Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2022 15:00

General

  • Target

    4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe

  • Size

    1.4MB

  • MD5

    47d64846e17e347e63fc491f63108ea6

  • SHA1

    dda5e7983996bca729c986bd3210def22543ca34

  • SHA256

    4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682

  • SHA512

    5ed0ac753d3d74c7db5d800ed098ec756a0685bbd69e204238af8d7eae835601b36b65d0e0c028de9acb1919eaf32165e4d85536bc93285d8b03d4cc1ce18e05

Malware Config

Extracted

Family

lokibot

C2

http://hydeoutent.com/app/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Detect XtremeRAT payload 10 IoCs
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Executes dropped EXE 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe
    "C:\Users\Admin\AppData\Local\Temp\4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Program Files\Java\jre7\bin\javaw.exe
        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\urrr.jar"
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Program Files\Java\jre7\bin\java.exe
          "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.90163692890128211891321197851417413.class
          4⤵
            PID:612
          • C:\Windows\system32\cmd.exe
            cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5332709884116655531.vbs
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1908
            • C:\Windows\system32\cscript.exe
              cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5332709884116655531.vbs
              5⤵
                PID:1472
            • C:\Windows\system32\cmd.exe
              cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7128116065096301877.vbs
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:744
              • C:\Windows\system32\cscript.exe
                cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7128116065096301877.vbs
                5⤵
                  PID:1796
              • C:\Windows\system32\xcopy.exe
                xcopy "C:\Program Files\Java\jre7" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
                4⤵
                  PID:804
                • C:\Windows\system32\cmd.exe
                  cmd.exe
                  4⤵
                    PID:1644
                  • C:\Windows\system32\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ZuOyObyrhCc /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\LJLJefisaYW\WrkAsvOHItM.PPYZfa\"" /f
                    4⤵
                    • Modifies registry key
                    PID:820
                  • C:\Windows\system32\attrib.exe
                    attrib +h "C:\Users\Admin\LJLJefisaYW\*.*"
                    4⤵
                    • Views/modifies file attributes
                    PID:1068
                • C:\Users\Admin\AppData\Local\Temp\server.exe
                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                  3⤵
                  • Executes dropped EXE
                  • Modifies Installed Components in the registry
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:2040
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    4⤵
                    • Modifies Installed Components in the registry
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:1468
                    • C:\Windows\InstallDir\Server.exe
                      "C:\Windows\InstallDir\Server.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:516
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    4⤵
                      PID:960
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer.exe
                      4⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:980
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe"
                      4⤵
                        PID:868
                      • C:\Windows\SysWOW64\explorer.exe
                        explorer.exe
                        4⤵
                          PID:328
                        • C:\Users\Admin\AppData\Local\Temp\588build.exe
                          "C:\Users\Admin\AppData\Local\Temp\588build.exe"
                          4⤵
                          • Executes dropped EXE
                          • Accesses Microsoft Outlook profiles
                          • Suspicious use of AdjustPrivilegeToken
                          • outlook_office_path
                          • outlook_win_path
                          PID:1140

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\588build.exe

                    Filesize

                    104KB

                    MD5

                    450b44d6aa351b7130ac861ad2f4307a

                    SHA1

                    ad56d2aeac25123e00e145c88777eba899c49350

                    SHA256

                    de38f67877646c941a41228b0f859490a8f0e2266b97655fd8b23f541748f048

                    SHA512

                    2aeca252df0ec86550dfcbfde223da8c6774845ce452c97cc5952b78acb0d33a9fee86c3c73d8da9a487f6b3f97bb5a64dc6a656637a4d8b4e1716193a277d05

                  • C:\Users\Admin\AppData\Local\Temp\588build.exe

                    Filesize

                    104KB

                    MD5

                    450b44d6aa351b7130ac861ad2f4307a

                    SHA1

                    ad56d2aeac25123e00e145c88777eba899c49350

                    SHA256

                    de38f67877646c941a41228b0f859490a8f0e2266b97655fd8b23f541748f048

                    SHA512

                    2aeca252df0ec86550dfcbfde223da8c6774845ce452c97cc5952b78acb0d33a9fee86c3c73d8da9a487f6b3f97bb5a64dc6a656637a4d8b4e1716193a277d05

