Analysis

  • max time kernel
    4265101s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    16-01-2022 07:52

General

  • Target

    a6cfb10c2d19aedfd94c7ebe64af00d7.exe

  • Size

    314KB

  • MD5

    a6cfb10c2d19aedfd94c7ebe64af00d7

  • SHA1

    9fa9b28e838755df366aa41458b5f60945c1aae3

  • SHA256

    e616d1a92bc5df7b90a71d524de68db2bffb1e5a59d7dfa273ed7f2b68611852

  • SHA512

    c1779bf1873e085afa0a4ccf56ecf7c3e9c72612611c9b3b063b57f6f269f084b04fc88568f443a16cae017157ba53ade8e488c9de24cd5640e84d1c0c6fd2a4

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6cfb10c2d19aedfd94c7ebe64af00d7.exe
    "C:\Users\Admin\AppData\Local\Temp\a6cfb10c2d19aedfd94c7ebe64af00d7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\a6cfb10c2d19aedfd94c7ebe64af00d7.exe
      "C:\Users\Admin\AppData\Local\Temp\a6cfb10c2d19aedfd94c7ebe64af00d7.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2928
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Users\Admin\AppData\Local\Temp\175E.exe
    C:\Users\Admin\AppData\Local\Temp\175E.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:560
  • C:\Users\Admin\AppData\Local\Temp\1CBE.exe
    C:\Users\Admin\AppData\Local\Temp\1CBE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:312
    • C:\Users\Admin\AppData\Local\Temp\1CBE.exe
      C:\Users\Admin\AppData\Local\Temp\1CBE.exe
      2⤵
      • Executes dropped EXE
      PID:3908
  • C:\Users\Admin\AppData\Local\Temp\2EFF.exe
    C:\Users\Admin\AppData\Local\Temp\2EFF.exe
    1⤵
    • Executes dropped EXE
    PID:2660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 556
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3832
  • C:\Users\Admin\AppData\Local\Temp\321C.exe
    C:\Users\Admin\AppData\Local\Temp\321C.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rqnvfyok\
      2⤵
        PID:1228
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zpzbnwns.exe" C:\Windows\SysWOW64\rqnvfyok\
        2⤵
          PID:3468
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create rqnvfyok binPath= "C:\Windows\SysWOW64\rqnvfyok\zpzbnwns.exe /d\"C:\Users\Admin\AppData\Local\Temp\321C.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1700
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description rqnvfyok "wifi internet conection"
            2⤵
              PID:2192
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start rqnvfyok
              2⤵
                PID:2848
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3388
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1048
                  2⤵
                  • Program crash
                  PID:2344
              • C:\Users\Admin\AppData\Local\Temp\33B4.exe
                C:\Users\Admin\AppData\Local\Temp\33B4.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1316
                • C:\Users\Admin\AppData\Local\Temp\33B4.exe
                  C:\Users\Admin\AppData\Local\Temp\33B4.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3592
              • C:\Windows\SysWOW64\rqnvfyok\zpzbnwns.exe
                C:\Windows\SysWOW64\rqnvfyok\zpzbnwns.exe /d"C:\Users\Admin\AppData\Local\Temp\321C.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2304
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:376
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3624
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 512
                  2⤵
                  • Program crash
                  PID:812
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 828 -ip 828
                1⤵
                  PID:2396
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2304 -ip 2304
                  1⤵
                    PID:1200
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2660 -ip 2660
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:520
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:3252
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 876
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:3628
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3252 -ip 3252
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      PID:2740
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:3644
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                        1⤵
                          PID:1840
                        • C:\Users\Admin\AppData\Local\Temp\982B.exe
                          C:\Users\Admin\AppData\Local\Temp\982B.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3188
                        • C:\Users\Admin\AppData\Local\Temp\A0F6.exe
                          C:\Users\Admin\AppData\Local\Temp\A0F6.exe
                          1⤵
                          • Executes dropped EXE
                          PID:1056
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 444
                            2⤵
                            • Program crash
                            PID:2592
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 464
                            2⤵
                            • Program crash
                            PID:1708
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1056 -ip 1056
                          1⤵
                            PID:2680
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1056 -ip 1056
                            1⤵
                              PID:2920
                            • C:\Users\Admin\AppData\Local\Temp\AEA3.exe
                              C:\Users\Admin\AppData\Local\Temp\AEA3.exe
                              1⤵
                                PID:3468

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\33B4.exe.log
                                MD5

