Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    23-11-2021 18:40

General

  • Target

    b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8.exe

  • Size

    292KB

  • MD5

    5ea78295c4dfc582646e68bd78f6a1e1

  • SHA1

    736ef0bfd9a33aff9cf8f53b523a6f00c99c00b1

  • SHA256

    b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8

  • SHA512

    5690facb09a90827b3661b2170b27535b1151449ddc93186cc3a9798adc995da824756704411563cf5ae642201c1712916b17782b09e95d3c49ab71ee50ee515

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

redline

Botnet

Firefox

C2

194.127.179.0:42417

Extracted

Family

redline

Botnet

BADMAN2020

C2

147.124.208.247:34932

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8.exe
    "C:\Users\Admin\AppData\Local\Temp\b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Users\Admin\AppData\Local\Temp\b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8.exe
      "C:\Users\Admin\AppData\Local\Temp\b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4416
  • C:\Users\Admin\AppData\Local\Temp\4189.exe
    C:\Users\Admin\AppData\Local\Temp\4189.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\4189.exe
      C:\Users\Admin\AppData\Local\Temp\4189.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2120
  • C:\Users\Admin\AppData\Local\Temp\45FF.exe
    C:\Users\Admin\AppData\Local\Temp\45FF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yhjfbzor\
      2⤵
        PID:404
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yrcsdatm.exe" C:\Windows\SysWOW64\yhjfbzor\
        2⤵
          PID:1200
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create yhjfbzor binPath= "C:\Windows\SysWOW64\yhjfbzor\yrcsdatm.exe /d\"C:\Users\Admin\AppData\Local\Temp\45FF.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1548
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description yhjfbzor "wifi internet conection"
            2⤵
              PID:1808
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start yhjfbzor
              2⤵
                PID:2612
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:4296
              • C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4624
                • C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                  C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:320
              • C:\Windows\SysWOW64\yhjfbzor\yrcsdatm.exe
                C:\Windows\SysWOW64\yhjfbzor\yrcsdatm.exe /d"C:\Users\Admin\AppData\Local\Temp\45FF.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2864
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:3056
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                      PID:2132
                • C:\Users\Admin\AppData\Local\Temp\A97E.exe
                  C:\Users\Admin\AppData\Local\Temp\A97E.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:5032
                • C:\Users\Admin\AppData\Local\Temp\AC9B.exe
                  C:\Users\Admin\AppData\Local\Temp\AC9B.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5060
                • C:\Users\Admin\AppData\Local\Temp\B344.exe
                  C:\Users\Admin\AppData\Local\Temp\B344.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:3912
                • C:\Users\Admin\AppData\Local\Temp\BB63.exe
                  C:\Users\Admin\AppData\Local\Temp\BB63.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2908
                • C:\Users\Admin\AppData\Local\Temp\C2B7.exe
                  C:\Users\Admin\AppData\Local\Temp\C2B7.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4284

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Disabling Security Tools

                1
                T1089

                Modify Registry

                2
                T1112

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Peripheral Device Discovery

                1
                T1120

                Collection

                Data from Local System

                2
                T1005

                Command and Control

                Web Service

                1
                T1102

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4CA7.exe.log
                  MD5

                  41fbed686f5700fc29aaccf83e8ba7fd

                  SHA1

                  5271bc29538f11e42a3b600c8dc727186e912456

                  SHA256

                  df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                  SHA512

                  234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                • C:\Users\Admin\AppData\Local\Temp\4189.exe
                  MD5

                  5ea78295c4dfc582646e68bd78f6a1e1

                  SHA1

                  736ef0bfd9a33aff9cf8f53b523a6f00c99c00b1

                  SHA256

                  b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8

                  SHA512

                  5690facb09a90827b3661b2170b27535b1151449ddc93186cc3a9798adc995da824756704411563cf5ae642201c1712916b17782b09e95d3c49ab71ee50ee515

