Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    24-11-2021 02:41

General

  • Target

    ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b.exe

  • Size

    150KB

  • MD5

    1ef4d05a6d289a44f78d8275f32d4fda

  • SHA1

    c26e68186ee97bac435655338d0bc2735c250d14

  • SHA256

    ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b

  • SHA512

    3eef789f7fa321c4a2a7b186f436c2ec1dad4d1cfd7026861b51186edfbc3064642b842465e789aaf179254ae1d95fddf5ab9fec06d5fe7e88ba7047798bea54

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

redline

Botnet

Firefox

C2

194.127.179.0:42417

Extracted

Family

redline

Botnet

BADMAN2020

C2

147.124.208.247:34932

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b.exe
    "C:\Users\Admin\AppData\Local\Temp\ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Local\Temp\ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b.exe
      "C:\Users\Admin\AppData\Local\Temp\ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3748
  • C:\Users\Admin\AppData\Local\Temp\15C6.exe
    C:\Users\Admin\AppData\Local\Temp\15C6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Users\Admin\AppData\Local\Temp\15C6.exe
      C:\Users\Admin\AppData\Local\Temp\15C6.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3456
  • C:\Users\Admin\AppData\Local\Temp\1951.exe
    C:\Users\Admin\AppData\Local\Temp\1951.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ursxtfui\
      2⤵
        PID:696
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cvqcgvg.exe" C:\Windows\SysWOW64\ursxtfui\
        2⤵
          PID:3948
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ursxtfui binPath= "C:\Windows\SysWOW64\ursxtfui\cvqcgvg.exe /d\"C:\Users\Admin\AppData\Local\Temp\1951.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3268
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ursxtfui "wifi internet conection"
            2⤵
              PID:2468
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ursxtfui
              2⤵
                PID:1508
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2224
              • C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3240
                • C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                  C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1472
              • C:\Windows\SysWOW64\ursxtfui\cvqcgvg.exe
                C:\Windows\SysWOW64\ursxtfui\cvqcgvg.exe /d"C:\Users\Admin\AppData\Local\Temp\1951.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1760
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2264
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:824
              • C:\Users\Admin\AppData\Local\Temp\75EA.exe
                C:\Users\Admin\AppData\Local\Temp\75EA.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:2308
              • C:\Users\Admin\AppData\Local\Temp\7995.exe
                C:\Users\Admin\AppData\Local\Temp\7995.exe
                1⤵
                • Executes dropped EXE
                PID:3804
              • C:\Users\Admin\AppData\Local\Temp\84F0.exe
                C:\Users\Admin\AppData\Local\Temp\84F0.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3416
              • C:\Users\Admin\AppData\Local\Temp\8C25.exe
                C:\Users\Admin\AppData\Local\Temp\8C25.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:672
              • C:\Users\Admin\AppData\Local\Temp\9FAE.exe
                C:\Users\Admin\AppData\Local\Temp\9FAE.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                PID:4060

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Virtualization/Sandbox Evasion

              1
              T1497

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              4
              T1012

              Virtualization/Sandbox Evasion

              1
              T1497

              System Information Discovery

              4
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1BF2.exe.log
                MD5

                41fbed686f5700fc29aaccf83e8ba7fd

                SHA1

                5271bc29538f11e42a3b600c8dc727186e912456

                SHA256

                df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                SHA512

                234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

              • C:\Users\Admin\AppData\Local\Temp\15C6.exe
                MD5

                1ef4d05a6d289a44f78d8275f32d4fda

                SHA1

                c26e68186ee97bac435655338d0bc2735c250d14

                SHA256

                ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b

                SHA512

                3eef789f7fa321c4a2a7b186f436c2ec1dad4d1cfd7026861b51186edfbc3064642b842465e789aaf179254ae1d95fddf5ab9fec06d5fe7e88ba7047798bea54

              • C:\Users\Admin\AppData\Local\Temp\15C6.exe
                MD5

                1ef4d05a6d289a44f78d8275f32d4fda

                SHA1

                c26e68186ee97bac435655338d0bc2735c250d14

                SHA256

                ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b

                SHA512

                3eef789f7fa321c4a2a7b186f436c2ec1dad4d1cfd7026861b51186edfbc3064642b842465e789aaf179254ae1d95fddf5ab9fec06d5fe7e88ba7047798bea54