                                e5352797047ad2c91b83e933b24fbc4f

                                SHA1

                                9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

                                SHA256

                                b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

                                SHA512

                                dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

                              • C:\Users\Admin\AppData\Local\Temp\175E.exe
                                MD5

                                277680bd3182eb0940bc356ff4712bef

                                SHA1

                                5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                SHA256

                                f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                SHA512

                                0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                              • C:\Users\Admin\AppData\Local\Temp\175E.exe
                                MD5

                                277680bd3182eb0940bc356ff4712bef

                                SHA1

                                5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                SHA256

                                f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                SHA512

                                0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                              • C:\Users\Admin\AppData\Local\Temp\1CBE.exe
                                MD5

                                a6cfb10c2d19aedfd94c7ebe64af00d7

                                SHA1

                                9fa9b28e838755df366aa41458b5f60945c1aae3

                                SHA256

                                e616d1a92bc5df7b90a71d524de68db2bffb1e5a59d7dfa273ed7f2b68611852

                                SHA512

                                c1779bf1873e085afa0a4ccf56ecf7c3e9c72612611c9b3b063b57f6f269f084b04fc88568f443a16cae017157ba53ade8e488c9de24cd5640e84d1c0c6fd2a4

                              • C:\Users\Admin\AppData\Local\Temp\1CBE.exe
                                MD5

                                a6cfb10c2d19aedfd94c7ebe64af00d7

                                SHA1

                                9fa9b28e838755df366aa41458b5f60945c1aae3

                                SHA256

                                e616d1a92bc5df7b90a71d524de68db2bffb1e5a59d7dfa273ed7f2b68611852

                                SHA512

                                c1779bf1873e085afa0a4ccf56ecf7c3e9c72612611c9b3b063b57f6f269f084b04fc88568f443a16cae017157ba53ade8e488c9de24cd5640e84d1c0c6fd2a4

                              • C:\Users\Admin\AppData\Local\Temp\1CBE.exe
                                MD5

                                a6cfb10c2d19aedfd94c7ebe64af00d7

                                SHA1

                                9fa9b28e838755df366aa41458b5f60945c1aae3

                                SHA256

                                e616d1a92bc5df7b90a71d524de68db2bffb1e5a59d7dfa273ed7f2b68611852

                                SHA512

                                c1779bf1873e085afa0a4ccf56ecf7c3e9c72612611c9b3b063b57f6f269f084b04fc88568f443a16cae017157ba53ade8e488c9de24cd5640e84d1c0c6fd2a4

                              • C:\Users\Admin\AppData\Local\Temp\2EFF.exe
                                MD5

                                64337e7a8d0fdf5876addbbf11d0df35

                                SHA1

                                c9d674c645dd9702981dce806a2b02ece2d5ed6f

                                SHA256

                                39a54036eed2e087969a6a2077680ff1515af1c46d489107386ed661257d606e

                                SHA512

                                931c2efb82ed0ee57831771aa75fa51accdf6d63141aebbcad622c25a6cdd5005f6cafb374de22af2ec280131153f380e49b7048be7c044c6749fcf6c8b02668

                              • C:\Users\Admin\AppData\Local\Temp\2EFF.exe
                                MD5

                                64337e7a8d0fdf5876addbbf11d0df35

                                SHA1

                                c9d674c645dd9702981dce806a2b02ece2d5ed6f

                                SHA256

                                39a54036eed2e087969a6a2077680ff1515af1c46d489107386ed661257d606e

                                SHA512

                                931c2efb82ed0ee57831771aa75fa51accdf6d63141aebbcad622c25a6cdd5005f6cafb374de22af2ec280131153f380e49b7048be7c044c6749fcf6c8b02668

                              • C:\Users\Admin\AppData\Local\Temp\321C.exe
                                MD5

                                51cf3b114f6a4a61113903d00a9efd01

                                SHA1

                                cfcf9a41683836644a9e2a6fa0ae3ad93e0f1ff8

                                SHA256

                                199d188dcbbda8d52aab7cc5bfc3b7e94543538f2f770afbce787d24ac7db481

                                SHA512

                                a75e6bec4123b42b3f1542b1def20b637a803e22ca46c78bb68030675bf43182fd1ccfc0addef2ea600506ede6d066ada67bba2d05ad219eb5c2ab64100d35e6

                              • C:\Users\Admin\AppData\Local\Temp\321C.exe
                                MD5

                                51cf3b114f6a4a61113903d00a9efd01

                                SHA1

                                cfcf9a41683836644a9e2a6fa0ae3ad93e0f1ff8

                                SHA256

                                199d188dcbbda8d52aab7cc5bfc3b7e94543538f2f770afbce787d24ac7db481

                                SHA512

                                a75e6bec4123b42b3f1542b1def20b637a803e22ca46c78bb68030675bf43182fd1ccfc0addef2ea600506ede6d066ada67bba2d05ad219eb5c2ab64100d35e6

