Analysis

  • max time kernel
    158s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20/12/2021, 14:04

General

  • Target

    b92625560c246d61a57b07fa793b92926260bdd983b04459f60ccd10c1cf63f2.exe

  • Size

    7.2MB

  • MD5

    8d942065370ff79150835e15d4cc409b

  • SHA1

    271cd3e2a95c82ca508f6d0f5e8750edfaa004bc

  • SHA256

    b92625560c246d61a57b07fa793b92926260bdd983b04459f60ccd10c1cf63f2

  • SHA512

    46838faca94854e539f5bdd4b29c5f433af98ba7ad8d86cea52c0adc6e085dbc4c570ad501f5682fe5ca261b626d48cf73b9633fb27cc480d1772dde63d673d5

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.1

Botnet

915

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 5 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 30 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92625560c246d61a57b07fa793b92926260bdd983b04459f60ccd10c1cf63f2.exe
    "C:\Users\Admin\AppData\Local\Temp\b92625560c246d61a57b07fa793b92926260bdd983b04459f60ccd10c1cf63f2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Users\Admin\AppData\Local\Temp\7zS48361276\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS48361276\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1824
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:676
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
              PID:1508
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1472
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sat04e9d8f172e50.exe /mixtwo
              4⤵
              • Loads dropped DLL
              PID:1460
              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04e9d8f172e50.exe
                Sat04e9d8f172e50.exe /mixtwo
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1868
                • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04e9d8f172e50.exe
                  Sat04e9d8f172e50.exe /mixtwo
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:652
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /im "Sat04e9d8f172e50.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04e9d8f172e50.exe" & exit
                    7⤵
                      PID:2120
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im "Sat04e9d8f172e50.exe" /f
                        8⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2200
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sat045fe73e29fa5e0b2.exe
                4⤵
                • Loads dropped DLL
                PID:1516
                • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat045fe73e29fa5e0b2.exe
                  Sat045fe73e29fa5e0b2.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2040
                  • C:\Windows\SysWOW64\control.exe
                    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\JQOzcH.CPL",
                    6⤵
                      PID:2392
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\JQOzcH.CPL",
                        7⤵
                          PID:2560
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sat0475667e2de8c3.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1320
                    • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat0475667e2de8c3.exe
                      Sat0475667e2de8c3.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1820
                      • C:\Users\Admin\AppData\Local\e6ea2bd6-9916-41df-b676-76287cf1d488.exe
                        "C:\Users\Admin\AppData\Local\e6ea2bd6-9916-41df-b676-76287cf1d488.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:3024
                      • C:\Users\Admin\AppData\Local\8f3c5b7c-c0e0-4596-b662-145c0d0bece6.exe
                        "C:\Users\Admin\AppData\Local\8f3c5b7c-c0e0-4596-b662-145c0d0bece6.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:296
                      • C:\Users\Admin\AppData\Local\6f41454c-ac51-4758-8630-f0b938e89dd2.exe
                        "C:\Users\Admin\AppData\Local\6f41454c-ac51-4758-8630-f0b938e89dd2.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:2132
                      • C:\Users\Admin\AppData\Local\bcd37bd2-14b0-4f0f-84fa-0a96cfbde4df.exe
                        "C:\Users\Admin\AppData\Local\bcd37bd2-14b0-4f0f-84fa-0a96cfbde4df.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:1908
                      • C:\Users\Admin\AppData\Local\5b0c9871-3eac-43ca-a73a-97ad52ce87f2.exe
                        "C:\Users\Admin\AppData\Local\5b0c9871-3eac-43ca-a73a-97ad52ce87f2.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:2528
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sat0440a840bf678986a.exe
                    4⤵
                    • Loads dropped DLL
                    PID:1156
                    • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat0440a840bf678986a.exe
                      Sat0440a840bf678986a.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:1668
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im Sat0440a840bf678986a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat0440a840bf678986a.exe" & del C:\ProgramData\*.dll & exit
                        6⤵
                          PID:2212
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sat0448d9fa84aca6c1.exe
                      4⤵
                        PID:1832
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sat04582c0a08.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1468
                        • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04582c0a08.exe
                          Sat04582c0a08.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:988
                          • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04582c0a08.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04582c0a08.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3040
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sat04efd3813d34d2686.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1728
                        • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04efd3813d34d2686.exe
                          Sat04efd3813d34d2686.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:812
                          • C:\Windows\SysWOW64\control.exe
                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\1S3Y.CPl",
                            6⤵
                              PID:2400
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\1S3Y.CPl",
                                7⤵
                                  PID:2552
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Sat0413d2f09b96ff.exe
                            4⤵
                            • Loads dropped DLL
                            PID:1760
                            • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat0413d2f09b96ff.exe
                              Sat0413d2f09b96ff.exe
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies system certificate store
                              • Suspicious use of AdjustPrivilegeToken
                              PID:952
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im chrome.exe
                                6⤵
                                  PID:2680
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    7⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2724
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat04091e9a4f.exe
                              4⤵
                              • Loads dropped DLL
                              PID:616
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04091e9a4f.exe
                                Sat04091e9a4f.exe
                                5⤵
                                • Executes dropped EXE
                                PID:1580
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat04cf04f0504c7.exe
                              4⤵
                              • Loads dropped DLL
                              PID:1924
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04cf04f0504c7.exe
                                Sat04cf04f0504c7.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:296
                                • C:\Users\Admin\AppData\Local\Temp\is-UM2GP.tmp\Sat04cf04f0504c7.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-UM2GP.tmp\Sat04cf04f0504c7.tmp" /SL5="$C0150,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04cf04f0504c7.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:1744
                                  • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04cf04f0504c7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04cf04f0504c7.exe" /SILENT
                                    7⤵
                                    • Executes dropped EXE
                                    PID:2052
                                    • C:\Users\Admin\AppData\Local\Temp\is-3OU4M.tmp\Sat04cf04f0504c7.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-3OU4M.tmp\Sat04cf04f0504c7.tmp" /SL5="$D0150,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04cf04f0504c7.exe" /SILENT
                                      8⤵
                                      • Executes dropped EXE
                                      PID:2176
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat04951cf2a61625.exe
                              4⤵
                              • Loads dropped DLL
                              PID:1332
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04951cf2a61625.exe
                                Sat04951cf2a61625.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:948
                                • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04951cf2a61625.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04951cf2a61625.exe" -u
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1740
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat047cc0debc59.exe
                              4⤵
                              • Loads dropped DLL
                              PID:1880
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat047cc0debc59.exe
                                Sat047cc0debc59.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2044
                                • C:\Users\Admin\AppData\Local\Temp\is-MKID2.tmp\Sat047cc0debc59.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-MKID2.tmp\Sat047cc0debc59.tmp" /SL5="$20158,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat047cc0debc59.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:1184
                                  • C:\Users\Admin\AppData\Local\Temp\is-DGESB.tmp\Tougay.exe
                                    "C:\Users\Admin\AppData\Local\Temp\is-DGESB.tmp\Tougay.exe" /S /UID=91
                                    7⤵
                                    • Executes dropped EXE
                                    PID:2380
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat049b33b1be29125.exe
                              4⤵
                              • Loads dropped DLL
                              PID:888
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat049b33b1be29125.exe
                                Sat049b33b1be29125.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Loads dropped DLL
                                PID:1588
                                • C:\Users\Admin\Pictures\Adobe Films\qtoymJEFscwqYcQv2k1R0_YS.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\qtoymJEFscwqYcQv2k1R0_YS.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2112
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 764
                                  6⤵
                                  • Program crash
                                  PID:588
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat04d99657076.exe
                              4⤵
                              • Loads dropped DLL
                              PID:1264
                              • C:\Users\Admin\AppData\Local\Temp\7zS48361276\Sat04d99657076.exe
                                Sat04d99657076.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:304
                      • C:\Windows\system32\rundll32.exe
                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                        1⤵
                        • Process spawned unexpected child process
                        PID:2836
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                          2⤵
                            PID:2896
                        • C:\Users\Admin\AppData\Local\Temp\60B6.exe
                          C:\Users\Admin\AppData\Local\Temp\60B6.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2436

