Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    24-11-2021 11:32

General

  • Target

    f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a.exe

  • Size

    145KB

  • MD5

    75cbb6418064e427e7071c23c5b3e9ec

  • SHA1

    30ce348c413b4c2f28ae87b5323eb31bb09c2453

  • SHA256

    f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a

  • SHA512

    8fadac618f0cdd0761fcf65c8cd6c0935f6095a2d08831f481012c792d5b4257be7bd7648c78888b758dc222df938855fab30b7c20c89b2d32d91e56aefbca00

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

C2

185.159.80.90:38655

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a.exe
    "C:\Users\Admin\AppData\Local\Temp\f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a.exe
      "C:\Users\Admin\AppData\Local\Temp\f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3528
  • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
    C:\Users\Admin\AppData\Local\Temp\1AF6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
      C:\Users\Admin\AppData\Local\Temp\1AF6.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3420
  • C:\Users\Admin\AppData\Local\Temp\1E43.exe
    C:\Users\Admin\AppData\Local\Temp\1E43.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gttksmxz\
      2⤵
        PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\urchfpmj.exe" C:\Windows\SysWOW64\gttksmxz\
        2⤵
          PID:1664
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create gttksmxz binPath= "C:\Windows\SysWOW64\gttksmxz\urchfpmj.exe /d\"C:\Users\Admin\AppData\Local\Temp\1E43.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1008
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description gttksmxz "wifi internet conection"
            2⤵
              PID:3544
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start gttksmxz
              2⤵
                PID:2872
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3640
              • C:\Users\Admin\AppData\Local\Temp\2132.exe
                C:\Users\Admin\AppData\Local\Temp\2132.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:916
                • C:\Users\Admin\AppData\Local\Temp\2132.exe
                  C:\Users\Admin\AppData\Local\Temp\2132.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:912
              • C:\Windows\SysWOW64\gttksmxz\urchfpmj.exe
                C:\Windows\SysWOW64\gttksmxz\urchfpmj.exe /d"C:\Users\Admin\AppData\Local\Temp\1E43.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2328
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1752
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1732
              • C:\Users\Admin\AppData\Local\Temp\7B2A.exe
                C:\Users\Admin\AppData\Local\Temp\7B2A.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1240
              • C:\Users\Admin\AppData\Local\Temp\7D5E.exe
                C:\Users\Admin\AppData\Local\Temp\7D5E.exe
                1⤵
                • Executes dropped EXE
                PID:3860
              • C:\Users\Admin\AppData\Local\Temp\D63D.exe
                C:\Users\Admin\AppData\Local\Temp\D63D.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:3632
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D63D.exe" & exit
                  2⤵
                    PID:876
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:2260
                • C:\Users\Admin\AppData\Local\Temp\DCE5.exe
                  C:\Users\Admin\AppData\Local\Temp\DCE5.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3208

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Persistence

                New Service

                1
                T1050

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Privilege Escalation

                New Service

                1
                T1050

                Defense Evasion

                Disabling Security Tools

                1
                T1089

                Modify Registry

                2
                T1112

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                5
                T1012

                Virtualization/Sandbox Evasion

                1
                T1497

                System Information Discovery

                5
                T1082

                Peripheral Device Discovery

                1
                T1120

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2132.exe.log
                  MD5

                  41fbed686f5700fc29aaccf83e8ba7fd

                  SHA1

                  5271bc29538f11e42a3b600c8dc727186e912456

                  SHA256

                  df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                  SHA512

                  234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
                  MD5

                  75cbb6418064e427e7071c23c5b3e9ec

                  SHA1

                  30ce348c413b4c2f28ae87b5323eb31bb09c2453

                  SHA256

                  f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a

                  SHA512

                  8fadac618f0cdd0761fcf65c8cd6c0935f6095a2d08831f481012c792d5b4257be7bd7648c78888b758dc222df938855fab30b7c20c89b2d32d91e56aefbca00

                • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
                  MD5

                  75cbb6418064e427e7071c23c5b3e9ec

                  SHA1

                  30ce348c413b4c2f28ae87b5323eb31bb09c2453

                  SHA256

                  f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a

                  SHA512

                  8fadac618f0cdd0761fcf65c8cd6c0935f6095a2d08831f481012c792d5b4257be7bd7648c78888b758dc222df938855fab30b7c20c89b2d32d91e56aefbca00