                              • C:\Users\Admin\AppData\Local\Temp\33B4.exe
                                MD5

                                29e5d8cbcf13639096bf1353b5f9f48b

                                SHA1

                                800629d06593b7fb232a2dfd08384c4349f37382

                                SHA256

                                ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                SHA512

                                3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                              • C:\Users\Admin\AppData\Local\Temp\33B4.exe
                                MD5

                                29e5d8cbcf13639096bf1353b5f9f48b

                                SHA1

                                800629d06593b7fb232a2dfd08384c4349f37382

                                SHA256

                                ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                SHA512

                                3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                              • C:\Users\Admin\AppData\Local\Temp\33B4.exe
                                MD5

                                29e5d8cbcf13639096bf1353b5f9f48b

                                SHA1

                                800629d06593b7fb232a2dfd08384c4349f37382

                                SHA256

                                ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                SHA512

                                3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                              • C:\Users\Admin\AppData\Local\Temp\982B.exe
                                MD5

                                915bd307888a7f7d29ffc766ee090f0c

                                SHA1

                                f9661d4e4deaa07932b91972102702b6d5a5098f

                                SHA256

                                446152687224ac1c2fe9d55943346ac6b35272965a6990e68d1ceb38bfb5a1d7

                                SHA512

                                ddf424d5c5d923f1bc71f1614a25ebbe6c8f673ac90bbf43e7c8424d0c9688a964a98cfefcffd6a40c7ca099a6c9cbf5dedfbb617f0a9c4dd74c599b43ee1eaf

                              • C:\Users\Admin\AppData\Local\Temp\982B.exe
                                MD5

                                915bd307888a7f7d29ffc766ee090f0c

                                SHA1

                                f9661d4e4deaa07932b91972102702b6d5a5098f

                                SHA256

                                446152687224ac1c2fe9d55943346ac6b35272965a6990e68d1ceb38bfb5a1d7

                                SHA512

                                ddf424d5c5d923f1bc71f1614a25ebbe6c8f673ac90bbf43e7c8424d0c9688a964a98cfefcffd6a40c7ca099a6c9cbf5dedfbb617f0a9c4dd74c599b43ee1eaf

                              • C:\Users\Admin\AppData\Local\Temp\A0F6.exe
                                MD5

                                c6ced700cc5fba7b4448ee685c865528

                                SHA1

                                fcd4e821581955c87c75b28d49e37aa564cfade5

                                SHA256

                                0067d9fcdd6c8ddbbe72c414d222972ee42aa8198c22d73c73834656fac03a7a

                                SHA512

                                58e72801c39ccf8a1880518ddf3927d3e604250433a60d6e396018eec942e82829819f675de86a21399935a20efc92993072b3fcb595ebdc677b7f9a40a3dd28

                              • C:\Users\Admin\AppData\Local\Temp\A0F6.exe
                                MD5

                                37173ac146ee461c380746bc1c1146f5

                                SHA1

                                e6d8ee9364a258c75d9b3bff151cd261d6011b0d

                                SHA256

                                b31918d42f25e750cb057db72ed7593dcac67ad5fcc0e302d5843a2318ad6052

                                SHA512

                                fc20bdca12b5c9b55c1c064f6e9793587ed8d0696be9b93ffa5a71c47635a18dccd516d438fbc26671f62c15a7429898f75a55e3d68dcadfbb44b6dfb5877f46

                              • C:\Users\Admin\AppData\Local\Temp\zpzbnwns.exe
                                MD5

                                45b687e5346e8f4e483c36905e845423

                                SHA1

                                8bf0dcc4d986b447537f416e9b75a31232611abd

                                SHA256

                                ba0fe48cc46f58ec4e9e782258d76e802f471384092a74f56a1430cc82d5a043

                                SHA512

                                3205e2c1ba37211ab4cebeeab8e46daab740b4103cb10643ac2f2ba7398b18761ffacc30144fd3db83a0a28d581214660d0b1cf37fffb432e0379ec7e0e02a68

                              • C:\Windows\SysWOW64\rqnvfyok\zpzbnwns.exe
                                MD5

                                45b687e5346e8f4e483c36905e845423

                                SHA1

                                8bf0dcc4d986b447537f416e9b75a31232611abd

                                SHA256

                                ba0fe48cc46f58ec4e9e782258d76e802f471384092a74f56a1430cc82d5a043

                                SHA512

                                3205e2c1ba37211ab4cebeeab8e46daab740b4103cb10643ac2f2ba7398b18761ffacc30144fd3db83a0a28d581214660d0b1cf37fffb432e0379ec7e0e02a68