                • C:\Users\Admin\AppData\Local\Temp\4189.exe
                  MD5

                  5ea78295c4dfc582646e68bd78f6a1e1

                  SHA1

                  736ef0bfd9a33aff9cf8f53b523a6f00c99c00b1

                  SHA256

                  b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8

                  SHA512

                  5690facb09a90827b3661b2170b27535b1151449ddc93186cc3a9798adc995da824756704411563cf5ae642201c1712916b17782b09e95d3c49ab71ee50ee515

                • C:\Users\Admin\AppData\Local\Temp\4189.exe
                  MD5

                  5ea78295c4dfc582646e68bd78f6a1e1

                  SHA1

                  736ef0bfd9a33aff9cf8f53b523a6f00c99c00b1

                  SHA256

                  b639cc5dae44c8a6ed37812e180b4d0ba2e85983ad94e9bb47ae349aac727ec8

                  SHA512

                  5690facb09a90827b3661b2170b27535b1151449ddc93186cc3a9798adc995da824756704411563cf5ae642201c1712916b17782b09e95d3c49ab71ee50ee515

                • C:\Users\Admin\AppData\Local\Temp\45FF.exe
                  MD5

                  831a5dc5fa2b9d8d477d3ef10e217506

                  SHA1

                  313455b9a0487d9dcf0b0ceaa054fc8d942a3eca

                  SHA256

                  1843cd50cf003274224a0f3355562f429b8dc4cd307b5b6b8d3fadfbd3840ece

                  SHA512

                  eca615a24dfb8a729a37fdd34e3723c767bd03f99a8404d66fe09e53d58dd4832254fb4049f7b0d13dd510d6cbd0fb876a919dab68ab3bca2370000b8f3f651b

                • C:\Users\Admin\AppData\Local\Temp\45FF.exe
                  MD5

                  831a5dc5fa2b9d8d477d3ef10e217506

                  SHA1

                  313455b9a0487d9dcf0b0ceaa054fc8d942a3eca

                  SHA256

                  1843cd50cf003274224a0f3355562f429b8dc4cd307b5b6b8d3fadfbd3840ece

                  SHA512

                  eca615a24dfb8a729a37fdd34e3723c767bd03f99a8404d66fe09e53d58dd4832254fb4049f7b0d13dd510d6cbd0fb876a919dab68ab3bca2370000b8f3f651b

                • C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\4CA7.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\A97E.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\A97E.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\AC9B.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\AC9B.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\B344.exe
                  MD5

                  8db49ad1e3564676b5c89aea32d52831

                  SHA1

                  c376e927b72b596e64e7144983c05ff3d735c092

                  SHA256

                  151a58796dc7a9e850d8d22f399d542d39ae64f8d6fa2862c8f34e522f5b3e6f

                  SHA512

                  18f3cec93a2ef53ab19647c1aba182cc5980a191e2b54430e3f7bfa864c62ea305a76dcc8c7a2361cb386d621ad31edf7fcb995cd47606c43e56183c62c6be0a

                • C:\Users\Admin\AppData\Local\Temp\B344.exe
                  MD5

                  8db49ad1e3564676b5c89aea32d52831

                  SHA1

                  c376e927b72b596e64e7144983c05ff3d735c092

                  SHA256

                  151a58796dc7a9e850d8d22f399d542d39ae64f8d6fa2862c8f34e522f5b3e6f

                  SHA512

                  18f3cec93a2ef53ab19647c1aba182cc5980a191e2b54430e3f7bfa864c62ea305a76dcc8c7a2361cb386d621ad31edf7fcb995cd47606c43e56183c62c6be0a