                • C:\Users\Admin\AppData\Local\Temp\1AF6.exe
                  MD5

                  75cbb6418064e427e7071c23c5b3e9ec

                  SHA1

                  30ce348c413b4c2f28ae87b5323eb31bb09c2453

                  SHA256

                  f28f7a0d94df74ae02cf848e11037adc9bc9fceae45b28988cfcde5c71de920a

                  SHA512

                  8fadac618f0cdd0761fcf65c8cd6c0935f6095a2d08831f481012c792d5b4257be7bd7648c78888b758dc222df938855fab30b7c20c89b2d32d91e56aefbca00

                • C:\Users\Admin\AppData\Local\Temp\1E43.exe
                  MD5

                  fdbce9f32cbdc291e817f3fccd62a4e9

                  SHA1

                  bac2e1e8a0a1d5fe6f12435f7c1e45d1511d40a3

                  SHA256

                  ef428a6bbd984deb346cbf3faa7ebb77b2bc627174f6e4554b8d59a8c42795e5

                  SHA512

                  1a96c2e0b6a2a4cf2c1ea6068272b2ab88241a113eb7c27fbac820abf95fce398e529385c286e2f763bccb978413a162cd74f0799f43185edc8bce05c5a372b5

                • C:\Users\Admin\AppData\Local\Temp\1E43.exe
                  MD5

                  fdbce9f32cbdc291e817f3fccd62a4e9

                  SHA1

                  bac2e1e8a0a1d5fe6f12435f7c1e45d1511d40a3

                  SHA256

                  ef428a6bbd984deb346cbf3faa7ebb77b2bc627174f6e4554b8d59a8c42795e5

                  SHA512

                  1a96c2e0b6a2a4cf2c1ea6068272b2ab88241a113eb7c27fbac820abf95fce398e529385c286e2f763bccb978413a162cd74f0799f43185edc8bce05c5a372b5

                • C:\Users\Admin\AppData\Local\Temp\2132.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\2132.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\2132.exe
                  MD5

                  e850bf7dbab0575d6bcde28710be9192

                  SHA1

                  9d8c748670b02c2e01c6ad894cacd1dd27ba0814

                  SHA256

                  c5f10feca7a51c7e54414820d37ca533175a78465578b4b03c531c8422a16db0

                  SHA512

                  4f181a6e43fc116ad9b5c92b762d7609e620b57e3c19009fe88fbbc3a248495a042d4e92644e333c10cb5c774e5237a9e312690a8c98975a9af029ba85087352

                • C:\Users\Admin\AppData\Local\Temp\7B2A.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\7B2A.exe
                  MD5

                  03651bfa0fa57d86e5a612e0cc81bc09

                  SHA1

                  67738024bea02128f0d7a9939e193dc706bcd0d8

                  SHA256

                  48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

                  SHA512

                  b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

                • C:\Users\Admin\AppData\Local\Temp\7D5E.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\7D5E.exe
                  MD5

                  b25fdabef081394cfc659b7f9574e323

                  SHA1

                  84c00d9786f82767814033f70401cb193e0024c0

                  SHA256

                  ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

                  SHA512

                  42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

                • C:\Users\Admin\AppData\Local\Temp\D63D.exe
                  MD5

                  863c48cc3528d39087d06257c563afd5

                  SHA1

                  aba9e5d1ff500e6fc805f378544a001426f7a9f6

                  SHA256

                  98575b827467fd9f3612c475b4971ba9e47a07ce420f25ba2c90ff66308d82ad

                  SHA512

                  77a327c370af6cd3778991d922562373f540d66551aaf8147bc101654b6da3f2bda203b5e3c4d9d3150f1c726ff394b50756964e4aae9402d78fd0a9d9e4bf23

