smokeloader | 4bb9bb8442b8bb68a5ebffb308c5d2f2212fa33b04a0f4de87dbf7ca1487dc1b

Analysis

max time kernel
41s
max time network
154s
platform
windows7_x64
resource
win7v20210408
submitted
30/08/2021, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89DAC1423E1281902DFA3501FED124B1.exe
Size 2.7MB
Sample210830-e3plsfvk5a
SHA256 4bb9bb8442b8bb68a5ebffb308c5d2f2212fa33b04a0f4de87dbf7ca1487dc1b
MD5 89dac1423e1281902dfa3501fed124b1
SHA1 21e5ec36467c2c2e15f4e699f28d84d629fcd077
SHA512 1ba1b83fadc69daf9a5c2dd9ae1e0d9f089d5ee3a917eacd77f2f9dbf0da02465b5c0df7bb45332e32062566b8c7ae6142f0779ac91f25280d5d03ff44e5b2d0
MD5 SHA1 SHA512

Score

10^/10

smokeloader aspackv2 backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1692	rundll32.exe	56

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130ce-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130ce-78.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cf-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cf-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-83.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-82.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1928	setup_installer.exe
1720	setup_install.exe
1564	Fri02024b3d1237621.exe
576	LzmwAqmV.exe
1008	Fri024dbf9c992.exe
908	Fri026b43c7db79.exe
1824	Fri020e07c2f8aa8dd.exe
1656	Fri02b3cba8e5ea.exe
984	Fri023db71e8e.exe
520	Fri024dbf9c992.tmp
1700	Fri020e07c2f8aa8dd.exe
1652	Fri02fc24d8801.exe
576	LzmwAqmV.exe

Loads dropped DLL 40 IoCs

pid	Process
736	89DAC1423E1281902DFA3501FED124B1.exe
1928	setup_installer.exe
1928	setup_installer.exe
1928	setup_installer.exe
1928	setup_installer.exe
1928	setup_installer.exe
1928	setup_installer.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
568	cmd.exe
1256	cmd.exe
1256	cmd.exe
564	cmd.exe
856	cmd.exe
1564	Fri02024b3d1237621.exe
1564	Fri02024b3d1237621.exe
1356	cmd.exe
1356	cmd.exe
576	LzmwAqmV.exe
576	LzmwAqmV.exe
1008	Fri024dbf9c992.exe
1008	Fri024dbf9c992.exe
1640	cmd.exe
1656	Fri02b3cba8e5ea.exe
1656	Fri02b3cba8e5ea.exe
1008	Fri024dbf9c992.exe
576	LzmwAqmV.exe
520	Fri024dbf9c992.tmp
520	Fri024dbf9c992.tmp
520	Fri024dbf9c992.tmp
1652	Fri02fc24d8801.exe
1652	Fri02fc24d8801.exe
576	LzmwAqmV.exe
576	LzmwAqmV.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
26	ipinfo.io
118	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri02b3cba8e5ea.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri02b3cba8e5ea.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri02b3cba8e5ea.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
1656	Fri02b3cba8e5ea.exe
1656	Fri02b3cba8e5ea.exe
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1656	Fri02b3cba8e5ea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	Fri023db71e8e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 736 wrote to memory of 1928	736	89DAC1423E1281902DFA3501FED124B1.exe	26
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1928 wrote to memory of 1720	1928	setup_installer.exe	27
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1128	1720	setup_install.exe	29
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1256	1720	setup_install.exe	31
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1356	1720	setup_install.exe	30
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1264	1720	setup_install.exe	54
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 1200	1720	setup_install.exe	32
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 856	1720	setup_install.exe	53
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 568	1720	setup_install.exe	33
PID 1720 wrote to memory of 564	1720	setup_install.exe	52

C:\Users\Admin\AppData\Local\Temp\89DAC1423E1281902DFA3501FED124B1.exe
"C:\Users\Admin\AppData\Local\Temp\89DAC1423E1281902DFA3501FED124B1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri02b3cba8e5ea.exe
      4⤵
      Loads dropped DLL
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri02b3cba8e5ea.exe
        
