Analysis

  • max time kernel
    36s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20/12/2021, 14:05

General

  • Target

    8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe

  • Size

    6.9MB

  • MD5

    0dbb370bd9561bebde04a63c0a967fac

  • SHA1

    c9dab70144d92a29c46921581174cf85eda44147

  • SHA256

    8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf

  • SHA512

    5355290e6439ef568782d340778fe54184db7249f3619633ebebef51a6810b762be07c9cc82ef8c033896686d358b54e114764d17038a7cf9386b0f4fe77577a

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.1

Botnet

915

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 51 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe
    "C:\Users\Admin\AppData\Local\Temp\8bc509f1ebfdf011b63c6a88571f683444ca974e7de0595e18632b9118b70adf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:796
      • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:980
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1780
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
                PID:284
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
                PID:1512
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                  5⤵
                    PID:1164
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Fri18083e5484e3b1125.exe
                  4⤵
                  • Loads dropped DLL
                  PID:840
                  • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18083e5484e3b1125.exe
                    Fri18083e5484e3b1125.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1888
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" -S .\BXNQ.FG
                      6⤵
                        PID:1816
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Fri1894cce7d386.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1320
                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1894cce7d386.exe
                      Fri1894cce7d386.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1272
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Fri18046280a7b776.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1776
                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exe
                      Fri18046280a7b776.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1948
                      • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exe
                        C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18046280a7b776.exe
                        6⤵
                          PID:2636
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Fri189c37bee8c29eb6.exe
                      4⤵
                      • Loads dropped DLL
                      PID:844
                      • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri189c37bee8c29eb6.exe
                        Fri189c37bee8c29eb6.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1728
                        • C:\Users\Admin\AppData\Local\510dbe9a-013a-46e6-baf4-953ee4bdfe70.exe
                          "C:\Users\Admin\AppData\Local\510dbe9a-013a-46e6-baf4-953ee4bdfe70.exe"
                          6⤵
                            PID:2992
                          • C:\Users\Admin\AppData\Local\84b10cb2-5c8a-4350-90bc-062f9353ca91.exe
                            "C:\Users\Admin\AppData\Local\84b10cb2-5c8a-4350-90bc-062f9353ca91.exe"
                            6⤵
                              PID:2064
                            • C:\Users\Admin\AppData\Local\9f1a66ff-5978-491b-9a83-eba5cf8138ed.exe
                              "C:\Users\Admin\AppData\Local\9f1a66ff-5978-491b-9a83-eba5cf8138ed.exe"
                              6⤵
                                PID:2152
                              • C:\Users\Admin\AppData\Local\13ee6744-4a91-445e-b7a9-edcb8dbdd81b.exe
                                "C:\Users\Admin\AppData\Local\13ee6744-4a91-445e-b7a9-edcb8dbdd81b.exe"
                                6⤵
                                  PID:2872
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Fri18cee95a1359570.exe
                              4⤵
                              • Loads dropped DLL
                              PID:268
                              • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18cee95a1359570.exe
                                Fri18cee95a1359570.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1532
                                • C:\Users\Admin\Pictures\Adobe Films\gbZQviSjcKZPcU59SznFE8iA.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\gbZQviSjcKZPcU59SznFE8iA.exe"
                                  6⤵
                                    PID:2952
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 1544
                                    6⤵
                                    • Program crash
                                    PID:1628
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Fri1851cb1bc629c3ac0.exe
                                4⤵
                                • Loads dropped DLL
                                PID:1180
                                • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1851cb1bc629c3ac0.exe
                                  Fri1851cb1bc629c3ac0.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2004
                                  • C:\Users\Admin\AppData\Local\Temp\is-D8SPP.tmp\Fri1851cb1bc629c3ac0.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-D8SPP.tmp\Fri1851cb1bc629c3ac0.tmp" /SL5="$30166,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1851cb1bc629c3ac0.exe"
                                    6⤵
                                      PID:1808
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri1845451c00c99718b.exe /mixtwo
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1724
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1845451c00c99718b.exe
                                    Fri1845451c00c99718b.exe /mixtwo
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2028
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri1845451c00c99718b.exe
                                      Fri1845451c00c99718b.exe /mixtwo
                                      6⤵
                                        PID:988
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Fri18002ecda8e9b.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1876
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18002ecda8e9b.exe
                                      Fri18002ecda8e9b.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1276
                                      • C:\Windows\SysWOW64\control.exe
                                        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\fFBFHI.cPL",
                                        6⤵
                                          PID:548
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fFBFHI.cPL",
                                            7⤵
                                              PID:2076
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Fri18e44ec8c2.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1792
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18e44ec8c2.exe
                                          Fri18e44ec8c2.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1580
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Fri187c9124f51b.exe
                                        4⤵
                                          PID:1688
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri187c9124f51b.exe
                                            Fri187c9124f51b.exe
                                            5⤵
                                              PID:2352
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Fri182efa7c2ad75046.exe
                                            4⤵
                                            • Loads dropped DLL
                                            PID:1824
                                            • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                              Fri182efa7c2ad75046.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:320
                                              • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                6⤵
                                                  PID:2628
                                                • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                  6⤵
                                                    PID:2680
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                    C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                    6⤵
                                                      PID:2732
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                      6⤵
                                                        PID:2836
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri182efa7c2ad75046.exe
                                                        6⤵
                                                          PID:2888
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Fri18b5451cab3.exe
                                                      4⤵
                                                        PID:1600
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe
                                                          Fri18b5451cab3.exe
                                                          5⤵
                                                            PID:1740
                                                            • C:\Users\Admin\AppData\Local\Temp\is-54PQF.tmp\Fri18b5451cab3.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-54PQF.tmp\Fri18b5451cab3.tmp" /SL5="$10194,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe"
                                                              6⤵
                                                                PID:1564
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe" /SILENT
                                                                  7⤵
                                                                    PID:1400
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-ABD5M.tmp\Fri18b5451cab3.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-ABD5M.tmp\Fri18b5451cab3.tmp" /SL5="$2019A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri18b5451cab3.exe" /SILENT
                                                                      8⤵
                                                                        PID:1172
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Fri184baf2e5e45.exe
                                                                4⤵
                                                                • Loads dropped DLL
                                                                PID:608
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri184baf2e5e45.exe
                                                                  Fri184baf2e5e45.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:360
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Fri185ef293d31.exe
                                                                4⤵
                                                                • Loads dropped DLL
                                                                PID:2020
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exe
                                                                  Fri185ef293d31.exe
                                                                  5⤵
                                                                    PID:1400
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSC13B45C6\Fri185ef293d31.exe" -u
                                                                      6⤵
                                                                        PID:1528
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 484
                                                                    4⤵
                                                                    • Program crash
                                                                    PID:1960
                                                            • C:\Windows\system32\rundll32.exe
                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:2584
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                2⤵
                                                                  PID:2656
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                1⤵
                                                                  PID:2804

