Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    24-11-2021 07:31

General

  • Target

    03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a.exe

  • Size

    149KB

  • MD5

    bbdb309dc15cabc3700ac19265d7ad5b

  • SHA1

    79136f36244266c766190dcabfb865887492c274

  • SHA256

    03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a

  • SHA512

    d2aba73a45303251f07a515857575106bc2eb81b895fee77a29729a7458338c54134ff1682efe7e150468fc3240ddb1c08f3375e0fb7ce040ff7f697db194dcf

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a.exe
    "C:\Users\Admin\AppData\Local\Temp\03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Users\Admin\AppData\Local\Temp\03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a.exe
      "C:\Users\Admin\AppData\Local\Temp\03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2120
  • C:\Users\Admin\AppData\Local\Temp\F4B1.exe
    C:\Users\Admin\AppData\Local\Temp\F4B1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Users\Admin\AppData\Local\Temp\F4B1.exe
      C:\Users\Admin\AppData\Local\Temp\F4B1.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4200
  • C:\Users\Admin\AppData\Local\Temp\F83D.exe
    C:\Users\Admin\AppData\Local\Temp\F83D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ufpmpyks\
      2⤵
        PID:500
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jyzfsdxw.exe" C:\Windows\SysWOW64\ufpmpyks\
        2⤵
          PID:700
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ufpmpyks binPath= "C:\Windows\SysWOW64\ufpmpyks\jyzfsdxw.exe /d\"C:\Users\Admin\AppData\Local\Temp\F83D.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1276
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ufpmpyks "wifi internet conection"
            2⤵
              PID:1608
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ufpmpyks
              2⤵
                PID:1888
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2432
              • C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                  C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1408
              • C:\Windows\SysWOW64\ufpmpyks\jyzfsdxw.exe
                C:\Windows\SysWOW64\ufpmpyks\jyzfsdxw.exe /d"C:\Users\Admin\AppData\Local\Temp\F83D.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2292
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2656
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4856
              • C:\Users\Admin\AppData\Local\Temp\54D6.exe
                C:\Users\Admin\AppData\Local\Temp\54D6.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:5056
              • C:\Users\Admin\AppData\Local\Temp\58AF.exe
                C:\Users\Admin\AppData\Local\Temp\58AF.exe
                1⤵
                • Executes dropped EXE
                PID:2624
              • C:\Users\Admin\AppData\Local\Temp\68DD.exe
                C:\Users\Admin\AppData\Local\Temp\68DD.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2572
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\68DD.exe" & exit
                  2⤵
                    PID:1708
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2280
                • C:\Users\Admin\AppData\Local\Temp\6F08.exe
                  C:\Users\Admin\AppData\Local\Temp\6F08.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5012

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Disabling Security Tools

                1
                T1089

                Modify Registry

                2
                T1112

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                5
                T1012

                Virtualization/Sandbox Evasion

                1
                T1497

                System Information Discovery

                5
                T1082

                Peripheral Device Discovery

                1
                T1120

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FB4B.exe.log
                  MD5

                  41fbed686f5700fc29aaccf83e8ba7fd

                  SHA1

                  5271bc29538f11e42a3b600c8dc727186e912456

                  SHA256

                  df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                  SHA512

                  234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                • C:\Users\Admin\AppData\Local\Temp\54D6.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\54D6.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\58AF.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\58AF.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\68DD.exe
                  MD5

                  0dc91c0ecc95c74ab9e92ac8b17c39a1

                  SHA1

                  b7d35f3a3f3d1a4fdb188825ad9a186b2c042b23

                  SHA256

                  9416c974ce9c14988fbab8b40ec9cd42a475c462cf6c505be72a20223a73a790

                  SHA512

                  6fcea767d406908a22e2a26a0eaead2066e08e26cd48e4667fcf14566d23f95c9b505be5f776a950ec9c7e6c9efae4aff4b0e3e07e8a3de0dc5d7f5a50681b5d

                • C:\Users\Admin\AppData\Local\Temp\68DD.exe
                  MD5

                  0dc91c0ecc95c74ab9e92ac8b17c39a1

                  SHA1

                  b7d35f3a3f3d1a4fdb188825ad9a186b2c042b23

                  SHA256

                  9416c974ce9c14988fbab8b40ec9cd42a475c462cf6c505be72a20223a73a790

                  SHA512

                  6fcea767d406908a22e2a26a0eaead2066e08e26cd48e4667fcf14566d23f95c9b505be5f776a950ec9c7e6c9efae4aff4b0e3e07e8a3de0dc5d7f5a50681b5d

