziraydwt binPath= "C:\Windows\SysWOW64\ziraydwt\fboailmt.exe /d\"C:\Users\Admin\AppData\Local\Temp\692C.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:2728
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description ziraydwt "wifi internet conection"
              2⤵
                PID:2044
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start ziraydwt
                2⤵
                  PID:1376
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:1844
                • C:\Users\Admin\AppData\Local\Temp\7C47.exe
                  C:\Users\Admin\AppData\Local\Temp\7C47.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:436
                  • C:\Users\Admin\AppData\Local\Temp\7C47.exe
                    C:\Users\Admin\AppData\Local\Temp\7C47.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2220
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noexit
                      3⤵
                      • Blocklisted process makes network request
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4076
                • C:\Users\Admin\AppData\Local\Temp\7FA4.exe
                  C:\Users\Admin\AppData\Local\Temp\7FA4.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  PID:2436
                • C:\Users\Admin\AppData\Local\Temp\817A.exe
                  C:\Users\Admin\AppData\Local\Temp\817A.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2992
                • C:\Users\Admin\AppData\Local\Temp\84A7.exe
                  C:\Users\Admin\AppData\Local\Temp\84A7.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  PID:3056
                  • C:\Windows\SysWOW64\explorer.exe
                    "C:\Windows\SysWOW64\explorer.exe"
                    2⤵
                    • Adds Run key to start application
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of FindShellTrayWindow
                    PID:916
                • C:\Users\Admin\AppData\Local\Temp\8D34.exe
                  C:\Users\Admin\AppData\Local\Temp\8D34.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2724
                • C:\Users\Admin\AppData\Local\Temp\9727.exe
                  C:\Users\Admin\AppData\Local\Temp\9727.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1252
                • C:\Windows\SysWOW64\ziraydwt\fboailmt.exe
                  C:\Windows\SysWOW64\ziraydwt\fboailmt.exe /d"C:\Users\Admin\AppData\Local\Temp\692C.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:392
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:396
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                        PID:1120
                  • C:\Users\Admin\AppData\Local\Temp\9DD0.exe
                    C:\Users\Admin\AppData\Local\Temp\9DD0.exe
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    PID:940
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im 9DD0.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9DD0.exe" & del C:\ProgramData\*.dll & exit
                      2⤵
                        PID:2240
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im 9DD0.exe /f
                          3⤵
                          • Kills process with taskkill
                          PID:2624
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 6
                          3⤵
                          • Delays execution with timeout.exe
                          PID:3472
                    • C:\Users\Admin\AppData\Local\Temp\AD22.exe
                      C:\Users\Admin\AppData\Local\Temp\AD22.exe
                      1⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3204
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                      1⤵
                        PID:1820
                      • C:\Users\Admin\AppData\Local\Temp\E1D0.exe
                        C:\Users\Admin\AppData\Local\Temp\E1D0.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:496
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                        • Accesses Microsoft Outlook profiles
                        • outlook_office_path
                        • outlook_win_path
                        PID:3940
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:2708

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/1204-172-0x0000000000400000-0x00000000004CD000-memory.dmp

                          Filesize

                          820KB

                        • memory/1204-171-0x00000000005C0000-0x000000000070A000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/1204-168-0x00000000007B6000-0x00000000007C7000-memory.dmp

                          Filesize

                          68KB

                        • memory/1252-304-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-298-0x0000000006690000-0x0000000006691000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-276-0x00000000035E0000-0x00000000035E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-272-0x00000000028C0000-0x00000000028C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-273-0x0000000002930000-0x0000000002931000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-270-0x0000000002910000-0x0000000002911000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-271-0x00000000028D0000-0x00000000028D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-269-0x00000000028A0000-0x00000000028A1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-266-0x00000000028E0000-0x00000000028E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-263-0x0000000000C70000-0x0000000000CD0000-memory.dmp

                          Filesize

                          384KB

                        • memory/1252-265-0x0000000002820000-0x0000000002821000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-287-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-291-0x0000000000D20000-0x0000000000D21000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-335-0x00000000008F0000-0x000000000099E000-memory.dmp

                          Filesize

                          696KB

                        • memory/1252-330-0x00000000008F0000-0x000000000099E000-memory.dmp

                          Filesize

                          696KB

                        • memory/1252-334-0x00000000008F0000-0x000000000099E000-memory.dmp

                          Filesize

                          696KB

                        • memory/1252-327-0x00000000008F0000-0x000000000099E000-memory.dmp

                          Filesize

                          696KB

                        • memory/1252-289-0x0000000000D10000-0x0000000000D11000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-324-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-322-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-320-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-318-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-317-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-316-0x0000000002880000-0x0000000002881000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-311-0x0000000002860000-0x0000000002861000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-312-0x0000000002810000-0x0000000002811000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-308-0x0000000002840000-0x0000000002841000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-309-0x00000000027F0000-0x00000000027F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-307-0x0000000002830000-0x0000000002831000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-282-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-294-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-306-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-279-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-302-0x0000000002610000-0x0000000002611000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-301-0x0000000000D40000-0x0000000000D41000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-300-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-277-0x00000000035D0000-0x00000000035D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-267-0x00000000028F0000-0x00000000028F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1252-274-0x0000000002900000-0x0000000002901000-memory.dmp