                                                                Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • memory/284-261-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/284-253-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/284-240-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/320-211-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-236-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/320-234-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/360-245-0x0000000000890000-0x0000000000969000-memory.dmp

                                                                        Filesize

                                                                        868KB

                                                                      • memory/360-246-0x0000000000400000-0x000000000088B000-memory.dmp

                                                                        Filesize

                                                                        4.5MB

                                                                      • memory/360-244-0x0000000000340000-0x00000000003BC000-memory.dmp

                                                                        Filesize

                                                                        496KB

                                                                      • memory/876-264-0x0000000000810000-0x000000000085D000-memory.dmp

                                                                        Filesize

                                                                        308KB

                                                                      • memory/876-266-0x0000000000AD0000-0x0000000000B42000-memory.dmp

                                                                        Filesize

                                                                        456KB

                                                                      • memory/972-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/980-96-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                        Filesize

                                                                        100KB

                                                                      • memory/980-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                        Filesize

                                                                        1.5MB

                                                                      • memory/980-92-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                        Filesize

                                                                        152KB

                                                                      • memory/980-91-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                        Filesize

                                                                        100KB

                                                                      • memory/980-94-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                        Filesize

                                                                        100KB

                                                                      • memory/980-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                        Filesize

                                                                        572KB

                                                                      • memory/980-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                        Filesize

                                                                        572KB

                                                                      • memory/980-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                        Filesize

                                                                        152KB

                                                                      • memory/980-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                        Filesize

                                                                        1.5MB

                                                                      • memory/980-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                        Filesize

                                                                        1.5MB

                                                                      • memory/980-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                        Filesize

                                                                        1.5MB

                                                                      • memory/980-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                        Filesize

                                                                        100KB

                                                                      • memory/980-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                        Filesize

                                                                        572KB

                                                                      • memory/980-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                        Filesize

                                                                        1.5MB

                                                                      • memory/980-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                        Filesize

                                                                        572KB

                                                                      • memory/1164-252-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/1164-241-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/1164-262-0x0000000001FE0000-0x0000000002C2A000-memory.dmp

                                                                        Filesize

                                                                        12.3MB

                                                                      • memory/1172-226-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1220-256-0x0000000002A30000-0x0000000002A46000-memory.dmp

                                                                        Filesize

                                                                        88KB

                                                                      • memory/1272-251-0x0000000000400000-0x0000000000817000-memory.dmp

                                                                        Filesize

                                                                        4.1MB

                                                                      • memory/1272-249-0x0000000000240000-0x0000000000248000-memory.dmp

                                                                        Filesize

                                                                        32KB

                                                                      • memory/1272-250-0x0000000000250000-0x0000000000259000-memory.dmp

                                                                        Filesize

                                                                        36KB

                                                                      • memory/1400-221-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                        Filesize

                                                                        816KB

                                                                      • memory/1532-248-0x00000000041E0000-0x000000000432E000-memory.dmp

                                                                        Filesize

                                                                        1.3MB

                                                                      • memory/1564-210-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1728-243-0x0000000002400000-0x0000000002401000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1728-227-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1728-215-0x00000000002E0000-0x00000000002E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1740-207-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                        Filesize

                                                                        816KB

                                                                      • memory/1948-237-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1948-212-0x0000000001240000-0x0000000001241000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1948-235-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/1960-247-0x0000000001E80000-0x0000000001F9C000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/2004-189-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                        Filesize

                                                                        80KB

                                                                      • memory/2076-242-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/2152-293-0x0000000000350000-0x0000000000395000-memory.dmp

                                                                        Filesize

                                                                        276KB

                                                                      • memory/2636-257-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                      • memory/2656-263-0x0000000001F20000-0x0000000002021000-memory.dmp

                                                                        Filesize

                                                                        1.0MB

                                                                      • memory/2656-265-0x0000000000270000-0x00000000002CD000-memory.dmp

                                                                        Filesize

                                                                        372KB

                                                                      • memory/2804-269-0x00000000004A0000-0x0000000000512000-memory.dmp

                                                                        Filesize

                                                                        456KB

                                                                      • memory/2872-310-0x00000000000F0000-0x0000000000135000-memory.dmp

                                                                        Filesize

                                                                        276KB

                                                                      • memory/2888-290-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/2992-288-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                        Filesize

                                                                        4KB