Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    24-11-2021 04:24

General

  • Target

    b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69.exe

  • Size

    150KB

  • MD5

    8c8b8c82b391ea457933c8277ccdd417

  • SHA1

    279e4ba0cb23a51289861fb3bec647fe55df98bd

  • SHA256

    b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69

  • SHA512

    1b81866b0e529dfdaa1e15fe7720d6746571f5d7269193ef77d9e99d069a2f4ba24a4506fbf7705f3ac952fc3d66623626446f0c95e44c74fa510f5604b7819f

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

redline

Botnet

BADMAN2020

C2

147.124.208.247:34932

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69.exe
    "C:\Users\Admin\AppData\Local\Temp\b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3776
    • C:\Users\Admin\AppData\Local\Temp\b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69.exe
      "C:\Users\Admin\AppData\Local\Temp\b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3956
  • C:\Users\Admin\AppData\Local\Temp\E437.exe
    C:\Users\Admin\AppData\Local\Temp\E437.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\E437.exe
      C:\Users\Admin\AppData\Local\Temp\E437.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4512
  • C:\Users\Admin\AppData\Local\Temp\E7C2.exe
    C:\Users\Admin\AppData\Local\Temp\E7C2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\icjndkyg\
      2⤵
        PID:3224
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lqaqej.exe" C:\Windows\SysWOW64\icjndkyg\
        2⤵
          PID:368
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create icjndkyg binPath= "C:\Windows\SysWOW64\icjndkyg\lqaqej.exe /d\"C:\Users\Admin\AppData\Local\Temp\E7C2.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1224
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description icjndkyg "wifi internet conection"
            2⤵
              PID:1700
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start icjndkyg
              2⤵
                PID:1812
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2328
              • C:\Users\Admin\AppData\Local\Temp\EA72.exe
                C:\Users\Admin\AppData\Local\Temp\EA72.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\Users\Admin\AppData\Local\Temp\EA72.exe
                  C:\Users\Admin\AppData\Local\Temp\EA72.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1232
              • C:\Windows\SysWOW64\icjndkyg\lqaqej.exe
                C:\Windows\SysWOW64\icjndkyg\lqaqej.exe /d"C:\Users\Admin\AppData\Local\Temp\E7C2.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3008
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4972
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:600
              • C:\Users\Admin\AppData\Local\Temp\4507.exe
                C:\Users\Admin\AppData\Local\Temp\4507.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:4824
              • C:\Users\Admin\AppData\Local\Temp\4892.exe
                C:\Users\Admin\AppData\Local\Temp\4892.exe
                1⤵
                • Executes dropped EXE
                PID:4252
              • C:\Users\Admin\AppData\Local\Temp\55C2.exe
                C:\Users\Admin\AppData\Local\Temp\55C2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4704
              • C:\Users\Admin\AppData\Local\Temp\6052.exe
                C:\Users\Admin\AppData\Local\Temp\6052.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of AdjustPrivilegeToken
                PID:4708

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Virtualization/Sandbox Evasion

              1
              T1497

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              4
              T1012

              Virtualization/Sandbox Evasion

              1
              T1497

              System Information Discovery

              4
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              2
              T1005

              Command and Control

              Web Service

              1
              T1102

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EA72.exe.log
                MD5