                • C:\Users\Admin\AppData\Local\Temp\6F08.exe
                  MD5

                  5bb9ac32655956f1924110c7c9c7adc3

                  SHA1

                  922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                  SHA256

                  6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                  SHA512

                  86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

                • C:\Users\Admin\AppData\Local\Temp\6F08.exe
                  MD5

                  5bb9ac32655956f1924110c7c9c7adc3

                  SHA1

                  922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                  SHA256

                  6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                  SHA512

                  86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

                • C:\Users\Admin\AppData\Local\Temp\F4B1.exe
                  MD5

                  bbdb309dc15cabc3700ac19265d7ad5b

                  SHA1

                  79136f36244266c766190dcabfb865887492c274

                  SHA256

                  03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a

                  SHA512

                  d2aba73a45303251f07a515857575106bc2eb81b895fee77a29729a7458338c54134ff1682efe7e150468fc3240ddb1c08f3375e0fb7ce040ff7f697db194dcf

                • C:\Users\Admin\AppData\Local\Temp\F4B1.exe
                  MD5

                  bbdb309dc15cabc3700ac19265d7ad5b

                  SHA1

                  79136f36244266c766190dcabfb865887492c274

                  SHA256

                  03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a

                  SHA512

                  d2aba73a45303251f07a515857575106bc2eb81b895fee77a29729a7458338c54134ff1682efe7e150468fc3240ddb1c08f3375e0fb7ce040ff7f697db194dcf

                • C:\Users\Admin\AppData\Local\Temp\F4B1.exe
                  MD5

                  bbdb309dc15cabc3700ac19265d7ad5b

                  SHA1

                  79136f36244266c766190dcabfb865887492c274

                  SHA256

                  03ff31fda371429cec0fcc54529d5fee1a76ac75556cba8fbdbd0922d709ed7a

                  SHA512

                  d2aba73a45303251f07a515857575106bc2eb81b895fee77a29729a7458338c54134ff1682efe7e150468fc3240ddb1c08f3375e0fb7ce040ff7f697db194dcf

                • C:\Users\Admin\AppData\Local\Temp\F83D.exe
                  MD5

                  116ae2472ad1e10e67604e5a13f6060e

                  SHA1

                  ad19eb42b725675303bee9c6f1fff4d86797ca33

                  SHA256

                  c38d66b2bfc00d99915cf4c76454745360dd2eb1dedfd63474e57d2dce812316

                  SHA512

                  d3a5d9c8a0c0e7129cdb13e69d4af43ab1d0a8aeef00f08c2070cbeed379f2a2f04652190f879f7f987649fc6f544a074a921acd2700e7bd5cd3bd7d70504f11

                • C:\Users\Admin\AppData\Local\Temp\F83D.exe
                  MD5

                  116ae2472ad1e10e67604e5a13f6060e

                  SHA1

                  ad19eb42b725675303bee9c6f1fff4d86797ca33

                  SHA256

                  c38d66b2bfc00d99915cf4c76454745360dd2eb1dedfd63474e57d2dce812316

                  SHA512

                  d3a5d9c8a0c0e7129cdb13e69d4af43ab1d0a8aeef00f08c2070cbeed379f2a2f04652190f879f7f987649fc6f544a074a921acd2700e7bd5cd3bd7d70504f11

                • C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\FB4B.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\jyzfsdxw.exe
                  MD5

                  351d2f84aa9935b56682fccd7fd4407a

                  SHA1

                  1fa5c77c76f57242282ea207f5b32885424b188f

                  SHA256

                  c570c80cf49c2cb5fbe0c811256dcf5c47d32b424bf3777e4d534437d0523e94

                  SHA512

                  c0fea4e14cf88d88b76d76cc467ee2568c9f33cd5cba899c92dd4a741411e0b354fcb4087f0b37398b162666a1cb8c0c509b48b1ae3e2aaaae50311f713cfe76

                • C:\Windows\SysWOW64\ufpmpyks\jyzfsdxw.exe
                  MD5

                  351d2f84aa9935b56682fccd7fd4407a

                  SHA1

                  1fa5c77c76f57242282ea207f5b32885424b188f

                  SHA256

                  c570c80cf49c2cb5fbe0c811256dcf5c47d32b424bf3777e4d534437d0523e94

                  SHA512

                  c0fea4e14cf88d88b76d76cc467ee2568c9f33cd5cba899c92dd4a741411e0b354fcb4087f0b37398b162666a1cb8c0c509b48b1ae3e2aaaae50311f713cfe76

