Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-05-2022 14:01

General

  • Target

    05434e326da912f5c6e1bb50a767d6dd16b27ff407b007cafd7d96d0daac1eea.exe

  • Size

    304KB

  • MD5

    1044868882af2d4362480dcf0c918c3b

  • SHA1

    277439cf62cdfedb2bdd03eeb04868b812556aa2

  • SHA256

    05434e326da912f5c6e1bb50a767d6dd16b27ff407b007cafd7d96d0daac1eea

  • SHA512

    d504e11382f7d84a593e73826489ba56b706e59ab75ac559e35ddacfca6f1e187729adf1c0349ff4c5414200effe2d2b9368b43afef25062cd8d86c1e1c73155

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

1

C2

45.10.43.167:26696

Attributes
  • auth_value

    3a70a3e2f548aaf61e05be9e4cadc7c1

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Executes dropped EXE 6 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05434e326da912f5c6e1bb50a767d6dd16b27ff407b007cafd7d96d0daac1eea.exe
    "C:\Users\Admin\AppData\Local\Temp\05434e326da912f5c6e1bb50a767d6dd16b27ff407b007cafd7d96d0daac1eea.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1920
  • C:\Users\Admin\AppData\Local\Temp\8666.exe
    C:\Users\Admin\AppData\Local\Temp\8666.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Windows\system32\mode.com
        mode 65,10
        3⤵
          PID:4916
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e file.zip -p283462270827100258722140325330 -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4928
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_3.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2148
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_2.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1736
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_1.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4960
        • C:\Windows\system32\attrib.exe
          attrib +H "benbenben.exe"
          3⤵
          • Views/modifies file attributes
          PID:5036
        • C:\Users\Admin\AppData\Local\Temp\main\benbenben.exe
          "benbenben.exe"
          3⤵
          • Executes dropped EXE
          • Checks BIOS information in registry
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:3580
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:4708

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Hidden Files and Directories

      1
      T1158

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Hidden Files and Directories

      1
      T1158

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      4
      T1012

      Virtualization/Sandbox Evasion

      1
      T1497

      System Information Discovery

      4
      T1082

      Peripheral Device Discovery

      1
      T1120

      Collection

      Data from Local System

      2
      T1005

      Email Collection

      1
      T1114

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\8666.exe
        Filesize

        3.9MB

        MD5

        4f8a7c030aa8784e5f9726de742be5b5

        SHA1

        b458828a0383defa2b1c79dc043d7e7e8cc712c4

        SHA256

        b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

        SHA512

        0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

      • C:\Users\Admin\AppData\Local\Temp\8666.exe
        Filesize

        3.9MB

        MD5

        4f8a7c030aa8784e5f9726de742be5b5

        SHA1

        b458828a0383defa2b1c79dc043d7e7e8cc712c4

        SHA256

        b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

        SHA512

        0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\benbenben.exe
        Filesize

        1.5MB

        MD5

        4c76c4bb8969621583baa58bf9c625f4

        SHA1

        46fcb2f437241d330144ae3b9ec2980f9b12c209

        SHA256

        e78a454a7fcf939c27d8beec97b8b77f851df342e2682143c9d2dc66fcab4340

        SHA512

        5c52696822d339b0c9f53de3db0fabdf8c7158b6d00b42c59f78694b282243cf6f92066203c60cfcbf363b3684eba3ff10bdcd851557c05a46bfa38d0c856e0c

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
        Filesize

        2.0MB

        MD5

        8f6c27385ab490689ddcc61866824ce8

        SHA1

        5b1874737e5cd1b1c52b7b8e10714d2c6e87d96d

        SHA256

        d47d174fa9feac7cd178bd9a62d0f9183651c043f6f3c8d15bb7197fc1fc042f

        SHA512

        046371e4c93c89ea54fceacd9b5f69e842f84debc00e668509d4b853e53621395cb4ac713093ff81368f9ad717f4621565a906a999d8dbfa3c0fad0278909c1f

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\benbenben.exe
        Filesize

        1.5MB

        MD5

        4c76c4bb8969621583baa58bf9c625f4

        SHA1

        46fcb2f437241d330144ae3b9ec2980f9b12c209

        SHA256

        e78a454a7fcf939c27d8beec97b8b77f851df342e2682143c9d2dc66fcab4340

        SHA512

        5c52696822d339b0c9f53de3db0fabdf8c7158b6d00b42c59f78694b282243cf6f92066203c60cfcbf363b3684eba3ff10bdcd851557c05a46bfa38d0c856e0c

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
        Filesize

        1.5MB

        MD5

        a73635e84d7ab318619454487514f446

        SHA1

        b492af29c93240c3479e69907f1ed74dec625ba6

        SHA256

        ed19a2d5f65d95969d697f205d3fa91688c6daac6274ac7e4847789c9b3a4061

        SHA512

        e8a0b92b3da67a60db0a9c65d7eb0bcd88d97ab1e72510eb602c1e0385b776c7834d08ff8618b805f805e457b21265884d71bdf9fafe6ca3da583ccd162b9f06

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
        Filesize

        1.5MB

        MD5

        620139174d311818701c05cbc8968c59

        SHA1

        7a427bf6653da862963e42c4f4a5a1ebd08ec061

        SHA256

        df5e8ab12f09d0dc41e2a7c7e5043d6477a7dc6d9a4bbae0943bbbbcfbdc6b2a

        SHA512

        21ebcfde72f38cc7d5feafe9168cb37e8b62c6fbf6a8c046fcba9cc9b6f079f5d4cc7dbf2b9d42e48fc4ff2909439a8cbff22c872b8453a944d0ad552792c37e

