Resubmissions

10-11-2024 00:36

241110-ax68jawbmc 10

10-11-2024 00:35

241110-axpngswblf 10

08-11-2024 23:50

241108-3vx63asflm 10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 00:35

General

  • Target

    3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534.exe

  • Size

    3.7MB

  • MD5

    4d24aa49afc8352934aa94f11bc74b4f

  • SHA1

    f0ca806a70fc5ce42c1803a549ee624559effbf0

  • SHA256

    3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534

  • SHA512

    8004d80d858c10dccbb3b4ff33f8bb7ef4747dc9ad0b4bcde213da0adf65c9116753d70b4b72fd6b806cbe3b5f5f2b78fdda9ef64444c80d148329e075afe02b

  • SSDEEP

    98304:xJZV4CCzTZ1Z9MLewPmwqHJdmCvLUBsK3lq:xXVBCvZ1DMLhuwqDPLUCK30

Malware Config

Extracted

Family

nullmixer

C2

http://razino.xyz/

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

redline

Botnet

Ani

C2

detuyaluro.xyz:80

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • Fabookie family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • Nullmixer family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Sectoprat family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Vidar Stealer 1 IoCs
  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534.exe
    "C:\Users\Admin\AppData\Local\Temp\3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_1.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1864
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_1.exe
          sahiba_1.exe
          4⤵
          • Executes dropped EXE
          PID:464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_2.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_2.exe
          sahiba_2.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2176
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 264
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2152
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_3.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2396
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_3.exe
          sahiba_3.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:1052
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 948
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_4.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_4.exe
          sahiba_4.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2136
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2044
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2712
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_5.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1868
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_5.exe
          sahiba_5.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2620
          • C:\Users\Admin\AppData\Local\Temp\is-L0PAK.tmp\sahiba_5.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-L0PAK.tmp\sahiba_5.tmp" /SL5="$6015A,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_5.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_6.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2956
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_6.exe
          sahiba_6.exe
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1856
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_7.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2968
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_7.exe
          sahiba_7.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1268
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_8.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2992
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_8.exe
          sahiba_8.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2016
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sahiba_9.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1660
        • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_9.exe
          sahiba_9.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1924
          • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_9.exe
            C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_9.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 424
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\libcurl.dll

    Filesize

    218KB

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\libgcc_s_dw2-1.dll

    Filesize

    113KB

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\libstdc++-6.dll

    Filesize

    647KB

    MD5

    5e279950775baae5fea04d2cc4526bcc

    SHA1

    8aef1e10031c3629512c43dd8b0b5d9060878453

    SHA256

    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

    SHA512

    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\libwinpthread-1.dll

    Filesize

    69KB

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_1.txt

    Filesize

    611KB

    MD5

    151ac4868889bf34489fec00289e2b68

    SHA1

    2e7b27cf334c64b0b28c5ca5742b4d920fa0434b

    SHA256

    0c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0

    SHA512

    e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_3.txt

    Filesize

    585KB

    MD5

    a03ba209264db1a2c71322ea8df81835

    SHA1

    c2341c4638d1edf0b33f5a03273f9e2c8b3d7907

    SHA256

    4335641569c179d487673b810ca8301562ae4325b9ffaeaebf0367113243a6af

    SHA512

    237f7d5f6e924e4be10f4ee4c96e9711bde4ee407872d1805f1bd4721f9a25e14bf20b4cf4ea2d22618ee0f3ed84e54afb654a049922828f5c8e1c6ca3cfa988

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_5.txt

    Filesize

    757KB

    MD5

    8c4df9d37195987ede03bf8adb495686

    SHA1

    010626025ca791720f85984a842c893b78f439d2

    SHA256

    5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

    SHA512

    8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_6.txt

    Filesize

    151KB

    MD5

    dae14fe61d968fb25b83887171b84238

    SHA1

    67c256d1c51b6dba818d9a556c9ef374241a4450

    SHA256

    e47c276aa5227157fb2eddf4a8451d75ab0573d19c79a2f99c29c42509b366a1

    SHA512

    4144f72c2e9cbc3eab0e7ad77f1dd167c56c21ed00740404bcba34caa7e17a832f30243601d456e5a7e1472aed8b15f939ad3fc3b635c6ea810bba1726edc155

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_7.txt

    Filesize

    804KB

    MD5

    a73c42ca8cdc50ffefdd313e2ba4d423

    SHA1

    7fcc3b60e169fe3c64935de7e431654f570d9dd2

    SHA256

    c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

    SHA512

    2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_8.txt

    Filesize

    318KB

    MD5

    75ab1409c95fe3c7cccc0bd6c6043397

    SHA1

    6ac9fd227696db5e9b1b98cbdaa5fe224dbea8a5

    SHA256

    b7bca02f33d2954f4f29203a77c2746f193116630bfbce316666a81c9a04f1ab

    SHA512

    78b1ca13f02bac57eb36a831178f647bb41f0223aaddd9f78ca9500b959d336ad9e838361c1fef67507f2adcf74a68b4fa31e36ca360e31ded8d8a8efe0c31f7

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_9.txt

    Filesize

    397KB

    MD5

    3e2c8ab8ed50cf8e9a4fe433965e8f60

    SHA1

    d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520

    SHA256

    b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6

    SHA512

    eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4

  • C:\Users\Admin\AppData\Local\Temp\7zSCDBAE056\setup_install.exe

    Filesize

    287KB

    MD5

    8b241eb4c18e7d35685bd62185490d75

    SHA1

    38522ba7dc5b1822203c296f24742a574115c5b9

    SHA256

    c58202010548d30e9d7134babdf57cefd8d7befaad7438f694dd8204da1b89b8

    SHA512

    f57879c12dad0311cecfe0d1c6303b5f8aaef9bbb89426d7c44a455f8ddbb3dbbe030ce867c91071d7c99dfd65e69f72d1a36fd78430556a2d79259de48d5388