                • C:\Users\Admin\AppData\Local\Temp\D63D.exe
                  MD5

                  863c48cc3528d39087d06257c563afd5

                  SHA1

                  aba9e5d1ff500e6fc805f378544a001426f7a9f6

                  SHA256

                  98575b827467fd9f3612c475b4971ba9e47a07ce420f25ba2c90ff66308d82ad

                  SHA512

                  77a327c370af6cd3778991d922562373f540d66551aaf8147bc101654b6da3f2bda203b5e3c4d9d3150f1c726ff394b50756964e4aae9402d78fd0a9d9e4bf23

                • C:\Users\Admin\AppData\Local\Temp\DCE5.exe
                  MD5

                  5bb9ac32655956f1924110c7c9c7adc3

                  SHA1

                  922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                  SHA256

                  6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                  SHA512

                  86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

                • C:\Users\Admin\AppData\Local\Temp\DCE5.exe
                  MD5

                  5bb9ac32655956f1924110c7c9c7adc3

                  SHA1

                  922d06d96ab2138b8ff8b6c8f7605e2c0c1fb72b

                  SHA256

                  6b126592ce7ac410aa0c3e68ef95226ae15b02c36f416d74f8e3fc1ea3df7f9d

                  SHA512

                  86e529e7cc1b4ec583228a098dcd811deafb26be737a07b1fca0c4a8ba91f7dbef29569db5457f94c38a88e65e0e27406e3371da7118a220b78fb3c0f90de4f5

                • C:\Users\Admin\AppData\Local\Temp\urchfpmj.exe
                  MD5

                  0d6a88163028639a7bee52f245058203

                  SHA1

                  b20aaf52f828effab836e74216a704344b94d82b

                  SHA256

                  420f6a25d13861f1837ef1cca915a90c8595e71546b2c59a0280274e397eb1d8

                  SHA512

                  8e817d224e5718b13758d815e24c1a86e3a9a98aead6989bc853e4d6a50e91523047a5816cd613e7bf9ddf00779b7e8b7439e7d61afe837b0836ca78454ae40c

                • C:\Windows\SysWOW64\gttksmxz\urchfpmj.exe
                  MD5

                  0d6a88163028639a7bee52f245058203

                  SHA1

                  b20aaf52f828effab836e74216a704344b94d82b

                  SHA256

                  420f6a25d13861f1837ef1cca915a90c8595e71546b2c59a0280274e397eb1d8

                  SHA512

                  8e817d224e5718b13758d815e24c1a86e3a9a98aead6989bc853e4d6a50e91523047a5816cd613e7bf9ddf00779b7e8b7439e7d61afe837b0836ca78454ae40c

                • \ProgramData\mozglue.dll
                  MD5

                  8f73c08a9660691143661bf7332c3c27

                  SHA1

                  37fa65dd737c50fda710fdbde89e51374d0c204a

                  SHA256

                  3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                  SHA512

                  0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                • \ProgramData\nss3.dll
                  MD5

                  bfac4e3c5908856ba17d41edcd455a51

                  SHA1

                  8eec7e888767aa9e4cca8ff246eb2aacb9170428

                  SHA256

                  e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                  SHA512

                  2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                • \ProgramData\sqlite3.dll
                  MD5

                  e477a96c8f2b18d6b5c27bde49c990bf

                  SHA1

                  e980c9bf41330d1e5bd04556db4646a0210f7409

                  SHA256

                  16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                  SHA512

                  335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                • memory/876-277-0x0000000000000000-mapping.dmp
                • memory/912-167-0x0000000005030000-0x0000000005031000-memory.dmp
                  Filesize

                  4KB

                • memory/912-158-0x0000000000400000-0x0000000000420000-memory.dmp
                  Filesize

                  128KB

                • memory/912-176-0x0000000007250000-0x0000000007251000-memory.dmp
                  Filesize

                  4KB

                • memory/912-175-0x0000000006B50000-0x0000000006B51000-memory.dmp
                  Filesize

                  4KB

                • memory/912-173-0x0000000005F50000-0x0000000005F51000-memory.dmp
                  Filesize

                  4KB

                • memory/912-171-0x0000000005360000-0x0000000005361000-memory.dmp
                  Filesize

                  4KB

                • memory/912-169-0x0000000005070000-0x0000000005071000-memory.dmp
                  Filesize

