Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-12-2020 03:08

General

  • Target

    Vuu0hnOqjF.exe

  • Size

    340KB

  • MD5

    0a7ab9da9997bf3f75ec4549a9b9daf0

  • SHA1

    d5ffba8afc0cccf2a3194c572db74605dd8879d3

  • SHA256

    1a78aaf6aae3b9d9a32dc6c8cfe9182043f71a3d44e727464ab95a70fc24bbe8

  • SHA512

    3f03bd23458e05469df1623e55a71b6bdad1c7a9af2bf8e7f8750406bd17e759d8b1049ed1531aeee9da503fa86d692bc29ec1a94126be6ff20b647e2840ffbe

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://cent.live/

rc4.i32
rc4.i32

Extracted

Family

qakbot

Botnet

tr01

Campaign

1604997522

C2

122.61.213.85:443

2.50.89.119:995

189.183.201.0:443

86.98.145.152:2222

96.241.66.126:443

90.101.117.122:2222

94.69.112.148:2222

81.150.181.168:2222

82.127.125.209:2222

81.214.126.173:2222

86.140.82.116:20

172.87.157.235:443

176.181.247.197:443

78.97.110.47:443

5.15.90.117:2222

41.206.131.156:443

151.73.112.67:443

82.127.125.209:990

197.45.110.165:995

81.133.234.36:2222

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1059 IoCs
  • Suspicious behavior: MapViewOfSection 32 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 74 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vuu0hnOqjF.exe
    "C:\Users\Admin\AppData\Local\Temp\Vuu0hnOqjF.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1112
  • C:\Users\Admin\AppData\Local\Temp\408.exe
    C:\Users\Admin\AppData\Local\Temp\408.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Local\Temp\408.exe
      C:\Users\Admin\AppData\Local\Temp\408.exe /C
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3784
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bqobvoti /tr "\"C:\Users\Admin\AppData\Local\Temp\408.exe\" /I bqobvoti" /SC ONCE /Z /ST 03:08 /ET 03:20
      2⤵
      • Creates scheduled task(s)
      PID:360
    • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: MapViewOfSection
      PID:2060
      • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe /C
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3488
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
          PID:1348
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:2696
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:3636
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:2528
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:1156
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:2232
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:2360
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:1724
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:1888
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:3880
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:968
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:2876
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1740
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:1504
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                1⤵
                                  PID:1108
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:3804

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Execution

                                  Scheduled Task

                                  1
                                  T1053

                                  Persistence

                                  Scheduled Task

                                  1
                                  T1053

                                  Privilege Escalation

                                  Scheduled Task

                                  1
                                  T1053

                                  Credential Access

                                  Credentials in Files

                                  1
                                  T1081

                                  Discovery

                                  Query Registry

                                  1
                                  T1012

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  System Information Discovery

                                  1
                                  T1082

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\408.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • C:\Users\Admin\AppData\Local\Temp\408.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • C:\Users\Admin\AppData\Local\Temp\408.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.dat
                                    MD5

                                    d64ede4d21616ebbaaa1a0d54bdb27bb

                                    SHA1

                                    99d8a05093b2dfe3364d0fbbb0c7c3ae124c93ab

                                    SHA256

                                    6f4683241939bb642650ad14769e9a4f2b47f8ec78867df5868424094c58aa2c

                                    SHA512

                                    dd4fe22936e24ff36741388244393b127014f7ce31aa4465df2dd443adeba820d4e5cbd6214d218086a3a8f3b2bf62d7b8bf72b2af138e68e7369387f25b9567

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Uxagjed\emukce.exe
                                    MD5

                                    ba98119e8d3b219a5ff1d3984a5f1bd0

                                    SHA1

                                    1de245ea6d17394a769da39711d8cde6eea88b4c

                                    SHA256

                                    c4d55748a4499a17b13c62635b1a9137882739afdd05e855f3248b01541747b5

                                    SHA512

                                    589d5ee340c4117227cc0583236d625648d6f185800fee61077066c8b2d4424f3cc84212f8f77e6b3dcbfa3f872ed7264228b29a9ae71de3d6557fc7b917ccb7