                • C:\Users\Admin\AppData\Local\Temp\BB63.exe
                  MD5

                  e93861c6783582541a7529d0c5466df9

                  SHA1

                  6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                  SHA256

                  9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                  SHA512

                  00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

                • C:\Users\Admin\AppData\Local\Temp\BB63.exe
                  MD5

                  e93861c6783582541a7529d0c5466df9

                  SHA1

                  6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                  SHA256

                  9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                  SHA512

                  00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

                • C:\Users\Admin\AppData\Local\Temp\C2B7.exe
                  MD5

                  cd217b0e6e936f9ae9492ec1a089cdcf

                  SHA1

                  14ac87815ea815f8997f0a4c751cc352822a7975

                  SHA256

                  5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                  SHA512

                  fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

                • C:\Users\Admin\AppData\Local\Temp\C2B7.exe
                  MD5

                  cd217b0e6e936f9ae9492ec1a089cdcf

                  SHA1

                  14ac87815ea815f8997f0a4c751cc352822a7975

                  SHA256

                  5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                  SHA512

                  fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

                • C:\Users\Admin\AppData\Local\Temp\yrcsdatm.exe
                  MD5

                  4becb1886c1e94b8529f56ccb1c755ba

                  SHA1

                  b76d439189c7b391a13773a1c76e5216d6a0c0a6

                  SHA256

                  731893f6e6fab52ce367e645b7985258d4e8cba0b404cc2d5c3d33ca96d99b00

                  SHA512

                  4d8ecd09f9dd64b88df8eb7ff2c3d713c9bec2178728c3fdeda202a4f97ac6ea02abd25695cde466d0f094dd4958c8c400987eca04200702a0030d6fc3ab6314

                • C:\Windows\SysWOW64\yhjfbzor\yrcsdatm.exe
                  MD5

                  4becb1886c1e94b8529f56ccb1c755ba

                  SHA1

                  b76d439189c7b391a13773a1c76e5216d6a0c0a6

                  SHA256

                  731893f6e6fab52ce367e645b7985258d4e8cba0b404cc2d5c3d33ca96d99b00

                  SHA512

                  4d8ecd09f9dd64b88df8eb7ff2c3d713c9bec2178728c3fdeda202a4f97ac6ea02abd25695cde466d0f094dd4958c8c400987eca04200702a0030d6fc3ab6314

                • memory/320-160-0x0000000004FD0000-0x00000000055D6000-memory.dmp
                  Filesize

                  6.0MB

                • memory/320-148-0x0000000000400000-0x0000000000420000-memory.dmp
                  Filesize

                  128KB

                • memory/320-162-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
                  Filesize

                  4KB

                • memory/320-155-0x00000000055E0000-0x00000000055E1000-memory.dmp
                  Filesize

                  4KB

                • memory/320-156-0x0000000002A80000-0x0000000002A81000-memory.dmp
                  Filesize

                  4KB

                • memory/320-177-0x0000000007130000-0x0000000007131000-memory.dmp
                  Filesize

                  4KB

                • memory/320-172-0x0000000005330000-0x0000000005331000-memory.dmp
                  Filesize

                  4KB

                • memory/320-174-0x0000000005F10000-0x0000000005F11000-memory.dmp
                  Filesize

                  4KB

                • memory/320-157-0x00000000050E0000-0x00000000050E1000-memory.dmp
                  Filesize

                  4KB

                • memory/320-149-0x0000000000418EEE-mapping.dmp
                • memory/320-163-0x0000000005010000-0x0000000005011000-memory.dmp
                  Filesize

                  4KB

                • memory/320-176-0x0000000006A30000-0x0000000006A31000-memory.dmp
                  Filesize

                  4KB

                • memory/404-143-0x0000000000000000-mapping.dmp
                • memory/1200-144-0x0000000000000000-mapping.dmp
                • memory/1548-146-0x0000000000000000-mapping.dmp
                • memory/1632-136-0x0000000002020000-0x0000000002029000-memory.dmp
                  Filesize