                  • C:\Users\Admin\AppData\Local\Temp\Retrive5332709884116655531.vbs

                    Filesize

                    276B

                    MD5

                    3bdfd33017806b85949b6faa7d4b98e4

                    SHA1

                    f92844fee69ef98db6e68931adfaa9a0a0f8ce66

                    SHA256

                    9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

                    SHA512

                    ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

                  • C:\Users\Admin\AppData\Local\Temp\Retrive7128116065096301877.vbs

                    Filesize

                    281B

                    MD5

                    a32c109297ed1ca155598cd295c26611

                    SHA1

                    dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

                    SHA256

                    45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

                    SHA512

                    70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

                  • C:\Users\Admin\AppData\Local\Temp\_0.90163692890128211891321197851417413.class

                    Filesize

                    241KB

                    MD5

                    781fb531354d6f291f1ccab48da6d39f

                    SHA1

                    9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

                    SHA256

                    97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

                    SHA512

                    3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

                  • C:\Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • C:\Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • C:\Users\Admin\AppData\Local\Temp\svhost.exe

                    Filesize

                    1.6MB

                    MD5

                    32827e69b293b99013bbbe37d029245d

                    SHA1

                    bc9f80a38f09354d71467a05b0c5a82c3f7dac53

                    SHA256

                    9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

                    SHA512

                    58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

                  • C:\Users\Admin\AppData\Local\Temp\urrr.jar

                    Filesize

                    479KB

                    MD5

                    e1128375e19a59c8e97a995896e7ee0d

                    SHA1

                    4662da97a36719b809cf895f0341a0bf555b828a

                    SHA256

                    b69074afb336a84f5892f38160e55e8d3dc86cd466609a9be9b5f82c23ac3eb4

                    SHA512

                    9d279f1bac882d04e60a01fa50c9a0db63b1bbb60260bfe50da4b777086374b7f3fb90817b7069443df6719da39a04e7ea19d84bd8045eeedb7a0da50486ca56

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3440072777-2118400376-1759599358-1000\83aa4cc77f591dfc2374580bbd95f6ba_7c53fe69-5b94-496b-96b7-9f57c3c2be05

                    Filesize

                    45B

                    MD5

                    c8366ae350e7019aefc9d1e6e6a498c6

                    SHA1

                    5731d8a3e6568a5f2dfbbc87e3db9637df280b61

                    SHA256

                    11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

                    SHA512

                    33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\9TRQz7hWX.cfg

                    Filesize

                    6KB

                    MD5

                    74b4fbc62fb04a0daf361724d2f5e75b

                    SHA1

                    9c21940f22b053b4bcb2702cd5699930641e87e8

                    SHA256

                    7ed7cfb3ad6a3328ce073dac7342f12d7d22e71e055443b5f329af1064a7f232

                    SHA512

                    e6cb003cb5830b7066d1a319da842b0ee540f3bafe98bb9732da14bf5d046a7019552dd625b64d6b1820fb7c0eee5ed095be40c31df2871cca12139ae5ed44c7

                  • C:\Windows\InstallDir\Server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • C:\Windows\InstallDir\Server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Users\Admin\AppData\Local\Temp\588build.exe

                    Filesize

                    104KB

                    MD5

                    450b44d6aa351b7130ac861ad2f4307a

                    SHA1

                    ad56d2aeac25123e00e145c88777eba899c49350

                    SHA256

                    de38f67877646c941a41228b0f859490a8f0e2266b97655fd8b23f541748f048

                    SHA512

                    2aeca252df0ec86550dfcbfde223da8c6774845ce452c97cc5952b78acb0d33a9fee86c3c73d8da9a487f6b3f97bb5a64dc6a656637a4d8b4e1716193a277d05