                • \ProgramData\mozglue.dll
                  MD5

                  8f73c08a9660691143661bf7332c3c27

                  SHA1

                  37fa65dd737c50fda710fdbde89e51374d0c204a

                  SHA256

                  3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                  SHA512

                  0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                • \ProgramData\nss3.dll
                  MD5

                  bfac4e3c5908856ba17d41edcd455a51

                  SHA1

                  8eec7e888767aa9e4cca8ff246eb2aacb9170428

                  SHA256

                  e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                  SHA512

                  2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                • \ProgramData\sqlite3.dll
                  MD5

                  e477a96c8f2b18d6b5c27bde49c990bf

                  SHA1

                  e980c9bf41330d1e5bd04556db4646a0210f7409

                  SHA256

                  16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                  SHA512

                  335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                • memory/500-136-0x0000000000000000-mapping.dmp
                • memory/700-144-0x0000000000000000-mapping.dmp
                • memory/1276-147-0x0000000000000000-mapping.dmp
                • memory/1408-168-0x0000000005840000-0x0000000005841000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-160-0x0000000000418EEE-mapping.dmp
                • memory/1408-170-0x00000000057B0000-0x00000000057B1000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-169-0x0000000005770000-0x0000000005771000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-159-0x0000000000400000-0x0000000000420000-memory.dmp
                  Filesize

                  128KB

                • memory/1408-172-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-171-0x0000000005730000-0x0000000005D36000-memory.dmp
                  Filesize

                  6.0MB

                • memory/1408-167-0x0000000001A30000-0x0000000001A31000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-175-0x0000000006640000-0x0000000006641000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-166-0x0000000005D40000-0x0000000005D41000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-183-0x00000000071E0000-0x00000000071E1000-memory.dmp
                  Filesize

                  4KB

                • memory/1408-184-0x00000000078E0000-0x00000000078E1000-memory.dmp
                  Filesize

                  4KB

                • memory/1608-149-0x0000000000000000-mapping.dmp
                • memory/1708-279-0x0000000000000000-mapping.dmp
                • memory/1836-140-0x0000000000530000-0x0000000000543000-memory.dmp
                  Filesize

                  76KB

                • memory/1836-139-0x0000000000520000-0x000000000052D000-memory.dmp
                  Filesize

                  52KB

                • memory/1836-129-0x0000000000000000-mapping.dmp
                • memory/1836-141-0x0000000000400000-0x0000000000431000-memory.dmp
                  Filesize

                  196KB

                • memory/1888-150-0x0000000000000000-mapping.dmp
                • memory/2120-118-0x0000000000400000-0x0000000000408000-memory.dmp
                  Filesize

                  32KB

                • memory/2120-119-0x0000000000402DC6-mapping.dmp
                • memory/2280-280-0x0000000000000000-mapping.dmp
                • memory/2292-157-0x0000000000400000-0x0000000000431000-memory.dmp
                  Filesize

                  196KB

                • memory/2432-152-0x0000000000000000-mapping.dmp
                • memory/2572-199-0x0000000000000000-mapping.dmp
                • memory/2572-206-0x0000000000400000-0x0000000000438000-memory.dmp
                  Filesize

                  224KB

                • memory/2572-204-0x0000000002020000-0x0000000002033000-memory.dmp
                  Filesize

                  76KB

                • memory/2572-205-0x0000000002040000-0x0000000002061000-memory.dmp
                  Filesize

                  132KB

                • memory/2624-188-0x0000000000000000-mapping.dmp
                • memory/2624-194-0x000000001BC40000-0x000000001BC41000-memory.dmp
                  Filesize

                  4KB

                • memory/2624-193-0x00000000016C0000-0x00000000016DB000-memory.dmp
                  Filesize

                  108KB

                • memory/2624-191-0x0000000000F70000-0x0000000000F71000-memory.dmp
                  Filesize

                  4KB

                • memory/2624-195-0x0000000001700000-0x0000000001701000-memory.dmp
                  Filesize

                  4KB

                • memory/2624-196-0x0000000001720000-0x0000000001722000-memory.dmp
                  Filesize

                  8KB

                • memory/2624-197-0x000000001B9B0000-0x000000001B9B1000-memory.dmp
                  Filesize

                  4KB

                • memory/2656-153-0x0000000000960000-0x0000000000975000-memory.dmp
                  Filesize

                  84KB

                • memory/2656-156-0x0000000000870000-0x0000000000871000-memory.dmp
                  Filesize

                  4KB

                • memory/2656-154-0x0000000000969A6B-mapping.dmp
                • memory/2656-155-0x0000000000870000-0x0000000000871000-memory.dmp
                  Filesize