                              • memory/312-141-0x000000000056D000-0x000000000057D000-memory.dmp
                                Filesize

                                64KB

                              • memory/312-138-0x0000000000000000-mapping.dmp
                              • memory/376-181-0x00000000005D0000-0x00000000005E5000-memory.dmp
                                Filesize

                                84KB

                              • memory/376-213-0x0000000003B70000-0x0000000003B80000-memory.dmp
                                Filesize

                                64KB

                              • memory/376-180-0x0000000000000000-mapping.dmp
                              • memory/376-182-0x00000000004F0000-0x00000000004F1000-memory.dmp
                                Filesize

                                4KB

                              • memory/376-183-0x00000000004F0000-0x00000000004F1000-memory.dmp
                                Filesize

                                4KB

                              • memory/376-219-0x00000000097C0000-0x00000000097C7000-memory.dmp
                                Filesize

                                28KB

                              • memory/376-217-0x0000000009A00000-0x0000000009E0B000-memory.dmp
                                Filesize

                                4.0MB

                              • memory/376-215-0x0000000004ED0000-0x0000000004ED5000-memory.dmp
                                Filesize

                                20KB

                              • memory/376-209-0x0000000004A00000-0x0000000004C0F000-memory.dmp
                                Filesize

                                2.1MB

                              • memory/376-211-0x0000000003B60000-0x0000000003B66000-memory.dmp
                                Filesize

                                24KB

                              • memory/560-135-0x0000000000000000-mapping.dmp
                              • memory/560-147-0x0000000000400000-0x0000000000452000-memory.dmp
                                Filesize

                                328KB

                              • memory/560-146-0x0000000000580000-0x0000000000589000-memory.dmp
                                Filesize

                                36KB

                              • memory/560-145-0x0000000000570000-0x0000000000579000-memory.dmp
                                Filesize

                                36KB

                              • memory/828-162-0x0000000000640000-0x0000000000653000-memory.dmp
                                Filesize

                                76KB

                              • memory/828-163-0x0000000000400000-0x00000000004E4000-memory.dmp
                                Filesize

                                912KB

                              • memory/828-161-0x00000000006ED000-0x00000000006FD000-memory.dmp
                                Filesize

                                64KB

                              • memory/828-155-0x0000000000000000-mapping.dmp
                              • memory/1056-232-0x0000000000000000-mapping.dmp
                              • memory/1056-235-0x00000000024C0000-0x0000000002520000-memory.dmp
                                Filesize

                                384KB

                              • memory/1228-166-0x0000000000000000-mapping.dmp
                              • memory/1316-172-0x0000000005040000-0x0000000005041000-memory.dmp
                                Filesize

                                4KB

                              • memory/1316-167-0x00000000050E0000-0x0000000005156000-memory.dmp
                                Filesize

                                472KB

                              • memory/1316-165-0x0000000000700000-0x000000000078A000-memory.dmp
                                Filesize

                                552KB

                              • memory/1316-164-0x0000000000700000-0x000000000078A000-memory.dmp
                                Filesize

                                552KB

                              • memory/1316-158-0x0000000000000000-mapping.dmp
                              • memory/1316-174-0x00000000057C0000-0x0000000005D64000-memory.dmp
                                Filesize

                                5.6MB

                              • memory/1316-171-0x0000000005200000-0x0000000005201000-memory.dmp
                                Filesize

                                4KB

                              • memory/1316-169-0x00000000050C0000-0x00000000050DE000-memory.dmp
                                Filesize

                                120KB

                              • memory/1700-173-0x0000000000000000-mapping.dmp
                              • memory/2192-175-0x0000000000000000-mapping.dmp
                              • memory/2304-179-0x0000000000599000-0x00000000005A9000-memory.dmp
                                Filesize

                                64KB

                              • memory/2304-184-0x0000000000400000-0x00000000004E4000-memory.dmp
                                Filesize

                                912KB

                              • memory/2424-154-0x0000000000ED0000-0x0000000000EE6000-memory.dmp
                                Filesize

                                88KB

                              • memory/2424-134-0x0000000002B10000-0x0000000002B26000-memory.dmp
                                Filesize

                                88KB

                              • memory/2660-152-0x0000000000630000-0x000000000064C000-memory.dmp
                                Filesize

                                112KB

                              • memory/2660-148-0x0000000000000000-mapping.dmp
                              • memory/2660-151-0x000000000075D000-0x000000000076E000-memory.dmp
                                Filesize