                  4KB

                • memory/912-168-0x0000000004F90000-0x0000000005596000-memory.dmp
                  Filesize

                  6.0MB

                • memory/912-166-0x00000000050E0000-0x00000000050E1000-memory.dmp
                  Filesize

                  4KB

                • memory/912-165-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                  Filesize

                  4KB

                • memory/912-164-0x00000000055A0000-0x00000000055A1000-memory.dmp
                  Filesize

                  4KB

                • memory/912-159-0x0000000000418EEE-mapping.dmp
                • memory/916-130-0x0000000000000000-mapping.dmp
                • memory/916-139-0x0000000005570000-0x0000000005571000-memory.dmp
                  Filesize

                  4KB

                • memory/916-145-0x0000000005750000-0x0000000005751000-memory.dmp
                  Filesize

                  4KB

                • memory/916-146-0x0000000005C60000-0x0000000005C61000-memory.dmp
                  Filesize

                  4KB

                • memory/916-136-0x0000000000D70000-0x0000000000D71000-memory.dmp
                  Filesize

                  4KB

                • memory/916-142-0x0000000005540000-0x0000000005541000-memory.dmp
                  Filesize

                  4KB

                • memory/1008-143-0x0000000000000000-mapping.dmp
                • memory/1240-177-0x0000000000000000-mapping.dmp
                • memory/1240-192-0x0000000000400000-0x0000000001085000-memory.dmp
                  Filesize

                  12.5MB

                • memory/1240-191-0x0000000001090000-0x000000000113E000-memory.dmp
                  Filesize

                  696KB

                • memory/1664-140-0x0000000000000000-mapping.dmp
                • memory/1732-198-0x00000000008B259C-mapping.dmp
                • memory/1732-194-0x0000000000820000-0x0000000000911000-memory.dmp
                  Filesize

                  964KB

                • memory/1732-199-0x0000000000820000-0x0000000000911000-memory.dmp
                  Filesize

                  964KB

                • memory/1752-151-0x00000000001A9A6B-mapping.dmp
                • memory/1752-150-0x00000000001A0000-0x00000000001B5000-memory.dmp
                  Filesize

                  84KB

                • memory/1752-153-0x00000000000C0000-0x00000000000C1000-memory.dmp
                  Filesize

                  4KB

                • memory/1752-152-0x00000000000C0000-0x00000000000C1000-memory.dmp
                  Filesize

                  4KB

                • memory/1752-157-0x00000000001A0000-0x00000000001B5000-memory.dmp
                  Filesize

                  84KB

                • memory/2260-278-0x0000000000000000-mapping.dmp
                • memory/2328-155-0x0000000000440000-0x00000000004EE000-memory.dmp
                  Filesize

                  696KB

                • memory/2328-156-0x0000000000400000-0x0000000000431000-memory.dmp
                  Filesize

                  196KB

                • memory/2500-115-0x00000000004C0000-0x00000000004C8000-memory.dmp
                  Filesize

                  32KB

                • memory/2500-116-0x00000000004E0000-0x000000000058E000-memory.dmp
                  Filesize

                  696KB

                • memory/2584-138-0x0000000000000000-mapping.dmp
                • memory/2872-147-0x0000000000000000-mapping.dmp
                • memory/3056-119-0x0000000000790000-0x00000000007A6000-memory.dmp
                  Filesize

                  88KB

                • memory/3056-193-0x0000000002BD0000-0x0000000002BE6000-memory.dmp
                  Filesize

                  88KB

                • memory/3056-154-0x0000000002C00000-0x0000000002C16000-memory.dmp
                  Filesize

                  88KB

                • memory/3208-231-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-232-0x00000000026A0000-0x00000000026A1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-271-0x0000000007E50000-0x0000000007E51000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-259-0x00000000029B0000-0x00000000029B1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-260-0x0000000002650000-0x0000000002651000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-258-0x0000000002940000-0x0000000002941000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-257-0x0000000002950000-0x0000000002951000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-250-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-255-0x0000000002920000-0x0000000002921000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-254-0x0000000002970000-0x0000000002971000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-256-0x0000000002990000-0x0000000002991000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-253-0x0000000002960000-0x0000000002961000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-252-0x0000000002650000-0x0000000002651000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-251-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-249-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-206-0x0000000000000000-mapping.dmp
                • memory/3208-248-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-247-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-209-0x0000000000400000-0x0000000000816000-memory.dmp
                  Filesize