              • C:\Users\Admin\AppData\Local\Temp\15C6.exe
                MD5

                1ef4d05a6d289a44f78d8275f32d4fda

                SHA1

                c26e68186ee97bac435655338d0bc2735c250d14

                SHA256

                ad39e9a8b19b3de1fed8bf2f1bf320d64e49032ebb4936f9c42769c31d58f64b

                SHA512

                3eef789f7fa321c4a2a7b186f436c2ec1dad4d1cfd7026861b51186edfbc3064642b842465e789aaf179254ae1d95fddf5ab9fec06d5fe7e88ba7047798bea54

              • C:\Users\Admin\AppData\Local\Temp\1951.exe
                MD5

                ef15323425a825ae51b50c25a08a1e97

                SHA1

                55b2b8dddadaa04c70de4d845b1ed344ebcacb28

                SHA256

                f56d18589d624660f6f60abaabe81a3714f6896df46080d42dbeb2e895f9e3fc

                SHA512

                f87b320591b6f98de12745daa0ca5abe2db8a991ad2e70aa7d74f8380241ed59c61b4d2e1dde9f0105e6068d0d12859d97c8669f84cb40c31aa4b73154cc7dd1

              • C:\Users\Admin\AppData\Local\Temp\1951.exe
                MD5

                ef15323425a825ae51b50c25a08a1e97

                SHA1

                55b2b8dddadaa04c70de4d845b1ed344ebcacb28

                SHA256

                f56d18589d624660f6f60abaabe81a3714f6896df46080d42dbeb2e895f9e3fc

                SHA512

                f87b320591b6f98de12745daa0ca5abe2db8a991ad2e70aa7d74f8380241ed59c61b4d2e1dde9f0105e6068d0d12859d97c8669f84cb40c31aa4b73154cc7dd1

              • C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\1BF2.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\75EA.exe
                MD5

                03651bfa0fa57d86e5a612e0cc81bc09

                SHA1

                67738024bea02128f0d7a9939e193dc706bcd0d8

                SHA256

                48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                SHA512

                b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

              • C:\Users\Admin\AppData\Local\Temp\75EA.exe
                MD5

                03651bfa0fa57d86e5a612e0cc81bc09

                SHA1

                67738024bea02128f0d7a9939e193dc706bcd0d8

                SHA256

                48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                SHA512

                b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

              • C:\Users\Admin\AppData\Local\Temp\7995.exe
                MD5

                b25fdabef081394cfc659b7f9574e323

                SHA1

                84c00d9786f82767814033f70401cb193e0024c0

                SHA256

                ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                SHA512

                42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

              • C:\Users\Admin\AppData\Local\Temp\7995.exe
                MD5

                b25fdabef081394cfc659b7f9574e323

                SHA1

                84c00d9786f82767814033f70401cb193e0024c0

                SHA256

                ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                SHA512

                42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

              • C:\Users\Admin\AppData\Local\Temp\84F0.exe
                MD5

                e93861c6783582541a7529d0c5466df9

                SHA1

                6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                SHA256

                9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                SHA512

                00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

              • C:\Users\Admin\AppData\Local\Temp\84F0.exe
                MD5

                e93861c6783582541a7529d0c5466df9

                SHA1

                6c35da40a2a8bc95211e246ac29cb13b1d3c9d18

                SHA256

                9995f44edede8afef849090432e98064d584c55471124850867620c4f0f397a5

                SHA512

                00ce72cd061504c6a81dfcf22597b3834f89bbb18eebffd93177f846b8a8cabf00fb85f4f256a47d4e83215a06d28b30a971e04604d85704728f2fc157d4fe10