  • C:\Users\Admin\AppData\Local\Temp\Cab8FA4.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8FD6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

    Filesize

    184KB

    MD5

    7fee8223d6e4f82d6cd115a28f0b6d58

    SHA1

    1b89c25f25253df23426bd9ff6c9208f1202f58b

    SHA256

    a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

    SHA512

    3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

    Filesize

    61KB

    MD5

    a6279ec92ff948760ce53bba817d6a77

    SHA1

    5345505e12f9e4c6d569a226d50e71b5a572dce2

    SHA256

    8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

    SHA512

    213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

  • \Users\Admin\AppData\Local\Temp\7zSCDBAE056\libcurlpp.dll

    Filesize

    54KB

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • \Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_2.exe

    Filesize

    220KB

    MD5

    0b722fdf5af17af0a942c927db8145b4

    SHA1

    95b11ae52972c1314f18c43f3e079f09155c1ec5

    SHA256

    0a99f1c738387f482cd9c37b490a44290ee823a50f332296ef8618514580d7a8

    SHA512

    0bb6fcb85130fede076268eeaa0b48be1dbaa14e93dfcbe90768ca651f49c84446210e2670bae771234998469ef944eaa6c29d52cc9edf58422327ca76e2b5ff

  • \Users\Admin\AppData\Local\Temp\7zSCDBAE056\sahiba_4.exe

    Filesize

    972KB

    MD5

    5668cb771643274ba2c375ec6403c266

    SHA1

    dd78b03428b99368906fe62fc46aaaf1db07a8b9

    SHA256

    d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

    SHA512

    135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

  • \Users\Admin\AppData\Local\Temp\is-L0PAK.tmp\sahiba_5.tmp

    Filesize

    1.0MB

    MD5

    ace50bc58251a21ff708c2a45b166905

    SHA1

    3acac0fbed800fe76722b781b7add2cbb7510849

    SHA256

    af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

    SHA512

    b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

  • memory/1052-271-0x0000000000400000-0x0000000002CE9000-memory.dmp

    Filesize

    40.9MB

  • memory/1796-151-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/1856-147-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/1856-129-0x0000000000D40000-0x0000000000D6C000-memory.dmp

    Filesize

    176KB

  • memory/1856-140-0x00000000002D0000-0x00000000002D6000-memory.dmp

    Filesize

    24KB

  • memory/1856-145-0x00000000002E0000-0x0000000000302000-memory.dmp

    Filesize

    136KB

  • memory/1924-139-0x0000000000090000-0x00000000000F6000-memory.dmp

    Filesize

    408KB

  • memory/1924-293-0x00000000005A0000-0x00000000005AE000-memory.dmp

    Filesize

    56KB

  • memory/2016-141-0x00000000030F0000-0x0000000003110000-memory.dmp

    Filesize

    128KB

  • memory/2016-279-0x0000000000400000-0x0000000002CA6000-memory.dmp

    Filesize

    40.6MB

  • memory/2016-146-0x0000000004660000-0x000000000467E000-memory.dmp

    Filesize

    120KB

  • memory/2044-218-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2044-215-0x0000000000240000-0x000000000029B000-memory.dmp

    Filesize

    364KB

  • memory/2044-214-0x0000000000240000-0x000000000029B000-memory.dmp

    Filesize

    364KB

  • memory/2136-266-0x00000000004D0000-0x000000000052B000-memory.dmp

    Filesize

    364KB

  • memory/2136-292-0x00000000004D0000-0x00000000004F2000-memory.dmp

    Filesize

    136KB

  • memory/2136-291-0x00000000004D0000-0x00000000004F2000-memory.dmp

    Filesize

    136KB

  • memory/2136-262-0x00000000004D0000-0x00000000004F2000-memory.dmp

    Filesize

    136KB

  • memory/2136-267-0x00000000004D0000-0x00000000004F2000-memory.dmp

    Filesize

    136KB

  • memory/2136-261-0x00000000004D0000-0x000000000052B000-memory.dmp

    Filesize

    364KB

  • memory/2136-213-0x00000000004D0000-0x000000000052B000-memory.dmp

    Filesize

    364KB

  • memory/2136-208-0x00000000004D0000-0x000000000052B000-memory.dmp

    Filesize

    364KB

  • memory/2176-278-0x0000000000400000-0x0000000002C8D000-memory.dmp

    Filesize

    40.6MB

  • memory/2620-152-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2620-114-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2692-258-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-287-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-70-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2692-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2692-49-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2692-65-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2692-43-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-71-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2692-72-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-73-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-212-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2692-253-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-257-0x000000006EB40000-0x000000006EB63000-memory.dmp

    Filesize

    140KB

  • memory/2692-256-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2692-255-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2692-76-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-64-0x0000000064941000-0x000000006494F000-memory.dmp

    Filesize

    56KB

  • memory/2692-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-74-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-75-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-62-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2692-77-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2692-61-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2692-284-0x000000006EB40000-0x000000006EB63000-memory.dmp

    Filesize

    140KB

  • memory/2692-286-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2692-289-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2692-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2692-288-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2692-63-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2712-277-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/2712-268-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/2712-269-0x0000000000240000-0x0000000000262000-memory.dmp

    Filesize

    136KB

  • memory/2712-270-0x0000000000240000-0x0000000000262000-memory.dmp

    Filesize

    136KB

  • memory/2980-294-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2980-296-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2980-295-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3036-41-0x0000000003530000-0x000000000364E000-memory.dmp

    Filesize

    1.1MB

  • memory/3036-40-0x0000000003530000-0x000000000364E000-memory.dmp

    Filesize

    1.1MB