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
        Filesize

        3.0MB

        MD5

        1a18731f1f1b9e3746a31b9bf7d6b901

        SHA1

        48cd2531251dff411b084dbb88c7fe6a73c437f8

        SHA256

        149b8af8eb2eba7d584bbc72083fd26b0cbc678f75739fce532bd80cc6548cd7

        SHA512

        4d298d564e4791f9404edafacd4d8ff2b70fb93152ca4e33a48fdd07f25c5d3b0bf616b4fe1cceb0a911093fb0ca47052a3529f115825729641b3dec1c82fafa

      • C:\Users\Admin\AppData\Local\Temp\main\file.bin
        Filesize

        3.0MB

        MD5

        03bd09b1b43203b5847bd65a390c7fe9

        SHA1

        15599a412e9d6934eaf35da04488a997ce88638f

        SHA256

        11317bad4a6346566fec9f2cefcf1d0e97a074be1f85d2f25bebf4bbc532bd9a

        SHA512

        058a97e75feb690afc35939017017b6d86725ab901c0a52473e6bb201ac38bbc20e052762f49567ba7f6cd4ea23c0dc94f42aaaae7b80644438f3e4ab0ed3118

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
        Filesize

        476B

        MD5

        21b6341d2b4fc3c54bca293b71545d0c

        SHA1

        ba66216cd3552de6b3ad254f65ccb834188347b0

        SHA256

        432347ce4e632e70cc0cb988ed72c43a17b81f8955a3905e43a93708029a0daf

        SHA512

        04842ab2240d782fe7f3336f4776576f67f3a30ae522713b2bfb8e5c86ca30a2706f2c73ede5647495b8cde06ad36b6499bf8bd9c8908e794fdbdb8bd0d534d1

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • memory/1736-287-0x0000000000000000-mapping.dmp
      • memory/1920-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-142-0x0000000000490000-0x000000000053E000-memory.dmp
        Filesize

        696KB

      • memory/1920-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-143-0x00000000001E0000-0x00000000001E9000-memory.dmp
        Filesize

        36KB

      • memory/1920-144-0x0000000000400000-0x000000000048D000-memory.dmp
        Filesize

        564KB

      • memory/1920-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-117-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-118-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-121-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-122-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-123-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-125-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-126-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-128-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-135-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-132-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/1920-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/2148-283-0x0000000000000000-mapping.dmp
      • memory/2652-154-0x0000000000570000-0x0000000000586000-memory.dmp
        Filesize

        88KB

      • memory/3580-189-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-183-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-184-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-186-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-187-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-188-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-185-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-182-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-179-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-172-0x0000000000000000-mapping.dmp
      • memory/3580-175-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3580-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-168-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-174-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-171-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-176-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-170-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-155-0x0000000000000000-mapping.dmp
      • memory/3832-169-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-167-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-165-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-163-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-162-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-159-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/3832-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
        Filesize

        1.6MB

      • memory/4676-275-0x0000000000000000-mapping.dmp
      • memory/4708-222-0x0000000000000000-mapping.dmp
      • memory/4916-277-0x0000000000000000-mapping.dmp
      • memory/4928-279-0x0000000000000000-mapping.dmp
      • memory/4960-291-0x0000000000000000-mapping.dmp
      • memory/5036-297-0x0000000000000000-mapping.dmp
      • memory/5048-361-0x00000000060F0000-0x000000000612E000-memory.dmp
        Filesize

        248KB

      • memory/5048-367-0x00000000071B0000-0x00000000076AE000-memory.dmp
        Filesize

        5.0MB

      • memory/5048-356-0x00000000066A0000-0x0000000006CA6000-memory.dmp
        Filesize

        6.0MB

      • memory/5048-357-0x0000000006090000-0x00000000060A2000-memory.dmp
        Filesize

        72KB

      • memory/5048-358-0x00000000061C0000-0x00000000062CA000-memory.dmp
        Filesize

        1.0MB

      • memory/5048-298-0x0000000000000000-mapping.dmp
      • memory/5048-363-0x0000000006130000-0x000000000617B000-memory.dmp
        Filesize

        300KB

      • memory/5048-341-0x0000000001170000-0x0000000001692000-memory.dmp
        Filesize

        5.1MB

      • memory/5048-368-0x0000000006480000-0x00000000064F6000-memory.dmp
        Filesize

        472KB

      • memory/5048-369-0x00000000065A0000-0x0000000006632000-memory.dmp
        Filesize

        584KB

      • memory/5048-373-0x0000000006570000-0x000000000658E000-memory.dmp
        Filesize

        120KB

      • memory/5048-375-0x0000000007090000-0x00000000070F6000-memory.dmp
        Filesize

        408KB

      • memory/5048-383-0x00000000079B0000-0x0000000007A00000-memory.dmp
        Filesize

        320KB

      • memory/5048-384-0x0000000007BD0000-0x0000000007D92000-memory.dmp
        Filesize

        1.8MB

      • memory/5048-385-0x00000000082D0000-0x00000000087FC000-memory.dmp
        Filesize

        5.2MB