                                68KB

                              • memory/2660-153-0x0000000000400000-0x00000000004E5000-memory.dmp
                                Filesize

                                916KB

                              • memory/2848-176-0x0000000000000000-mapping.dmp
                              • memory/2928-131-0x0000000000000000-mapping.dmp
                              • memory/2928-132-0x0000000000400000-0x0000000000409000-memory.dmp
                                Filesize

                                36KB

                              • memory/3028-133-0x0000000002230000-0x0000000002239000-memory.dmp
                                Filesize

                                36KB

                              • memory/3028-130-0x00000000007AE000-0x00000000007BE000-memory.dmp
                                Filesize

                                64KB

                              • memory/3188-227-0x0000000000000000-mapping.dmp
                              • memory/3188-231-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                Filesize

                                39.8MB

                              • memory/3188-230-0x00000000048B0000-0x0000000004955000-memory.dmp
                                Filesize

                                660KB

                              • memory/3188-238-0x0000000004A40000-0x0000000004AD2000-memory.dmp
                                Filesize

                                584KB

                              • memory/3188-236-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                Filesize

                                39.8MB

                              • memory/3188-237-0x00000000049D0000-0x0000000004A38000-memory.dmp
                                Filesize

                                416KB

                              • memory/3252-203-0x0000000000000000-mapping.dmp
                              • memory/3252-204-0x0000000000740000-0x00000000007B4000-memory.dmp
                                Filesize

                                464KB

                              • memory/3252-205-0x00000000006D0000-0x000000000073B000-memory.dmp
                                Filesize

                                428KB

                              • memory/3388-178-0x0000000000000000-mapping.dmp
                              • memory/3468-239-0x0000000000000000-mapping.dmp
                              • memory/3468-168-0x0000000000000000-mapping.dmp
                              • memory/3592-201-0x00000000069A0000-0x0000000006B62000-memory.dmp
                                Filesize

                                1.8MB

                              • memory/3592-197-0x0000000005C80000-0x0000000005CF6000-memory.dmp
                                Filesize

                                472KB

                              • memory/3592-185-0x0000000000000000-mapping.dmp
                              • memory/3592-186-0x0000000000400000-0x0000000000420000-memory.dmp
                                Filesize

                                128KB

                              • memory/3592-202-0x00000000070A0000-0x00000000075CC000-memory.dmp
                                Filesize

                                5.2MB

                              • memory/3592-200-0x0000000005F40000-0x0000000005F5E000-memory.dmp
                                Filesize

                                120KB

                              • memory/3592-199-0x00000000063F0000-0x0000000006994000-memory.dmp
                                Filesize

                                5.6MB

                              • memory/3592-189-0x0000000000400000-0x0000000000420000-memory.dmp
                                Filesize

                                128KB

                              • memory/3592-190-0x0000000000400000-0x0000000000420000-memory.dmp
                                Filesize

                                128KB

                              • memory/3592-191-0x00000000052A0000-0x00000000058B8000-memory.dmp
                                Filesize

                                6.1MB

                              • memory/3592-198-0x0000000005DA0000-0x0000000005E32000-memory.dmp
                                Filesize

                                584KB

                              • memory/3592-192-0x0000000004D40000-0x0000000004D52000-memory.dmp
                                Filesize

                                72KB

                              • memory/3592-196-0x0000000005120000-0x0000000005186000-memory.dmp
                                Filesize

                                408KB

                              • memory/3592-195-0x0000000004C80000-0x0000000005298000-memory.dmp
                                Filesize

                                6.1MB

                              • memory/3592-194-0x0000000004DA0000-0x0000000004DDC000-memory.dmp
                                Filesize

                                240KB

                              • memory/3592-193-0x0000000004E70000-0x0000000004F7A000-memory.dmp
                                Filesize

                                1.0MB

                              • memory/3624-226-0x0000000000400000-0x00000000004F1000-memory.dmp
                                Filesize

                                964KB

                              • memory/3624-222-0x0000000000400000-0x00000000004F1000-memory.dmp
                                Filesize

                                964KB

                              • memory/3624-221-0x0000000000000000-mapping.dmp
                              • memory/3644-208-0x0000000000C10000-0x0000000000C1C000-memory.dmp
                                Filesize

                                48KB

                              • memory/3644-206-0x0000000000000000-mapping.dmp
                              • memory/3644-207-0x0000000000C20000-0x0000000000C27000-memory.dmp
                                Filesize

                                28KB

                              • memory/3908-142-0x0000000000000000-mapping.dmp