                  • \Users\Admin\AppData\Local\Temp\588build.exe

                    Filesize

                    104KB

                    MD5

                    450b44d6aa351b7130ac861ad2f4307a

                    SHA1

                    ad56d2aeac25123e00e145c88777eba899c49350

                    SHA256

                    de38f67877646c941a41228b0f859490a8f0e2266b97655fd8b23f541748f048

                    SHA512

                    2aeca252df0ec86550dfcbfde223da8c6774845ce452c97cc5952b78acb0d33a9fee86c3c73d8da9a487f6b3f97bb5a64dc6a656637a4d8b4e1716193a277d05

                  • \Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Users\Admin\AppData\Local\Temp\server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Users\Admin\AppData\Local\Temp\svhost.exe

                    Filesize

                    1.6MB

                    MD5

                    32827e69b293b99013bbbe37d029245d

                    SHA1

                    bc9f80a38f09354d71467a05b0c5a82c3f7dac53

                    SHA256

                    9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

                    SHA512

                    58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

                  • \Windows\InstallDir\Server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • \Windows\InstallDir\Server.exe

                    Filesize

                    144KB

                    MD5

                    0d0e93abe80ecb43e6381cb49c8875da

                    SHA1

                    aad791b969960e6bb9c25b278df789e0acbaa624

                    SHA256

                    c641cd7cf5e386b44b55c527cd324cc631471fc2f91bb98fca7f468f4f9197a8

                    SHA512

                    6456c240cdc3cc9b4379d41ab862743607e420cd03ec1b3a8fad7712f54fef08b23d7fdc386b76a3437e847529a2231194faf453ce2ce78817dc3921379d30d9

                  • memory/328-130-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/328-117-0x0000000000000000-mapping.dmp

                  • memory/516-141-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/516-136-0x0000000000000000-mapping.dmp

                  • memory/612-118-0x0000000002050000-0x0000000005050000-memory.dmp

                    Filesize

                    48.0MB

                  • memory/612-147-0x0000000002050000-0x0000000005050000-memory.dmp

                    Filesize

                    48.0MB

                  • memory/612-97-0x0000000000000000-mapping.dmp

                  • memory/744-144-0x0000000000000000-mapping.dmp

                  • memory/804-150-0x0000000000000000-mapping.dmp

                  • memory/816-68-0x0000000000000000-mapping.dmp

                  • memory/816-69-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

                    Filesize

                    8KB

                  • memory/816-145-0x00000000021A0000-0x00000000051A0000-memory.dmp

                    Filesize

                    48.0MB

                  • memory/816-90-0x00000000021A0000-0x00000000051A0000-memory.dmp

                    Filesize

                    48.0MB

                  • memory/820-152-0x0000000000000000-mapping.dmp

                  • memory/980-109-0x0000000074901000-0x0000000074903000-memory.dmp

                    Filesize

                    8KB

                  • memory/980-104-0x0000000000000000-mapping.dmp

                  • memory/980-121-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/1108-87-0x00000000744C0000-0x0000000074A6B000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/1108-55-0x00000000744C0000-0x0000000074A6B000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/1108-54-0x00000000762A1000-0x00000000762A3000-memory.dmp

                    Filesize

                    8KB

                  • memory/1140-125-0x0000000000000000-mapping.dmp

                  • memory/1468-108-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/1468-140-0x0000000000C30000-0x0000000000C68000-memory.dmp

                    Filesize

                    224KB

                  • memory/1468-92-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/1468-94-0x0000000000000000-mapping.dmp

                  • memory/1472-58-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-77-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-61-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-67-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-142-0x0000000000000000-mapping.dmp

                  • memory/1472-65-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-62-0x00000000004013C1-mapping.dmp

                  • memory/1472-59-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1472-57-0x0000000000400000-0x00000000004A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/1644-151-0x0000000000000000-mapping.dmp

                  • memory/1796-146-0x0000000000000000-mapping.dmp

                  • memory/1908-133-0x0000000000000000-mapping.dmp

                  • memory/2040-75-0x0000000000000000-mapping.dmp

                  • memory/2040-129-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB

                  • memory/2040-91-0x0000000000C80000-0x0000000000CB8000-memory.dmp

                    Filesize

                    224KB