                  4.1MB

                • memory/3208-210-0x0000000000400000-0x0000000000402000-memory.dmp
                  Filesize

                  8KB

                • memory/3208-214-0x0000000000910000-0x0000000000A5A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/3208-217-0x00000000064D0000-0x00000000064D1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-216-0x00000000028B0000-0x00000000028B1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-219-0x00000000028C0000-0x00000000028C1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-220-0x0000000002870000-0x0000000002871000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-221-0x0000000006500000-0x0000000006501000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-223-0x00000000028A0000-0x00000000028A1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-224-0x0000000002890000-0x0000000002891000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-222-0x00000000028E0000-0x00000000028E1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-225-0x0000000002900000-0x0000000002901000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-227-0x00000000035A0000-0x00000000035A1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-226-0x00000000028D0000-0x00000000028D1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-229-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-228-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-230-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-246-0x0000000002850000-0x0000000002851000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-245-0x00000000027E0000-0x00000000027E1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-233-0x00000000026B0000-0x00000000026B1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-234-0x0000000002660000-0x0000000002661000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-235-0x0000000002680000-0x0000000002681000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-236-0x00000000026D0000-0x00000000026D1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-238-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-237-0x00000000026F0000-0x00000000026F1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-239-0x0000000003590000-0x0000000003591000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-240-0x0000000002800000-0x0000000002801000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-241-0x0000000002810000-0x0000000002811000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-242-0x00000000027C0000-0x00000000027C1000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-243-0x0000000002830000-0x0000000002831000-memory.dmp
                  Filesize

                  4KB

                • memory/3208-244-0x00000000027F0000-0x00000000027F1000-memory.dmp
                  Filesize

                  4KB

                • memory/3324-126-0x0000000000000000-mapping.dmp
                • memory/3324-133-0x0000000000520000-0x000000000052D000-memory.dmp
                  Filesize

                  52KB

                • memory/3324-134-0x0000000000530000-0x0000000000543000-memory.dmp
                  Filesize

                  76KB

                • memory/3324-135-0x0000000000400000-0x0000000000431000-memory.dmp
                  Filesize

                  196KB

                • memory/3420-124-0x0000000000402DC6-mapping.dmp
                • memory/3528-117-0x0000000000400000-0x0000000000408000-memory.dmp
                  Filesize

                  32KB

                • memory/3528-118-0x0000000000402DC6-mapping.dmp
                • memory/3544-144-0x0000000000000000-mapping.dmp
                • memory/3632-205-0x0000000000400000-0x0000000000437000-memory.dmp
                  Filesize

                  220KB

                • memory/3632-204-0x0000000000440000-0x000000000058A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/3632-203-0x0000000000440000-0x000000000058A000-memory.dmp
                  Filesize

                  1.3MB

                • memory/3632-200-0x0000000000000000-mapping.dmp
                • memory/3640-148-0x0000000000000000-mapping.dmp
                • memory/3860-185-0x00000000009B0000-0x00000000009CB000-memory.dmp
                  Filesize

                  108KB

                • memory/3860-186-0x000000001AE60000-0x000000001AE62000-memory.dmp
                  Filesize

                  8KB

                • memory/3860-187-0x000000001C710000-0x000000001C711000-memory.dmp
                  Filesize

                  4KB

                • memory/3860-189-0x0000000002450000-0x0000000002451000-memory.dmp
                  Filesize

                  4KB

                • memory/3860-183-0x0000000000260000-0x0000000000261000-memory.dmp
                  Filesize

                  4KB

                • memory/3860-180-0x0000000000000000-mapping.dmp
                • memory/3860-188-0x00000000009F0000-0x00000000009F1000-memory.dmp
                  Filesize

                  4KB

                • memory/3936-120-0x0000000000000000-mapping.dmp
                • memory/3936-129-0x0000000000490000-0x0000000000499000-memory.dmp
                  Filesize

                  36KB