                  36KB

                • memory/1632-120-0x0000000000000000-mapping.dmp
                • memory/1808-147-0x0000000000000000-mapping.dmp
                • memory/2120-131-0x0000000000402DC6-mapping.dmp
                • memory/2132-269-0x0000000000A9259C-mapping.dmp
                • memory/2612-154-0x0000000000000000-mapping.dmp
                • memory/2864-170-0x0000000000400000-0x0000000001FCF000-memory.dmp
                  Filesize

                  27.8MB

                • memory/2864-169-0x0000000001FD0000-0x000000000211A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/2864-164-0x00000000022C3000-0x00000000022D4000-memory.dmp
                  Filesize

                  68KB

                • memory/2908-235-0x0000000004B43000-0x0000000004B44000-memory.dmp
                  Filesize

                  4KB

                • memory/2908-236-0x0000000004B44000-0x0000000004B46000-memory.dmp
                  Filesize

                  8KB

                • memory/2908-211-0x0000000000000000-mapping.dmp
                • memory/2908-217-0x0000000002130000-0x00000000021AF000-memory.dmp
                  Filesize

                  508KB

                • memory/2908-218-0x00000000021B0000-0x000000000224C000-memory.dmp
                  Filesize

                  624KB

                • memory/2908-234-0x0000000004B42000-0x0000000004B43000-memory.dmp
                  Filesize

                  4KB

                • memory/2908-225-0x0000000005150000-0x00000000051B6000-memory.dmp
                  Filesize

                  408KB

                • memory/2908-223-0x0000000000400000-0x00000000004A4000-memory.dmp
                  Filesize

                  656KB

                • memory/2908-222-0x0000000004B40000-0x0000000004B41000-memory.dmp
                  Filesize

                  4KB

                • memory/2908-221-0x0000000004AD0000-0x0000000004B38000-memory.dmp
                  Filesize

                  416KB

                • memory/3040-119-0x00000000011F0000-0x0000000001206000-memory.dmp
                  Filesize

                  88KB

                • memory/3040-237-0x0000000004D60000-0x0000000004D76000-memory.dmp
                  Filesize

                  88KB

                • memory/3040-159-0x0000000002DE0000-0x0000000002DF6000-memory.dmp
                  Filesize

                  88KB

                • memory/3056-166-0x0000000000A49A6B-mapping.dmp
                • memory/3056-165-0x0000000000A40000-0x0000000000A55000-memory.dmp
                  Filesize

                  84KB

                • memory/3056-168-0x0000000000750000-0x0000000000751000-memory.dmp
                  Filesize

                  4KB

                • memory/3056-167-0x0000000000750000-0x0000000000751000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-198-0x00000000761C0000-0x00000000762B1000-memory.dmp
                  Filesize

                  964KB

                • memory/3912-206-0x00000000023E0000-0x0000000002426000-memory.dmp
                  Filesize

                  280KB

                • memory/3912-214-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-215-0x0000000071920000-0x000000007196B000-memory.dmp
                  Filesize

                  300KB

                • memory/3912-210-0x00000000742C0000-0x0000000075608000-memory.dmp
                  Filesize

                  19.3MB

                • memory/3912-191-0x0000000000000000-mapping.dmp
                • memory/3912-209-0x0000000076BD0000-0x0000000077154000-memory.dmp
                  Filesize

                  5.5MB

                • memory/3912-208-0x0000000004F10000-0x0000000004F11000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-194-0x0000000000050000-0x0000000000161000-memory.dmp
                  Filesize

                  1.1MB

                • memory/3912-196-0x0000000000870000-0x0000000000871000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-195-0x0000000000050000-0x0000000000161000-memory.dmp
                  Filesize

                  1.1MB

                • memory/3912-197-0x00000000768C0000-0x0000000076A82000-memory.dmp
                  Filesize

                  1.8MB

                • memory/3912-207-0x0000000000880000-0x0000000000881000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-199-0x0000000000050000-0x0000000000051000-memory.dmp
                  Filesize

                  4KB

                • memory/3912-201-0x0000000071D80000-0x0000000071E00000-memory.dmp
                  Filesize