                                  • \Users\Admin\AppData\Local\Temp\554B.tmp
                                    MD5

                                    50741b3f2d7debf5d2bed63d88404029

                                    SHA1

                                    56210388a627b926162b36967045be06ffb1aad3

                                    SHA256

                                    f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                    SHA512

                                    fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                  • memory/360-631-0x0000000000000000-mapping.dmp
                                  • memory/968-525-0x0000000000C20000-0x0000000000C25000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/968-507-0x0000000000000000-mapping.dmp
                                  • memory/968-518-0x0000000000C10000-0x0000000000C19000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/1108-723-0x0000000000BC0000-0x0000000000BC7000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/1108-716-0x0000000000BB0000-0x0000000000BBD000-memory.dmp
                                    Filesize

                                    52KB

                                  • memory/1108-701-0x0000000000000000-mapping.dmp
                                  • memory/1112-2-0x00000000063E0000-0x00000000063E1000-memory.dmp
                                    Filesize

                                    4KB

                                  • memory/1156-221-0x0000000000000000-mapping.dmp
                                  • memory/1156-224-0x0000000000680000-0x000000000068B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/1308-5-0x0000000000000000-mapping.dmp
                                  • memory/1348-1368-0x0000000000000000-mapping.dmp
                                  • memory/1504-658-0x0000000000000000-mapping.dmp
                                  • memory/1504-679-0x0000000000340000-0x0000000000346000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/1504-672-0x0000000000330000-0x000000000033B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/1724-368-0x0000000000900000-0x0000000000905000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/1724-365-0x00000000008F0000-0x00000000008F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/1724-356-0x0000000000000000-mapping.dmp
                                  • memory/1740-611-0x0000000000000000-mapping.dmp
                                  • memory/1740-636-0x0000000000900000-0x0000000000905000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/1740-627-0x00000000008F0000-0x00000000008F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/1888-423-0x0000000001230000-0x0000000001236000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/1888-417-0x0000000001220000-0x000000000122C000-memory.dmp
                                    Filesize

                                    48KB

                                  • memory/1888-406-0x0000000000000000-mapping.dmp
                                  • memory/2060-1361-0x00000000020A0000-0x00000000020DA000-memory.dmp
                                    Filesize

                                    232KB

                                  • memory/2060-605-0x0000000000000000-mapping.dmp
                                  • memory/2232-265-0x0000000000350000-0x000000000035B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/2232-267-0x0000000000360000-0x0000000000367000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/2232-259-0x0000000000000000-mapping.dmp
                                  • memory/2360-302-0x0000000000000000-mapping.dmp
                                  • memory/2360-313-0x0000000000BF0000-0x0000000000BF9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2360-310-0x0000000000BE0000-0x0000000000BEE000-memory.dmp
                                    Filesize

                                    56KB

                                  • memory/2396-445-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-543-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-191-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-192-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-193-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-194-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-195-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-190-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-2326-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-196-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-198-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-188-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-199-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-201-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-203-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-204-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-202-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-206-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-205-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-207-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-208-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-210-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-209-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-211-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-213-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-212-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-214-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-215-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-216-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-217-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-220-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-219-0x0000000001230000-0x000000000123A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-218-0x0000000001230000-0x000000000123A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-222-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-223-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-187-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-227-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-229-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-225-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-232-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-235-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-233-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-186-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-237-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-239-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-244-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-245-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-248-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-241-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-249-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-251-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-253-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-260-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-185-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-257-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-184-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-183-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-268-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-271-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-274-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-277-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-280-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-282-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-287-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-292-0x0000000001230000-0x000000000123A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-295-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-301-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-182-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-308-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-181-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-316-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-180-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-318-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-311-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-304-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-297-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-290-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-285-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-322-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-326-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-335-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-337-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-344-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-346-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-351-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-331-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-360-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-179-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-369-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-178-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-374-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-383-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-394-0x0000000001230000-0x000000000123A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-398-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-393-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-403-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-177-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-409-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-418-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-176-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-175-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-428-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-422-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-440-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-174-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-2245-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-2081-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-464-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1999-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1917-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-452-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-457-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-435-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-497-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-173-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-511-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-413-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-388-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-379-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-172-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-364-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-355-0x0000000001210000-0x0000000001219000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-171-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-170-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-532-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-189-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-522-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-554-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-564-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1835-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-575-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-586-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-597-0x0000000001060000-0x0000000001069000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-613-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-169-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-168-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-167-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-166-0x0000000001210000-0x000000000121A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/2396-1753-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1671-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1589-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-4-0x0000000001040000-0x0000000001055000-memory.dmp
                                    Filesize