                41fbed686f5700fc29aaccf83e8ba7fd

                SHA1

                5271bc29538f11e42a3b600c8dc727186e912456

                SHA256

                df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                SHA512

                234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

              • C:\Users\Admin\AppData\Local\Temp\4507.exe
                MD5

                03651bfa0fa57d86e5a612e0cc81bc09

                SHA1

                67738024bea02128f0d7a9939e193dc706bcd0d8

                SHA256

                48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                SHA512

                b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

              • C:\Users\Admin\AppData\Local\Temp\4507.exe
                MD5

                03651bfa0fa57d86e5a612e0cc81bc09

                SHA1

                67738024bea02128f0d7a9939e193dc706bcd0d8

                SHA256

                48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                SHA512

                b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

              • C:\Users\Admin\AppData\Local\Temp\4892.exe
                MD5

                b25fdabef081394cfc659b7f9574e323

                SHA1

                84c00d9786f82767814033f70401cb193e0024c0

                SHA256

                ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                SHA512

                42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

              • C:\Users\Admin\AppData\Local\Temp\4892.exe
                MD5

                b25fdabef081394cfc659b7f9574e323

                SHA1

                84c00d9786f82767814033f70401cb193e0024c0

                SHA256

                ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                SHA512

                42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

              • C:\Users\Admin\AppData\Local\Temp\55C2.exe
                MD5

                cd217b0e6e936f9ae9492ec1a089cdcf

                SHA1

                14ac87815ea815f8997f0a4c751cc352822a7975

                SHA256

                5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                SHA512

                fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

              • C:\Users\Admin\AppData\Local\Temp\55C2.exe
                MD5

                cd217b0e6e936f9ae9492ec1a089cdcf

                SHA1

                14ac87815ea815f8997f0a4c751cc352822a7975

                SHA256

                5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8

                SHA512

                fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73

              • C:\Users\Admin\AppData\Local\Temp\6052.exe
                MD5

                5bb9ac32655956f1924110c7c9c7adc3

                SHA1

                922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                SHA256

                6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                SHA512

                86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

              • C:\Users\Admin\AppData\Local\Temp\6052.exe
                MD5

                5bb9ac32655956f1924110c7c9c7adc3

                SHA1

                922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                SHA256

                6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                SHA512

                86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

              • C:\Users\Admin\AppData\Local\Temp\E437.exe
                MD5

                8c8b8c82b391ea457933c8277ccdd417

                SHA1

                279e4ba0cb23a51289861fb3bec647fe55df98bd

                SHA256

                b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69

                SHA512

                1b81866b0e529dfdaa1e15fe7720d6746571f5d7269193ef77d9e99d069a2f4ba24a4506fbf7705f3ac952fc3d66623626446f0c95e44c74fa510f5604b7819f

              • C:\Users\Admin\AppData\Local\Temp\E437.exe
                MD5

                8c8b8c82b391ea457933c8277ccdd417

                SHA1

                279e4ba0cb23a51289861fb3bec647fe55df98bd

                SHA256

                b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69

                SHA512

                1b81866b0e529dfdaa1e15fe7720d6746571f5d7269193ef77d9e99d069a2f4ba24a4506fbf7705f3ac952fc3d66623626446f0c95e44c74fa510f5604b7819f

              • C:\Users\Admin\AppData\Local\Temp\E437.exe
                MD5

                8c8b8c82b391ea457933c8277ccdd417

                SHA1

                279e4ba0cb23a51289861fb3bec647fe55df98bd

                SHA256

                b4859b2e6479b8d3946070dbc9c0fae4ace805926227b71e9a9ffccc48b84f69

                SHA512

                1b81866b0e529dfdaa1e15fe7720d6746571f5d7269193ef77d9e99d069a2f4ba24a4506fbf7705f3ac952fc3d66623626446f0c95e44c74fa510f5604b7819f

              • C:\Users\Admin\AppData\Local\Temp\E7C2.exe
                MD5

                ae26a7d97f24de1ccb18f6e8d5c2b17e

                SHA1

                db1699530d888798f5755c6fa49b510735ee382c

                SHA256

                8de70b11b35097da33e0d5dd0e501ab30c1e7848bfa1339ae111208720412a2e

                SHA512

                08c8c53f698d20167058d26b973c95fe639b7f2b7812c3b8b4ee6a89088d9917ec0ea31a3d34592400976bf2b3419993d7b5207830e396bc89701c5b69b8e723

              • C:\Users\Admin\AppData\Local\Temp\E7C2.exe
                MD5

                ae26a7d97f24de1ccb18f6e8d5c2b17e

                SHA1

                db1699530d888798f5755c6fa49b510735ee382c

                SHA256

                8de70b11b35097da33e0d5dd0e501ab30c1e7848bfa1339ae111208720412a2e

                SHA512

                08c8c53f698d20167058d26b973c95fe639b7f2b7812c3b8b4ee6a89088d9917ec0ea31a3d34592400976bf2b3419993d7b5207830e396bc89701c5b69b8e723