        Fri02b3cba8e5ea.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri02fc24d8801.exe
      4⤵
      Loads dropped DLL
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri02fc24d8801.exe
        
        Fri02fc24d8801.exe
        5⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri02fc24d8801.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri02fc24d8801.exe" -a
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0223b8b387f9569.exe
      4⤵
      PID:1200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri02024b3d1237621.exe
      4⤵
      Loads dropped DLL
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri02024b3d1237621.exe
        
        Fri02024b3d1237621.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1564
      - C:\Users\Admin\Documents\mh70YlKhKVKvEO84v5VJqBbB.exe
        
        "C:\Users\Admin\Documents\mh70YlKhKVKvEO84v5VJqBbB.exe"
        6⤵
        
        PID:2264
      - C:\Users\Admin\Documents\4evzyHiMLV1C1_2LYzh8G1iM.exe
        
        "C:\Users\Admin\Documents\4evzyHiMLV1C1_2LYzh8G1iM.exe"
        6⤵
        
        PID:2276
      - C:\Users\Admin\Documents\3ZT5y3cCTWLpmKemPffW1hWc.exe
        
        "C:\Users\Admin\Documents\3ZT5y3cCTWLpmKemPffW1hWc.exe"
        6⤵
        
        PID:2320
      - C:\Users\Admin\Documents\2wWGkfpYXaOa5ShoXV2hR6F2.exe
        
        "C:\Users\Admin\Documents\2wWGkfpYXaOa5ShoXV2hR6F2.exe"
        6⤵
        
        PID:2308
      - C:\Users\Admin\Documents\Ux8HWLr_GwSFqF3MhvlNRviF.exe
        
        "C:\Users\Admin\Documents\Ux8HWLr_GwSFqF3MhvlNRviF.exe"
        6⤵
        
        PID:2504
      - C:\Users\Admin\Documents\W6KHGcFpQityc2Q1hbtOUwAA.exe
        
        "C:\Users\Admin\Documents\W6KHGcFpQityc2Q1hbtOUwAA.exe"
        6⤵
        
        PID:2492
      - C:\Users\Admin\Documents\xKRHuSfNK6qtilT8Tgpb7zz6.exe
        
        "C:\Users\Admin\Documents\xKRHuSfNK6qtilT8Tgpb7zz6.exe"
        6⤵
        
        PID:2480
      - C:\Users\Admin\Documents\4HO8cRZpT2dKflYKpt8PJozo.exe
        
        "C:\Users\Admin\Documents\4HO8cRZpT2dKflYKpt8PJozo.exe"
        6⤵
        
        PID:2468
      - C:\Users\Admin\Documents\QSkSs3aDK3dNd3vxNDg6UscL.exe
        
        "C:\Users\Admin\Documents\QSkSs3aDK3dNd3vxNDg6UscL.exe"
        6⤵
        
        PID:2456
      - C:\Users\Admin\Documents\zBbV3gfjgh3f54gGDLvrfrPM.exe
        
        "C:\Users\Admin\Documents\zBbV3gfjgh3f54gGDLvrfrPM.exe"
        6⤵
        
        PID:2444
      - C:\Users\Admin\Documents\IYkUVrcexiWjcTkIClovEsuG.exe
        
        "C:\Users\Admin\Documents\IYkUVrcexiWjcTkIClovEsuG.exe"
        6⤵
        
        PID:2432
      - C:\Users\Admin\Documents\DUnn3YJM3oQpjWiq2q74O9Mg.exe
        
        "C:\Users\Admin\Documents\DUnn3YJM3oQpjWiq2q74O9Mg.exe"
        6⤵
        
        PID:2420
      - C:\Users\Admin\Documents\VePsPViTDS4DnlGhRpMDZyET.exe
        
        "C:\Users\Admin\Documents\VePsPViTDS4DnlGhRpMDZyET.exe"
        6⤵
        
        PID:2408
      - C:\Users\Admin\Documents\Rgw0VKVgxSyqgzlIJ4a5vvBh.exe
        
        "C:\Users\Admin\Documents\Rgw0VKVgxSyqgzlIJ4a5vvBh.exe"
        6⤵
        
        PID:2396
      - C:\Users\Admin\Documents\TD3iGjwOiul65A48_X6domPl.exe
        
        "C:\Users\Admin\Documents\TD3iGjwOiul65A48_X6domPl.exe"
        6⤵
        
        PID:2380
      - C:\Users\Admin\Documents\UVXgcahDd4w8N4ag1O4Rgn1i.exe
        
        "C:\Users\Admin\Documents\UVXgcahDd4w8N4ag1O4Rgn1i.exe"
        6⤵
        
        PID:2372
      - C:\Users\Admin\Documents\2g81d5EVfMeTO4uqYO_bYPpo.exe
        
        "C:\Users\Admin\Documents\2g81d5EVfMeTO4uqYO_bYPpo.exe"
        6⤵
        
        PID:2360