                                    84KB

                                  • memory/2396-1505-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1502-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1501-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1492-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1499-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1497-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1495-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1494-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1490-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1488-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1487-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-13-0x0000000001210000-0x000000000121C000-memory.dmp
                                    Filesize

                                    48KB

                                  • memory/2396-1163-0x00000000011F0000-0x00000000011F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2396-1168-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1179-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1173-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1184-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1198-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1202-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1190-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1215-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1221-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1210-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1225-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1238-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1232-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1249-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1244-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1255-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1259-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1263-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1268-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1273-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1278-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1283-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1288-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1293-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1298-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1304-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1308-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1312-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1317-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1322-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1331-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1336-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1326-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1476-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1347-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1362-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-9-0x0000000002FA0000-0x000000000300B000-memory.dmp
                                    Filesize

                                    428KB

                                  • memory/2396-1367-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-8-0x0000000002FA0000-0x000000000300B000-memory.dmp
                                    Filesize

                                    428KB

                                  • memory/2396-1373-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1378-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1351-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1356-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1340-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1383-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1388-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1397-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1392-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1407-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1403-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1415-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1410-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1418-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1426-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1423-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1434-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1437-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1441-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1444-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1448-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1430-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1454-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1457-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1452-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1460-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1462-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1465-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1468-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1472-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1473-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1480-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1483-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2396-1485-0x0000000001060000-0x0000000001065000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/2528-163-0x0000000000000000-mapping.dmp
                                  • memory/2528-164-0x00000000008F0000-0x00000000008F9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/2528-165-0x0000000000900000-0x0000000000904000-memory.dmp
                                    Filesize

                                    16KB

                                  • memory/2696-10-0x0000000000000000-mapping.dmp
                                  • memory/2696-11-0x0000000003100000-0x000000000316B000-memory.dmp
                                    Filesize

                                    428KB

                                  • memory/2696-12-0x0000000003170000-0x00000000031E5000-memory.dmp
                                    Filesize

                                    468KB

                                  • memory/2876-581-0x0000000000440000-0x0000000000462000-memory.dmp
                                    Filesize

                                    136KB

                                  • memory/2876-573-0x0000000000410000-0x0000000000437000-memory.dmp
                                    Filesize

                                    156KB

                                  • memory/2876-560-0x0000000000000000-mapping.dmp
                                  • memory/3488-1343-0x0000000002820000-0x0000000002821000-memory.dmp
                                    Filesize

                                    4KB

                                  • memory/3488-860-0x0000000000000000-mapping.dmp
                                  • memory/3636-17-0x0000000000000000-mapping.dmp
                                  • memory/3636-22-0x0000000000390000-0x0000000000397000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/3636-21-0x0000000000380000-0x000000000038C000-memory.dmp
                                    Filesize

                                    48KB

                                  • memory/3784-454-0x0000000002870000-0x0000000002871000-memory.dmp
                                    Filesize

                                    4KB

                                  • memory/3784-197-0x0000000000000000-mapping.dmp
                                  • memory/3804-767-0x0000000003110000-0x0000000003118000-memory.dmp
                                    Filesize

                                    32KB

                                  • memory/3804-760-0x0000000003100000-0x000000000310B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/3804-746-0x0000000000000000-mapping.dmp
                                  • memory/3880-473-0x0000000003110000-0x0000000003114000-memory.dmp
                                    Filesize

                                    16KB

                                  • memory/3880-468-0x0000000003100000-0x0000000003109000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/3880-459-0x0000000000000000-mapping.dmp