                  512KB

                • memory/4284-252-0x0000000004923000-0x0000000004924000-memory.dmp
                  Filesize

                  4KB

                • memory/4284-226-0x0000000000000000-mapping.dmp
                • memory/4284-250-0x0000000004920000-0x0000000004921000-memory.dmp
                  Filesize

                  4KB

                • memory/4284-251-0x0000000004922000-0x0000000004923000-memory.dmp
                  Filesize

                  4KB

                • memory/4284-241-0x00000000048F0000-0x000000000491E000-memory.dmp
                  Filesize

                  184KB

                • memory/4284-240-0x0000000000400000-0x0000000002B5C000-memory.dmp
                  Filesize

                  39.4MB

                • memory/4284-243-0x0000000004B80000-0x0000000004BAC000-memory.dmp
                  Filesize

                  176KB

                • memory/4284-253-0x0000000004924000-0x0000000004926000-memory.dmp
                  Filesize

                  8KB

                • memory/4284-239-0x0000000002C90000-0x0000000002DDA000-memory.dmp
                  Filesize

                  1.3MB

                • memory/4296-161-0x0000000000000000-mapping.dmp
                • memory/4368-115-0x00000000021E9000-0x00000000021FA000-memory.dmp
                  Filesize

                  68KB

                • memory/4368-118-0x0000000001FD0000-0x000000000207E000-memory.dmp
                  Filesize

                  696KB

                • memory/4416-116-0x0000000000400000-0x0000000000408000-memory.dmp
                  Filesize

                  32KB

                • memory/4416-117-0x0000000000402DC6-mapping.dmp
                • memory/4560-141-0x0000000000400000-0x0000000001FCF000-memory.dmp
                  Filesize

                  27.8MB

                • memory/4560-137-0x0000000002288000-0x0000000002299000-memory.dmp
                  Filesize

                  68KB

                • memory/4560-139-0x0000000001FD0000-0x000000000211A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/4560-123-0x0000000000000000-mapping.dmp
                • memory/4624-133-0x0000000000C30000-0x0000000000C31000-memory.dmp
                  Filesize

                  4KB

                • memory/4624-138-0x0000000002F20000-0x0000000002F21000-memory.dmp
                  Filesize

                  4KB

                • memory/4624-126-0x0000000000000000-mapping.dmp
                • memory/4624-135-0x00000000054C0000-0x00000000054C1000-memory.dmp
                  Filesize

                  4KB

                • memory/4624-142-0x0000000005A90000-0x0000000005A91000-memory.dmp
                  Filesize

                  4KB

                • memory/4624-140-0x0000000002F40000-0x0000000002F41000-memory.dmp
                  Filesize

                  4KB

                • memory/5032-219-0x0000000001090000-0x000000000113E000-memory.dmp
                  Filesize

                  696KB

                • memory/5032-216-0x00000000012E6000-0x00000000012F7000-memory.dmp
                  Filesize

                  68KB

                • memory/5032-178-0x0000000000000000-mapping.dmp
                • memory/5032-220-0x0000000000400000-0x0000000001085000-memory.dmp
                  Filesize

                  12.5MB

                • memory/5060-187-0x000000001B060000-0x000000001B062000-memory.dmp
                  Filesize

                  8KB

                • memory/5060-181-0x0000000000000000-mapping.dmp
                • memory/5060-184-0x00000000002D0000-0x00000000002D1000-memory.dmp
                  Filesize

                  4KB

                • memory/5060-186-0x0000000000A50000-0x0000000000A6B000-memory.dmp
                  Filesize

                  108KB

                • memory/5060-190-0x00000000023D0000-0x00000000023D1000-memory.dmp
                  Filesize

                  4KB

                • memory/5060-189-0x0000000000A90000-0x0000000000A91000-memory.dmp
                  Filesize

                  4KB

                • memory/5060-188-0x000000001C800000-0x000000001C801000-memory.dmp
                  Filesize

                  4KB