      - C:\Users\Admin\Documents\l6JwCDYwPGhhe7QRA76Jcbnc.exe
        
        "C:\Users\Admin\Documents\l6JwCDYwPGhhe7QRA76Jcbnc.exe"
        6⤵
        
        PID:2348
      - C:\Users\Admin\Documents\AACkBAqjWDpFyBRNwso3ck4w.exe
        
        "C:\Users\Admin\Documents\AACkBAqjWDpFyBRNwso3ck4w.exe"
        6⤵
        
        PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri02f203cfd9edb7298.exe
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri023db71e8e.exe
      4⤵
      Loads dropped DLL
      PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri026b43c7db79.exe
      4⤵
      Loads dropped DLL
      PID:564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri024dbf9c992.exe
      4⤵
      Loads dropped DLL
      PID:856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri020e07c2f8aa8dd.exe
      4⤵
      PID:1264

C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri026b43c7db79.exe
Fri026b43c7db79.exe
1⤵
- Executes dropped EXE
PID:908

C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri024dbf9c992.exe
Fri024dbf9c992.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008
- C:\Users\Admin\AppData\Local\Temp\is-34MSB.tmp\Fri024dbf9c992.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-34MSB.tmp\Fri024dbf9c992.tmp" /SL5="$5001C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri024dbf9c992.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:520
- - C:\Users\Admin\AppData\Local\Temp\is-L1L12.tmp\zab2our.exe
    "C:\Users\Admin\AppData\Local\Temp\is-L1L12.tmp\zab2our.exe" /S /UID=burnerch2
    3⤵
    PID:1568

C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri023db71e8e.exe
Fri023db71e8e.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:576

C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri020e07c2f8aa8dd.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri020e07c2f8aa8dd.exe"
1⤵
- Executes dropped EXE
PID:1700

C:\Users\Admin\AppData\Local\Temp\7zS8877DE84\Fri020e07c2f8aa8dd.exe
Fri020e07c2f8aa8dd.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-181-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/576-195-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/736-60-0x0000000075891000-0x0000000075893000-memory.dmp

Download

memory/908-148-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/984-178-0x000000001B000000-0x000000001B002000-memory.dmp

Download

memory/984-165-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1008-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-184-0x0000000003B70000-0x0000000003B85000-memory.dmp

Download

memory/1264-180-0x0000000001E50000-0x0000000001E51000-memory.dmp

Download

memory/1564-191-0x0000000003F10000-0x000000000404F000-memory.dmp

Download

memory/1568-188-0x0000000000440000-0x0000000000442000-memory.dmp

Download

memory/1656-182-0x0000000000400000-0x00000000023AC000-memory.dmp

Download

memory/1656-183-0x0000000000240000-0x0000000000249000-memory.dmp

Download

memory/1720-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1720-119-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1720-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1720-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1720-114-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-117-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1720-118-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1720-116-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-115-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-112-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2480-226-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2504-219-0x0000000000880000-0x0000000000881000-memory.dmp

Download