              • C:\Users\Admin\AppData\Local\Temp\8C25.exe
                MD5

                cd217b0e6e936f9ae9492ec1a089cdcf

                SHA1

                14ac87815ea815f8997f0a4c751cc352822a7975

                SHA256

                5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                SHA512

                fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

              • C:\Users\Admin\AppData\Local\Temp\8C25.exe
                MD5

                cd217b0e6e936f9ae9492ec1a089cdcf

                SHA1

                14ac87815ea815f8997f0a4c751cc352822a7975

                SHA256

                5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                SHA512

                fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

              • C:\Users\Admin\AppData\Local\Temp\9FAE.exe
                MD5

                5bb9ac32655956f1924110c7c9c7adc3

                SHA1

                922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                SHA256

                6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                SHA512

                86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

              • C:\Users\Admin\AppData\Local\Temp\9FAE.exe
                MD5

                5bb9ac32655956f1924110c7c9c7adc3

                SHA1

                922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                SHA256

                6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                SHA512

                86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

              • C:\Users\Admin\AppData\Local\Temp\cvqcgvg.exe
                MD5

                cf82435f8e6575bfc32cbfc3c9ef2bda

                SHA1

                0c1eb2606cd21c9f906817d81733b2d58f72b28a

                SHA256

                b8c058956b00c86c2ca328e887fba8e98bc9f6af75d03cf1e25a8d64b936eb27

                SHA512

                ab4b97eee725acf01ef6f50556ad4a1541d4f4e859ec1cee7ef70c3dfe0bc1a7aa21eb8e938f572a4bb5f63a5362043c14ab2a7747f9f2a2435dfc6e0595ac0b

              • C:\Windows\SysWOW64\ursxtfui\cvqcgvg.exe
                MD5

                cf82435f8e6575bfc32cbfc3c9ef2bda

                SHA1

                0c1eb2606cd21c9f906817d81733b2d58f72b28a

                SHA256

                b8c058956b00c86c2ca328e887fba8e98bc9f6af75d03cf1e25a8d64b936eb27

                SHA512

                ab4b97eee725acf01ef6f50556ad4a1541d4f4e859ec1cee7ef70c3dfe0bc1a7aa21eb8e938f572a4bb5f63a5362043c14ab2a7747f9f2a2435dfc6e0595ac0b

              • memory/672-209-0x0000000000000000-mapping.dmp
              • memory/672-239-0x0000000000400000-0x0000000002B5C000-memory.dmp
                Filesize

                39.4MB

              • memory/672-240-0x0000000004AF0000-0x0000000004B1E000-memory.dmp
                Filesize

                184KB

              • memory/672-226-0x0000000002E88000-0x0000000002EB4000-memory.dmp
                Filesize

                176KB

              • memory/672-241-0x0000000004B80000-0x0000000004B81000-memory.dmp
                Filesize

                4KB

              • memory/672-245-0x0000000004B90000-0x0000000004BBC000-memory.dmp
                Filesize

                176KB

              • memory/672-244-0x0000000004B83000-0x0000000004B84000-memory.dmp
                Filesize

                4KB

              • memory/672-243-0x0000000004B82000-0x0000000004B83000-memory.dmp
                Filesize

                4KB

              • memory/672-255-0x0000000004B84000-0x0000000004B86000-memory.dmp
                Filesize

                8KB

              • memory/696-137-0x0000000000000000-mapping.dmp
              • memory/824-170-0x0000000000D00000-0x0000000000DF1000-memory.dmp
                Filesize

                964KB

              • memory/824-175-0x0000000000D00000-0x0000000000DF1000-memory.dmp
                Filesize

                964KB

              • memory/824-174-0x0000000000D9259C-mapping.dmp
              • memory/1472-182-0x0000000007050000-0x0000000007051000-memory.dmp
                Filesize

                4KB

              • memory/1472-177-0x00000000051D0000-0x00000000051D1000-memory.dmp
                Filesize

                4KB

              • memory/1472-181-0x0000000006950000-0x0000000006951000-memory.dmp
                Filesize

                4KB

              • memory/1472-169-0x0000000004E80000-0x0000000004E81000-memory.dmp
                Filesize

                4KB

              • memory/1472-179-0x0000000005D90000-0x0000000005D91000-memory.dmp
                Filesize

                4KB

              • memory/1472-168-0x0000000004D80000-0x0000000005386000-memory.dmp
                Filesize

                6.0MB

              • memory/1472-166-0x0000000004F10000-0x0000000004F11000-memory.dmp
                Filesize

                4KB

              • memory/1472-158-0x0000000000400000-0x0000000000420000-memory.dmp
                Filesize

                128KB

              • memory/1472-167-0x0000000004E40000-0x0000000004E41000-memory.dmp
                Filesize

                4KB

              • memory/1472-159-0x0000000000418EEE-mapping.dmp
              • memory/1472-164-0x0000000005390000-0x0000000005391000-memory.dmp
                Filesize

                4KB

              • memory/1472-165-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                Filesize

                4KB

              • memory/1508-146-0x0000000000000000-mapping.dmp
              • memory/1760-156-0x0000000000400000-0x0000000000432000-memory.dmp
                Filesize