              • C:\Users\Admin\AppData\Local\Temp\EA72.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\EA72.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\EA72.exe
                MD5

                e850bf7dbab0575d6bcde28710be9192

                SHA1

                9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                SHA256

                c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                SHA512

                4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

              • C:\Users\Admin\AppData\Local\Temp\lqaqej.exe
                MD5

                bf82c1341e6b1710397568ad35f4207b

                SHA1

                ef9929799418b7889c160ce5694c3f2e72ed53fd

                SHA256

                caa43dd74141466a09c8a1173d61540799b7b6c3eed65c9546c4850eb5d33f5a

                SHA512

                9c4419f5deb5a14ca39995e0bade1340fd4b7d00c1aed30832fab43e18ee6048f808f1af27bca02949f2807c6eadac3c4550360064e65e175edde54393a757de

              • C:\Windows\SysWOW64\icjndkyg\lqaqej.exe
                MD5

                bf82c1341e6b1710397568ad35f4207b

                SHA1

                ef9929799418b7889c160ce5694c3f2e72ed53fd

                SHA256

                caa43dd74141466a09c8a1173d61540799b7b6c3eed65c9546c4850eb5d33f5a

                SHA512

                9c4419f5deb5a14ca39995e0bade1340fd4b7d00c1aed30832fab43e18ee6048f808f1af27bca02949f2807c6eadac3c4550360064e65e175edde54393a757de

              • memory/368-144-0x0000000000000000-mapping.dmp
              • memory/432-139-0x0000000002A90000-0x0000000002A91000-memory.dmp
                Filesize

                4KB

              • memory/432-138-0x0000000005030000-0x0000000005031000-memory.dmp
                Filesize

                4KB

              • memory/432-143-0x0000000005190000-0x0000000005191000-memory.dmp
                Filesize

                4KB

              • memory/432-136-0x00000000007C0000-0x00000000007C1000-memory.dmp
                Filesize

                4KB

              • memory/432-132-0x0000000000000000-mapping.dmp
              • memory/432-146-0x00000000056A0000-0x00000000056A1000-memory.dmp
                Filesize

                4KB

              • memory/600-185-0x0000000000800000-0x00000000008F1000-memory.dmp
                Filesize

                964KB

              • memory/600-180-0x0000000000800000-0x00000000008F1000-memory.dmp
                Filesize

                964KB

              • memory/600-184-0x000000000089259C-mapping.dmp
              • memory/1224-147-0x0000000000000000-mapping.dmp
              • memory/1232-164-0x0000000005750000-0x0000000005751000-memory.dmp
                Filesize

                4KB

              • memory/1232-165-0x0000000005680000-0x0000000005681000-memory.dmp
                Filesize

                4KB

              • memory/1232-152-0x0000000000400000-0x0000000000420000-memory.dmp
                Filesize

                128KB

              • memory/1232-178-0x00000000078F0000-0x00000000078F1000-memory.dmp
                Filesize

                4KB

              • memory/1232-177-0x00000000071F0000-0x00000000071F1000-memory.dmp
                Filesize

                4KB

              • memory/1232-174-0x0000000006580000-0x0000000006581000-memory.dmp
                Filesize

                4KB

              • memory/1232-172-0x00000000059D0000-0x00000000059D1000-memory.dmp
                Filesize

                4KB

              • memory/1232-153-0x0000000000418EEE-mapping.dmp
              • memory/1232-161-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
                Filesize

                4KB

              • memory/1232-171-0x00000000056C0000-0x00000000056C1000-memory.dmp
                Filesize

                4KB

              • memory/1232-170-0x00000000055B0000-0x0000000005BB6000-memory.dmp
                Filesize

                6.0MB

              • memory/1232-163-0x0000000005620000-0x0000000005621000-memory.dmp
                Filesize

                4KB

              • memory/1700-148-0x0000000000000000-mapping.dmp
              • memory/1812-149-0x0000000000000000-mapping.dmp
              • memory/2036-122-0x0000000000DD0000-0x0000000000DE6000-memory.dmp
                Filesize

                88KB

              • memory/2036-166-0x0000000002CC0000-0x0000000002CD6000-memory.dmp
                Filesize

                88KB

              • memory/2036-238-0x0000000004C20000-0x0000000004C36000-memory.dmp
                Filesize