                          Filesize

                          4KB

                        • memory/1476-148-0x00000000007B6000-0x00000000007C7000-memory.dmp

                          Filesize

                          68KB

                        • memory/2220-180-0x0000000000400000-0x000000000040F000-memory.dmp

                          Filesize

                          60KB

                        • memory/2220-176-0x0000000000400000-0x000000000040F000-memory.dmp

                          Filesize

                          60KB

                        • memory/2364-160-0x00000000030E0000-0x00000000030F6000-memory.dmp

                          Filesize

                          88KB

                        • memory/2364-119-0x0000000000E50000-0x0000000000E66000-memory.dmp

                          Filesize

                          88KB

                        • memory/2364-227-0x00000000051A0000-0x00000000051B6000-memory.dmp

                          Filesize

                          88KB

                        • memory/2376-118-0x0000000000530000-0x0000000000539000-memory.dmp

                          Filesize

                          36KB

                        • memory/2436-198-0x0000000003020000-0x0000000003022000-memory.dmp

                          Filesize

                          8KB

                        • memory/2704-162-0x0000000001300000-0x000000000130A000-memory.dmp

                          Filesize

                          40KB

                        • memory/2724-219-0x0000000000900000-0x0000000000901000-memory.dmp

                          Filesize

                          4KB

                        • memory/2724-229-0x0000000002670000-0x00000000026B5000-memory.dmp

                          Filesize

                          276KB

                        • memory/2724-218-0x0000000000920000-0x00000000009BC000-memory.dmp

                          Filesize

                          624KB

                        • memory/2724-222-0x0000000075A30000-0x0000000075B21000-memory.dmp

                          Filesize

                          964KB

                        • memory/2724-224-0x0000000000920000-0x0000000000921000-memory.dmp

                          Filesize

                          4KB

                        • memory/2724-228-0x00000000722E0000-0x0000000072360000-memory.dmp

                          Filesize

                          512KB

                        • memory/2724-249-0x0000000005210000-0x0000000005211000-memory.dmp

                          Filesize

                          4KB

                        • memory/2724-244-0x0000000070420000-0x000000007046B000-memory.dmp

                          Filesize

                          300KB

                        • memory/2724-238-0x00000000745A0000-0x00000000758E8000-memory.dmp

                          Filesize

                          19.3MB

                        • memory/2724-237-0x00000000767C0000-0x0000000076D44000-memory.dmp

                          Filesize

                          5.5MB

                        • memory/2724-221-0x0000000076EC0000-0x0000000077082000-memory.dmp

                          Filesize

                          1.8MB

                        • memory/2992-208-0x00000000050C0000-0x00000000056C6000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/2992-191-0x0000000000890000-0x0000000000891000-memory.dmp

                          Filesize

                          4KB

                        • memory/3056-315-0x0000000000400000-0x000000000081A000-memory.dmp

                          Filesize

                          4.1MB

                        • memory/3056-314-0x0000000000940000-0x0000000000A8A000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/3056-313-0x0000000000030000-0x000000000003A000-memory.dmp

                          Filesize

                          40KB

                        • memory/3112-212-0x00000000004E0000-0x000000000058E000-memory.dmp

                          Filesize

                          696KB

                        • memory/3112-213-0x0000000000400000-0x00000000004D5000-memory.dmp

                          Filesize

                          852KB

                        • memory/3144-134-0x0000000076EC0000-0x0000000077082000-memory.dmp

                          Filesize

                          1.8MB

                        • memory/3144-133-0x00000000007E0000-0x00000000007E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-154-0x0000000004E90000-0x0000000004E91000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-140-0x00000000722E0000-0x0000000072360000-memory.dmp

                          Filesize

                          512KB

                        • memory/3144-146-0x0000000004E50000-0x0000000004E51000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-143-0x0000000005400000-0x0000000005401000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-155-0x0000000070420000-0x000000007046B000-memory.dmp

                          Filesize

                          300KB

                        • memory/3144-151-0x0000000002C70000-0x0000000002C71000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-147-0x00000000767C0000-0x0000000076D44000-memory.dmp

                          Filesize

                          5.5MB

                        • memory/3144-132-0x0000000000900000-0x0000000000969000-memory.dmp

                          Filesize

                          420KB

                        • memory/3144-137-0x0000000000900000-0x0000000000901000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-136-0x0000000000970000-0x0000000000ABA000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/3144-149-0x00000000745A0000-0x00000000758E8000-memory.dmp

                          Filesize

                          19.3MB

                        • memory/3144-145-0x0000000004F20000-0x0000000004F21000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-144-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3144-135-0x0000000075A30000-0x0000000075B21000-memory.dmp

                          Filesize

                          964KB

                        • memory/3148-116-0x0000000000400000-0x0000000000409000-memory.dmp

                          Filesize

                          36KB

                        • memory/3504-128-0x0000000000400000-0x00000000004CD000-memory.dmp

                          Filesize

                          820KB

                        • memory/3504-127-0x00000000004D0000-0x000000000061A000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/3504-126-0x00000000007D6000-0x00000000007E7000-memory.dmp

                          Filesize

                          68KB

                        • memory/3640-167-0x0000000000746000-0x0000000000758000-memory.dmp

                          Filesize

                          72KB

                        • memory/3640-170-0x0000000000400000-0x00000000004D6000-memory.dmp

                          Filesize

                          856KB

                        • memory/3640-169-0x00000000004E0000-0x000000000058E000-memory.dmp

                          Filesize

                          696KB

                        • memory/4076-183-0x0000000004A20000-0x0000000004A21000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-210-0x00000000081F0000-0x00000000081F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-203-0x0000000007E10000-0x0000000007E11000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-184-0x00000000074C0000-0x00000000074C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-195-0x0000000007460000-0x0000000007461000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-201-0x0000000007B70000-0x0000000007B71000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-193-0x0000000004A10000-0x0000000004A11000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-199-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-182-0x0000000000F70000-0x0000000000F71000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-196-0x0000000004A12000-0x0000000004A13000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-181-0x0000000000F70000-0x0000000000F71000-memory.dmp

                          Filesize

                          4KB

                        • memory/4076-223-0x0000000000F70000-0x0000000000F71000-memory.dmp

                          Filesize

                          4KB