                200KB

              • memory/1760-155-0x0000000000530000-0x000000000067A000-memory.dmp
                Filesize

                1.3MB

              • memory/1760-154-0x0000000000530000-0x000000000067A000-memory.dmp
                Filesize

                1.3MB

              • memory/2224-148-0x0000000000000000-mapping.dmp
              • memory/2264-151-0x0000000000560000-0x0000000000561000-memory.dmp
                Filesize

                4KB

              • memory/2264-157-0x0000000000850000-0x0000000000865000-memory.dmp
                Filesize

                84KB

              • memory/2264-152-0x0000000000560000-0x0000000000561000-memory.dmp
                Filesize

                4KB

              • memory/2264-150-0x0000000000859A6B-mapping.dmp
              • memory/2264-149-0x0000000000850000-0x0000000000865000-memory.dmp
                Filesize

                84KB

              • memory/2308-201-0x0000000000400000-0x0000000001085000-memory.dmp
                Filesize

                12.5MB

              • memory/2308-183-0x0000000000000000-mapping.dmp
              • memory/2308-200-0x00000000010E0000-0x00000000010E9000-memory.dmp
                Filesize

                36KB

              • memory/2468-143-0x0000000000000000-mapping.dmp
              • memory/2716-118-0x0000000000490000-0x0000000000499000-memory.dmp
                Filesize

                36KB

              • memory/2716-117-0x0000000000480000-0x0000000000488000-memory.dmp
                Filesize

                32KB

              • memory/3020-119-0x0000000000820000-0x0000000000836000-memory.dmp
                Filesize

                88KB

              • memory/3020-153-0x0000000002A10000-0x0000000002A26000-memory.dmp
                Filesize

                88KB

              • memory/3020-220-0x0000000004820000-0x0000000004836000-memory.dmp
                Filesize

                88KB

              • memory/3240-144-0x00000000051F0000-0x00000000051F1000-memory.dmp
                Filesize

                4KB

              • memory/3240-129-0x0000000000000000-mapping.dmp
              • memory/3240-135-0x0000000000720000-0x0000000000721000-memory.dmp
                Filesize

                4KB

              • memory/3240-138-0x0000000005090000-0x0000000005091000-memory.dmp
                Filesize

                4KB

              • memory/3240-142-0x0000000005030000-0x0000000005031000-memory.dmp
                Filesize

                4KB

              • memory/3240-145-0x0000000005700000-0x0000000005701000-memory.dmp
                Filesize

                4KB

              • memory/3268-141-0x0000000000000000-mapping.dmp
              • memory/3416-218-0x0000000002603000-0x0000000002604000-memory.dmp
                Filesize

                4KB

              • memory/3416-196-0x0000000000000000-mapping.dmp
              • memory/3416-202-0x00000000024D0000-0x0000000002538000-memory.dmp
                Filesize

                416KB

              • memory/3416-204-0x0000000005170000-0x00000000051D6000-memory.dmp
                Filesize

                408KB

              • memory/3416-219-0x0000000002604000-0x0000000002606000-memory.dmp
                Filesize

                8KB

              • memory/3416-210-0x0000000002110000-0x000000000218F000-memory.dmp
                Filesize

                508KB

              • memory/3416-215-0x0000000000400000-0x00000000004A4000-memory.dmp
                Filesize

                656KB

              • memory/3416-214-0x00000000021C0000-0x000000000225C000-memory.dmp
                Filesize

                624KB

              • memory/3416-216-0x0000000002600000-0x0000000002601000-memory.dmp
                Filesize

                4KB

              • memory/3416-217-0x0000000002602000-0x0000000002603000-memory.dmp
                Filesize

                4KB

              • memory/3416-213-0x0000000005B80000-0x0000000005B81000-memory.dmp
                Filesize

                4KB

              • memory/3456-124-0x0000000000402DC6-mapping.dmp
              • memory/3460-133-0x0000000000590000-0x00000000005A3000-memory.dmp
                Filesize

                76KB

              • memory/3460-126-0x0000000000000000-mapping.dmp
              • memory/3460-132-0x00000000001D0000-0x00000000001DD000-memory.dmp
                Filesize

                52KB

              • memory/3460-134-0x0000000000400000-0x0000000000432000-memory.dmp
                Filesize