                88KB

              • memory/2328-150-0x0000000000000000-mapping.dmp
              • memory/3008-167-0x0000000000560000-0x000000000056D000-memory.dmp
                Filesize

                52KB

              • memory/3008-169-0x0000000000400000-0x0000000000432000-memory.dmp
                Filesize

                200KB

              • memory/3008-168-0x0000000000580000-0x00000000006CA000-memory.dmp
                Filesize

                1.3MB

              • memory/3224-135-0x0000000000000000-mapping.dmp
              • memory/3776-120-0x0000000000540000-0x0000000000548000-memory.dmp
                Filesize

                32KB

              • memory/3776-121-0x0000000002150000-0x0000000002159000-memory.dmp
                Filesize

                36KB

              • memory/3956-119-0x0000000000402DC6-mapping.dmp
              • memory/3956-118-0x0000000000400000-0x0000000000408000-memory.dmp
                Filesize

                32KB

              • memory/4252-196-0x0000000001470000-0x0000000001471000-memory.dmp
                Filesize

                4KB

              • memory/4252-195-0x000000001BB30000-0x000000001BB31000-memory.dmp
                Filesize

                4KB

              • memory/4252-189-0x0000000000000000-mapping.dmp
              • memory/4252-198-0x000000001BB20000-0x000000001BB22000-memory.dmp
                Filesize

                8KB

              • memory/4252-197-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
                Filesize

                4KB

              • memory/4252-192-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                Filesize

                4KB

              • memory/4252-194-0x0000000001330000-0x000000000134B000-memory.dmp
                Filesize

                108KB

              • memory/4328-123-0x0000000000000000-mapping.dmp
              • memory/4512-127-0x0000000000402DC6-mapping.dmp
              • memory/4564-142-0x0000000000400000-0x0000000000432000-memory.dmp
                Filesize

                200KB

              • memory/4564-141-0x0000000000520000-0x000000000066A000-memory.dmp
                Filesize

                1.3MB

              • memory/4564-140-0x0000000000520000-0x000000000066A000-memory.dmp
                Filesize

                1.3MB

              • memory/4564-129-0x0000000000000000-mapping.dmp
              • memory/4704-264-0x0000000007432000-0x0000000007433000-memory.dmp
                Filesize

                4KB

              • memory/4704-263-0x0000000007430000-0x0000000007431000-memory.dmp
                Filesize

                4KB

              • memory/4704-262-0x0000000004930000-0x000000000495E000-memory.dmp
                Filesize

                184KB

              • memory/4704-202-0x0000000000000000-mapping.dmp
              • memory/4704-258-0x0000000000400000-0x0000000002B5C000-memory.dmp
                Filesize

                39.4MB

              • memory/4704-267-0x0000000004B30000-0x0000000004B5C000-memory.dmp
                Filesize

                176KB

              • memory/4704-251-0x0000000002B60000-0x0000000002C0E000-memory.dmp
                Filesize

                696KB

              • memory/4704-266-0x0000000007433000-0x0000000007434000-memory.dmp
                Filesize

                4KB

              • memory/4708-229-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-240-0x0000000002800000-0x0000000002801000-memory.dmp
                Filesize

                4KB

              • memory/4708-210-0x00000000028C0000-0x00000000028C1000-memory.dmp
                Filesize

                4KB

              • memory/4708-213-0x0000000000400000-0x0000000000402000-memory.dmp
                Filesize

                8KB

              • memory/4708-212-0x0000000002870000-0x0000000002871000-memory.dmp
                Filesize

                4KB

              • memory/4708-214-0x00000000028E0000-0x00000000028E1000-memory.dmp
                Filesize

                4KB

              • memory/4708-218-0x0000000002890000-0x0000000002891000-memory.dmp
                Filesize

                4KB

              • memory/4708-216-0x00000000028A0000-0x00000000028A1000-memory.dmp
                Filesize

                4KB

              • memory/4708-220-0x0000000002900000-0x0000000002901000-memory.dmp
                Filesize

                4KB

              • memory/4708-211-0x0000000000400000-0x0000000000816000-memory.dmp
                Filesize