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • memory/296-210-0x0000000000400000-0x00000000004CC000-memory.dmp

                                Filesize

                                816KB

                              • memory/304-224-0x0000000000400000-0x00000000004CC000-memory.dmp

                                Filesize

                                816KB

                              • memory/304-220-0x00000000005F0000-0x0000000000600000-memory.dmp

                                Filesize

                                64KB

                              • memory/304-223-0x0000000000250000-0x0000000000259000-memory.dmp

                                Filesize

                                36KB

                              • memory/652-213-0x0000000000400000-0x0000000000450000-memory.dmp

                                Filesize

                                320KB

                              • memory/652-204-0x0000000000400000-0x0000000000450000-memory.dmp

                                Filesize

                                320KB

                              • memory/652-212-0x0000000000400000-0x0000000000450000-memory.dmp

                                Filesize

                                320KB

                              • memory/652-206-0x0000000000400000-0x0000000000450000-memory.dmp

                                Filesize

                                320KB

                              • memory/676-265-0x0000000001EE0000-0x0000000002B2A000-memory.dmp

                                Filesize

                                12.3MB

                              • memory/736-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

                                Filesize

                                8KB

                              • memory/988-238-0x00000000011C0000-0x00000000011C1000-memory.dmp

                                Filesize

                                4KB

                              • memory/988-259-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/988-255-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                Filesize

                                4KB

                              • memory/1184-229-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1400-242-0x0000000002A50000-0x0000000002A66000-memory.dmp

                                Filesize

                                88KB

                              • memory/1472-266-0x0000000001FC0000-0x0000000002C0A000-memory.dmp

                                Filesize

                                12.3MB

                              • memory/1472-269-0x0000000001FC0000-0x0000000002C0A000-memory.dmp

                                Filesize

                                12.3MB

                              • memory/1588-249-0x0000000003C20000-0x0000000003D6E000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/1592-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1592-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1592-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                              • memory/1592-96-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                              • memory/1592-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                              • memory/1592-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                              • memory/1592-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                              • memory/1592-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1592-89-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                              • memory/1592-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1592-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                              • memory/1592-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1592-91-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                              • memory/1592-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                              • memory/1592-93-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                              • memory/1668-219-0x0000000000280000-0x00000000002FD000-memory.dmp

                                Filesize

                                500KB

                              • memory/1668-221-0x0000000000850000-0x0000000000929000-memory.dmp

                                Filesize

                                868KB

                              • memory/1668-222-0x0000000000400000-0x0000000000539000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1744-218-0x0000000000260000-0x0000000000261000-memory.dmp

                                Filesize

                                4KB

                              • memory/1820-262-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1820-237-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1908-297-0x0000000000290000-0x00000000002D5000-memory.dmp

                                Filesize

                                276KB

                              • memory/2044-208-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                              • memory/2052-230-0x0000000000400000-0x00000000004CC000-memory.dmp

                                Filesize

                                816KB

                              • memory/2132-290-0x0000000000210000-0x0000000000255000-memory.dmp

                                Filesize

                                276KB

                              • memory/2176-236-0x0000000000270000-0x0000000000271000-memory.dmp

                                Filesize

                                4KB

                              • memory/2380-270-0x00000000020E0000-0x00000000020E2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2552-267-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2560-268-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/3024-296-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/3040-298-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                                Filesize

                                4KB