                200KB

              • memory/3748-115-0x0000000000400000-0x0000000000408000-memory.dmp
                Filesize

                32KB

              • memory/3748-116-0x0000000000402DC6-mapping.dmp
              • memory/3804-192-0x000000001BE20000-0x000000001BE21000-memory.dmp
                Filesize

                4KB

              • memory/3804-191-0x0000000000DE0000-0x0000000000DFB000-memory.dmp
                Filesize

                108KB

              • memory/3804-194-0x0000000002860000-0x0000000002861000-memory.dmp
                Filesize

                4KB

              • memory/3804-189-0x0000000000680000-0x0000000000681000-memory.dmp
                Filesize

                4KB

              • memory/3804-193-0x0000000000E20000-0x0000000000E21000-memory.dmp
                Filesize

                4KB

              • memory/3804-186-0x0000000000000000-mapping.dmp
              • memory/3804-195-0x000000001B3C0000-0x000000001B3C2000-memory.dmp
                Filesize

                8KB

              • memory/3944-120-0x0000000000000000-mapping.dmp
              • memory/3948-139-0x0000000000000000-mapping.dmp
              • memory/4060-225-0x0000000000400000-0x0000000000402000-memory.dmp
                Filesize

                8KB

              • memory/4060-238-0x00000000028E0000-0x00000000028E1000-memory.dmp
                Filesize

                4KB

              • memory/4060-237-0x0000000002870000-0x0000000002871000-memory.dmp
                Filesize

                4KB

              • memory/4060-235-0x0000000006630000-0x0000000006631000-memory.dmp
                Filesize

                4KB

              • memory/4060-233-0x00000000028C0000-0x00000000028C1000-memory.dmp
                Filesize

                4KB

              • memory/4060-231-0x00000000028B0000-0x00000000028B1000-memory.dmp
                Filesize

                4KB

              • memory/4060-229-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Filesize

                384KB

              • memory/4060-224-0x0000000000400000-0x0000000000816000-memory.dmp
                Filesize

                4.1MB

              • memory/4060-246-0x00000000028A0000-0x00000000028A1000-memory.dmp
                Filesize

                4KB

              • memory/4060-247-0x0000000002890000-0x0000000002891000-memory.dmp
                Filesize

                4KB

              • memory/4060-249-0x0000000002900000-0x0000000002901000-memory.dmp
                Filesize

                4KB

              • memory/4060-252-0x00000000028D0000-0x00000000028D1000-memory.dmp
                Filesize

                4KB

              • memory/4060-253-0x00000000035A0000-0x00000000035A1000-memory.dmp
                Filesize

                4KB

              • memory/4060-257-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-221-0x0000000000000000-mapping.dmp
              • memory/4060-259-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-260-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-261-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-262-0x00000000026A0000-0x00000000026A1000-memory.dmp
                Filesize

                4KB

              • memory/4060-263-0x00000000026B0000-0x00000000026B1000-memory.dmp
                Filesize

                4KB

              • memory/4060-264-0x0000000002660000-0x0000000002661000-memory.dmp
                Filesize

                4KB

              • memory/4060-265-0x0000000002680000-0x0000000002681000-memory.dmp
                Filesize

                4KB

              • memory/4060-266-0x00000000026D0000-0x00000000026D1000-memory.dmp
                Filesize

                4KB

              • memory/4060-267-0x00000000026F0000-0x00000000026F1000-memory.dmp
                Filesize

                4KB

              • memory/4060-268-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-269-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-270-0x0000000002800000-0x0000000002801000-memory.dmp
                Filesize

                4KB

              • memory/4060-271-0x0000000002810000-0x0000000002811000-memory.dmp
                Filesize

                4KB

              • memory/4060-272-0x00000000027C0000-0x00000000027C1000-memory.dmp
                Filesize

                4KB

              • memory/4060-273-0x0000000002830000-0x0000000002831000-memory.dmp
                Filesize

                4KB

              • memory/4060-274-0x00000000027F0000-0x00000000027F1000-memory.dmp
                Filesize

                4KB

              • memory/4060-275-0x00000000027E0000-0x00000000027E1000-memory.dmp
                Filesize

                4KB

              • memory/4060-276-0x0000000002850000-0x0000000002851000-memory.dmp
                Filesize

                4KB

              • memory/4060-277-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-278-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-279-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-280-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4060-281-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB