Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2022, 08:45

General

  • Target

    3b59592dcd363e939110c500f86d2b2fa9e9eb53403e3f9c321eec47055ef20a.exe

  • Size

    290KB

  • MD5

    55eb02184d72de2ac95eecbb59b13e4c

  • SHA1

    7aab5d8e68baa28308eb765e27f1994d0f5796b4

  • SHA256

    3b59592dcd363e939110c500f86d2b2fa9e9eb53403e3f9c321eec47055ef20a

  • SHA512

    15a29cd782032b6533f5f19863507e763762bb0c3504fec8cc5879e5008d3872eefb90b51ff9eebf4fe2bb85133f0cc110ee63d68c65d6068a56b330c3afdff9

  • SSDEEP

    3072:Io8b6DOdeGw1voLP7yIJ8p2tijs9YFd1aUiLcI0Mv4J:I6oy3oIjDFd1aR

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Wallets

45coZygmFLnRF5NY7Uz51tadci9wak52fbbhfgKR5q5BTB9QbKMiCnXiPiiwCwyUTQeF4nZD5mdAugj8yB5hTLA9ViAFFR8

Attributes
  • payload_urls

    http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion.pet/shared/xmrig.exe

Extracted

Family

redline

Botnet

installs-49

C2

94.140.112.157:29329

Attributes
  • auth_value

    f137ab12b29192785aff1f9a524f0090

Signatures

  • Detects Smokeloader packer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b59592dcd363e939110c500f86d2b2fa9e9eb53403e3f9c321eec47055ef20a.exe
    "C:\Users\Admin\AppData\Local\Temp\3b59592dcd363e939110c500f86d2b2fa9e9eb53403e3f9c321eec47055ef20a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3068
  • C:\Users\Admin\AppData\Local\Temp\6542.exe
    C:\Users\Admin\AppData\Local\Temp\6542.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\Miner.exe
      "C:\Users\Admin\AppData\Local\Temp\Miner.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Miner" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Miner.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4160
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:2344
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1
            4⤵
            • Runs ping.exe
            PID:520
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Miner" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe" /rl HIGHEST /f
            4⤵
            • Creates scheduled task(s)
            PID:4020
          • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe
            "C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe"
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:344
            • C:\Users\Admin\AppData\Local\Temp\Admin_IYMUGYHL.exe
              "C:\Users\Admin\AppData\Local\Temp\Admin_IYMUGYHL.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 45coZygmFLnRF5NY7Uz51tadci9wak52fbbhfgKR5q5BTB9QbKMiCnXiPiiwCwyUTQeF4nZD5mdAugj8yB5hTLA9ViAFFR8.Admin_IYMUGYHL -p --max-cpu-usage=40 --donate-level=1
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5092
      • C:\Users\Admin\AppData\Local\Temp\installs49.exe
        "C:\Users\Admin\AppData\Local\Temp\installs49.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:884
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1256
        2⤵
        • Program crash
        PID:2592
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4868 -ip 4868
      1⤵
        PID:4612
      • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe
        C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe
        1⤵
        • Executes dropped EXE
        PID:1788
      • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe
        C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe
        1⤵
        • Executes dropped EXE
        PID:3500

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Miner.exe.log

              Filesize

              612B

              MD5

              81ab0e59097e03cb04c32378024d6628

              SHA1

              cc2a7a335f905e787906b6a0820acfbd4c5d0ed2

              SHA256

              704dd8b8fb6dfccf43fd0712e36950102151fe7232d6602c53a42af967969533

              SHA512

              3dd1374962c4d913ad6ec4207889abcca3e28946fa8937626bd2d13025a538e676bfc2efe76d27031d3f741bb3934104c0cf4e10da62758839add1fe543dfacb

            • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\ServiceHub\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\Temp\6542.exe

              Filesize

              436KB

              MD5

              f1ae38e744808d4df42eed53c896323a

              SHA1

              0d0edac38a4e1a1c073aa99fc1009230a05deb74

              SHA256

              9508f7888f8d8f0297c20762f4a372e704649a903b961dfe9ac4a5dc12bb5439

              SHA512

              b23262fd0709c2cdf2702bab85a39ffeeebc28644e268ddecf5861bef6307b3f92c50a73b5725fa1a8578033c446bd957277224a24ed7ccd806bf3d0a77376d6

            • C:\Users\Admin\AppData\Local\Temp\6542.exe

              Filesize

              436KB

              MD5

              f1ae38e744808d4df42eed53c896323a

              SHA1

              0d0edac38a4e1a1c073aa99fc1009230a05deb74

              SHA256

              9508f7888f8d8f0297c20762f4a372e704649a903b961dfe9ac4a5dc12bb5439

              SHA512

              b23262fd0709c2cdf2702bab85a39ffeeebc28644e268ddecf5861bef6307b3f92c50a73b5725fa1a8578033c446bd957277224a24ed7ccd806bf3d0a77376d6

            • C:\Users\Admin\AppData\Local\Temp\Admin_IYMUGYHL.exe

              Filesize

              4.7MB

              MD5

              84cbc72865b542c646bd89bb9430e7d1

              SHA1

              c8320b1e24f22b36c1a283506dacdcbcf5598a4f

              SHA256

              323a18d661fab8c743bb0584b4182902f49640a9ead4b9cedfb548889c25a9d4

              SHA512

              235afdba7fcf029920a20ac3d99ce0dacd87554d27a0e473ff5636c74f7f747ed9d242637d10963bac7461f789266191b37beaec0b9acdd2dc38b0f196ae65a8

            • C:\Users\Admin\AppData\Local\Temp\Admin_IYMUGYHL.exe

              Filesize

              4.7MB

              MD5

              84cbc72865b542c646bd89bb9430e7d1

              SHA1

              c8320b1e24f22b36c1a283506dacdcbcf5598a4f

              SHA256

              323a18d661fab8c743bb0584b4182902f49640a9ead4b9cedfb548889c25a9d4

              SHA512

              235afdba7fcf029920a20ac3d99ce0dacd87554d27a0e473ff5636c74f7f747ed9d242637d10963bac7461f789266191b37beaec0b9acdd2dc38b0f196ae65a8

            • C:\Users\Admin\AppData\Local\Temp\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\Temp\Miner.exe

              Filesize

              16KB

              MD5

              d1b22ce6e0f11c1b8283a85d9f902bbd

              SHA1

              8593038e651f856367d094b4541dd7cbffb8e7a3

              SHA256

              95aaf5cd2e08561391d3cc3056d8d629d7caa5ab5117bb7dbf0d7da1e3dbcdf8

              SHA512

              d212280985c97c6c9b4055783ae6839e42289a72a59c2863b93b1ce93edfd8ab16a5f802806f818360753e0e5f802392fbe0382eb7fae299e67bdec2205ad7ed

            • C:\Users\Admin\AppData\Local\Temp\installs49.exe

              Filesize

              88KB

              MD5

              24f5400ea175ed8a981c5f4184587ac4

              SHA1

              24b9e12675b4e5f389eb01d6c423e123909d02d9

              SHA256

              3be6f25cd0a2f0c367e34e6b2d300671626dcb7ce46aeb83f3396433d8da9bc4

              SHA512

              4d685f9f062359b6aae187cb88c98d55c059a316bccf6fc07aed3cbb172ee55edf84aa2fd53f67d9a5301195dddf7dc68e7e10ea2ffdf7d8a13750440f0a9669

            • C:\Users\Admin\AppData\Local\Temp\installs49.exe

              Filesize

              88KB

              MD5

              24f5400ea175ed8a981c5f4184587ac4

              SHA1

              24b9e12675b4e5f389eb01d6c423e123909d02d9

              SHA256

              3be6f25cd0a2f0c367e34e6b2d300671626dcb7ce46aeb83f3396433d8da9bc4

              SHA512

              4d685f9f062359b6aae187cb88c98d55c059a316bccf6fc07aed3cbb172ee55edf84aa2fd53f67d9a5301195dddf7dc68e7e10ea2ffdf7d8a13750440f0a9669

            • memory/884-177-0x0000000000390000-0x00000000003AC000-memory.dmp

              Filesize

              112KB

            • memory/884-179-0x0000000004C30000-0x0000000004C42000-memory.dmp

              Filesize

              72KB

            • memory/884-178-0x0000000005D40000-0x0000000006358000-memory.dmp

              Filesize

              6.1MB

            • memory/884-181-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

              Filesize

              240KB

            • memory/884-191-0x0000000005AB0000-0x0000000005B00000-memory.dmp

              Filesize

              320KB

            • memory/884-195-0x0000000006820000-0x000000000683E000-memory.dmp

              Filesize

              120KB

            • memory/884-180-0x0000000004D60000-0x0000000004E6A000-memory.dmp

              Filesize

              1.0MB

            • memory/884-189-0x0000000005B00000-0x0000000005B92000-memory.dmp

              Filesize

              584KB

            • memory/884-194-0x0000000006C30000-0x000000000715C000-memory.dmp

              Filesize

              5.2MB

            • memory/884-193-0x0000000006530000-0x00000000066F2000-memory.dmp

              Filesize

              1.8MB

            • memory/884-192-0x0000000005C20000-0x0000000005C96000-memory.dmp

              Filesize

              472KB

            • memory/1492-169-0x00000000001B0000-0x00000000001BA000-memory.dmp

              Filesize

              40KB

            • memory/1492-170-0x00000000049E0000-0x0000000004A46000-memory.dmp

              Filesize

              408KB

            • memory/2056-207-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-217-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-238-0x00000000023A0000-0x00000000023B0000-memory.dmp

              Filesize

              64KB

            • memory/2056-235-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-234-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-230-0x0000000002DF0000-0x0000000002E00000-memory.dmp

              Filesize

              64KB

            • memory/2056-158-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

              Filesize

              64KB

            • memory/2056-157-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

              Filesize

              64KB

            • memory/2056-156-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

              Filesize

              64KB

            • memory/2056-229-0x0000000002DF0000-0x0000000002E00000-memory.dmp

              Filesize

              64KB

            • memory/2056-228-0x0000000002DF0000-0x0000000002E00000-memory.dmp

              Filesize

              64KB

            • memory/2056-155-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

              Filesize

              64KB

            • memory/2056-154-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

              Filesize

              64KB

            • memory/2056-153-0x0000000002A90000-0x0000000002AA0000-memory.dmp

              Filesize

              64KB

            • memory/2056-152-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-151-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-150-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-149-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-148-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-145-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-225-0x0000000002DF0000-0x0000000002E00000-memory.dmp

              Filesize

              64KB

            • memory/2056-224-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-223-0x0000000002DF0000-0x0000000002E00000-memory.dmp

              Filesize

              64KB

            • memory/2056-146-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-147-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-144-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-143-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-142-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-141-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-140-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-139-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-138-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-137-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-136-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-222-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-221-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-220-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-219-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-218-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-201-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-202-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-203-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-205-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-204-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-206-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-209-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-208-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-211-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-213-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-215-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/2056-210-0x0000000002A80000-0x0000000002A90000-memory.dmp

              Filesize

              64KB

            • memory/3068-133-0x0000000002E00000-0x0000000002E09000-memory.dmp

              Filesize

              36KB

            • memory/3068-134-0x0000000000400000-0x0000000002B92000-memory.dmp

              Filesize

              39.6MB

            • memory/3068-135-0x0000000000400000-0x0000000002B92000-memory.dmp

              Filesize

              39.6MB

            • memory/3068-132-0x0000000002E8C000-0x0000000002E9C000-memory.dmp

              Filesize

              64KB

            • memory/4868-162-0x0000000002F1C000-0x0000000002F51000-memory.dmp

              Filesize

              212KB

            • memory/4868-183-0x0000000000400000-0x0000000002BB6000-memory.dmp

              Filesize

              39.7MB

            • memory/4868-182-0x0000000002F1C000-0x0000000002F51000-memory.dmp

              Filesize

              212KB

            • memory/4868-165-0x0000000000400000-0x0000000002BB6000-memory.dmp

              Filesize

              39.7MB

            • memory/4868-164-0x0000000007410000-0x00000000079B4000-memory.dmp

              Filesize

              5.6MB

            • memory/4868-163-0x0000000002E10000-0x0000000002E52000-memory.dmp

              Filesize

              264KB

            • memory/5092-226-0x000001EC38200000-0x000001EC38220000-memory.dmp

              Filesize

              128KB

            • memory/5092-231-0x000001EC38200000-0x000001EC38220000-memory.dmp

              Filesize

              128KB

            • memory/5092-232-0x000001EC381E0000-0x000001EC38200000-memory.dmp

              Filesize

              128KB

            • memory/5092-227-0x000001EC381E0000-0x000001EC38200000-memory.dmp

              Filesize

              128KB

            • memory/5092-199-0x000001EC368B0000-0x000001EC368D0000-memory.dmp

              Filesize

              128KB

            • memory/5092-200-0x000001EC381A0000-0x000001EC381E0000-memory.dmp

              Filesize

              256KB