                4.1MB

              • memory/4708-224-0x0000000006510000-0x0000000006511000-memory.dmp
                Filesize

                4KB

              • memory/4708-222-0x00000000028D0000-0x00000000028D1000-memory.dmp
                Filesize

                4KB

              • memory/4708-225-0x0000000006520000-0x0000000006521000-memory.dmp
                Filesize

                4KB

              • memory/4708-226-0x00000000035A0000-0x00000000035A1000-memory.dmp
                Filesize

                4KB

              • memory/4708-227-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-228-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-286-0x0000000007D00000-0x0000000007D01000-memory.dmp
                Filesize

                4KB

              • memory/4708-231-0x0000000002690000-0x0000000002691000-memory.dmp
                Filesize

                4KB

              • memory/4708-230-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-232-0x00000000026A0000-0x00000000026A1000-memory.dmp
                Filesize

                4KB

              • memory/4708-233-0x0000000002650000-0x0000000002651000-memory.dmp
                Filesize

                4KB

              • memory/4708-235-0x00000000026C0000-0x00000000026C1000-memory.dmp
                Filesize

                4KB

              • memory/4708-234-0x0000000002670000-0x0000000002671000-memory.dmp
                Filesize

                4KB

              • memory/4708-236-0x00000000026E0000-0x00000000026E1000-memory.dmp
                Filesize

                4KB

              • memory/4708-208-0x0000000000AC0000-0x0000000000B20000-memory.dmp
                Filesize

                384KB

              • memory/4708-237-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-239-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-209-0x00000000028B0000-0x00000000028B1000-memory.dmp
                Filesize

                4KB

              • memory/4708-242-0x00000000027C0000-0x00000000027C1000-memory.dmp
                Filesize

                4KB

              • memory/4708-241-0x0000000002810000-0x0000000002811000-memory.dmp
                Filesize

                4KB

              • memory/4708-243-0x0000000002830000-0x0000000002831000-memory.dmp
                Filesize

                4KB

              • memory/4708-245-0x00000000027E0000-0x00000000027E1000-memory.dmp
                Filesize

                4KB

              • memory/4708-244-0x00000000027F0000-0x00000000027F1000-memory.dmp
                Filesize

                4KB

              • memory/4708-246-0x0000000002850000-0x0000000002851000-memory.dmp
                Filesize

                4KB

              • memory/4708-247-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-249-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-250-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-205-0x0000000000000000-mapping.dmp
              • memory/4708-253-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-252-0x0000000003590000-0x0000000003591000-memory.dmp
                Filesize

                4KB

              • memory/4708-254-0x0000000002640000-0x0000000002641000-memory.dmp
                Filesize

                4KB

              • memory/4708-255-0x0000000002960000-0x0000000002961000-memory.dmp
                Filesize

                4KB

              • memory/4708-257-0x0000000002920000-0x0000000002921000-memory.dmp
                Filesize

                4KB

              • memory/4708-256-0x0000000002970000-0x0000000002971000-memory.dmp
                Filesize

                4KB

              • memory/4708-268-0x00000000029B0000-0x00000000029B1000-memory.dmp
                Filesize

                4KB

              • memory/4708-260-0x0000000002950000-0x0000000002951000-memory.dmp
                Filesize

                4KB

              • memory/4708-259-0x0000000002990000-0x0000000002991000-memory.dmp
                Filesize

                4KB

              • memory/4708-261-0x0000000002940000-0x0000000002941000-memory.dmp
                Filesize

                4KB

              • memory/4824-200-0x0000000001170000-0x0000000001179000-memory.dmp
                Filesize

                36KB

              • memory/4824-201-0x0000000000400000-0x0000000001085000-memory.dmp
                Filesize

                12.5MB

              • memory/4824-186-0x0000000000000000-mapping.dmp
              • memory/4972-157-0x0000000000790000-0x00000000007A5000-memory.dmp
                Filesize

                84KB

              • memory/4972-159-0x0000000000799A6B-mapping.dmp
              • memory/4972-162-0x00000000006A0000-0x00000000006A1000-memory.dmp
                Filesize

                4KB

              • memory/4972-160-0x00000000006A0000-0x00000000006A1000-memory.dmp
                Filesize

                4KB