                  4KB

                • memory/2656-158-0x0000000000960000-0x0000000000975000-memory.dmp
                  Filesize

                  84KB

                • memory/2716-122-0x0000000000660000-0x0000000000676000-memory.dmp
                  Filesize

                  88KB

                • memory/2716-165-0x0000000002700000-0x0000000002716000-memory.dmp
                  Filesize

                  88KB

                • memory/3084-146-0x0000000005C70000-0x0000000005C71000-memory.dmp
                  Filesize

                  4KB

                • memory/3084-142-0x0000000005620000-0x0000000005621000-memory.dmp
                  Filesize

                  4KB

                • memory/3084-133-0x0000000000000000-mapping.dmp
                • memory/3084-148-0x0000000005760000-0x0000000005761000-memory.dmp
                  Filesize

                  4KB

                • memory/3084-137-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                  Filesize

                  4KB

                • memory/3084-143-0x0000000003160000-0x0000000003161000-memory.dmp
                  Filesize

                  4KB

                • memory/3612-120-0x0000000000550000-0x0000000000558000-memory.dmp
                  Filesize

                  32KB

                • memory/3612-121-0x0000000000560000-0x0000000000569000-memory.dmp
                  Filesize

                  36KB

                • memory/4200-127-0x0000000000402DC6-mapping.dmp
                • memory/4232-132-0x0000000000530000-0x000000000067A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/4232-123-0x0000000000000000-mapping.dmp
                • memory/4856-176-0x00000000004F0000-0x00000000005E1000-memory.dmp
                  Filesize

                  964KB

                • memory/4856-182-0x00000000004F0000-0x00000000005E1000-memory.dmp
                  Filesize

                  964KB

                • memory/4856-180-0x000000000058259C-mapping.dmp
                • memory/5012-234-0x0000000002540000-0x0000000002541000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-243-0x0000000002820000-0x0000000002821000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-219-0x0000000006520000-0x0000000006521000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-220-0x00000000028B0000-0x00000000028B1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-218-0x00000000028A0000-0x00000000028A1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-221-0x0000000002860000-0x0000000002861000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-222-0x00000000028D0000-0x00000000028D1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-223-0x0000000002890000-0x0000000002891000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-224-0x0000000002880000-0x0000000002881000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-225-0x00000000028F0000-0x00000000028F1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-226-0x00000000028C0000-0x00000000028C1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-229-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-227-0x00000000035A0000-0x00000000035A1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-228-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-230-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-232-0x0000000002580000-0x0000000002581000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-207-0x0000000000000000-mapping.dmp
                • memory/5012-233-0x0000000002590000-0x0000000002591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-235-0x0000000002560000-0x0000000002561000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-231-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-236-0x00000000025B0000-0x00000000025B1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-238-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-237-0x00000000025D0000-0x00000000025D1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-239-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-240-0x00000000027F0000-0x00000000027F1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-241-0x0000000002800000-0x0000000002801000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-242-0x00000000027B0000-0x00000000027B1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-217-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                  Filesize

                  384KB

                • memory/5012-245-0x00000000027D0000-0x00000000027D1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-246-0x0000000002840000-0x0000000002841000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-247-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-248-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-249-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-250-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-244-0x00000000027E0000-0x00000000027E1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-251-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-252-0x0000000000C30000-0x0000000000C31000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-253-0x0000000002960000-0x0000000002961000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-254-0x0000000002970000-0x0000000002971000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-255-0x0000000002920000-0x0000000002921000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-256-0x0000000002990000-0x0000000002991000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-257-0x0000000002950000-0x0000000002951000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-258-0x0000000002940000-0x0000000002941000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-259-0x00000000029B0000-0x00000000029B1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-260-0x0000000000C30000-0x0000000000C31000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-261-0x0000000000C30000-0x0000000000C31000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-262-0x00000000029A0000-0x00000000029A1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-263-0x00000000025E0000-0x00000000025E1000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-273-0x0000000007D00000-0x0000000007D01000-memory.dmp
                  Filesize

                  4KB

                • memory/5012-211-0x0000000000400000-0x0000000000402000-memory.dmp
                  Filesize

                  8KB

                • memory/5012-210-0x0000000000400000-0x0000000000816000-memory.dmp
                  Filesize

                  4.1MB

                • memory/5056-185-0x0000000000000000-mapping.dmp
                • memory/5056-202-0x00000000010E0000-0x00000000010E9000-memory.dmp
                  Filesize

                  36KB

                • memory/5056-203-0x0000000000400000-0x0000000001085000-memory.dmp
                  Filesize

                  12.5MB