General
Target

26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe

Filesize

304KB

Completed

21-05-2022 16:06

Task

behavioral1

Score
10/10
MD5

8ff62be376db466f631adfd8917f094f

SHA1

1c52c2a363d3d4b09a9d7c9a6b7d1aee2cd65ba9

SHA256

26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a

SHA256

2979cd26fe7f11ecdfba674d8e3bd6c359017b8f3898d5f884276ca75497a97ac4714be7f64ea0f8581e8dd2f42177dc574afcdab0868413948ad60a46a3c7d9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://bahninfo.at/upload/

http://img4mobi.com/upload/

http://equix.ru/upload/

http://worldalltv.com/upload/

http://negarehgallery.com/upload/

http://lite-server.ru/upload/

http://piratia/su/upload/

http://go-piratia.ru/upload/

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

https://ny-city-mall.com/search.php

https://fresh-cars.net/search.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32
Signatures 13

Filter: none

Discovery
Execution
Persistence
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE
    A22B.exeF212.exeA8EF.exe

    Reported IOCs

    pidprocess
    3744A22B.exe
    4336F212.exe
    212A8EF.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Deletes itself

    Reported IOCs

    pidprocess
    2100
  • Checks SCSI registry key(s)
    A22B.exeF212.exe26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIA22B.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIF212.exe
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIF212.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIA22B.exe
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIA22B.exe
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSIF212.exe
  • Gathers network information
    ipconfig.exe

    Description

    Uses commandline utility to view network configuration.

    TTPs

    System Information DiscoveryCommand-Line Interface

    Reported IOCs

    pidprocess
    920ipconfig.exe
  • Gathers system information
    systeminfo.exe

    Description

    Runs systeminfo.exe.

    TTPs

    System Information Discovery

    Reported IOCs

    pidprocess
    3468systeminfo.exe
  • Suspicious behavior: EnumeratesProcesses
    26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe

    Reported IOCs

    pidprocess
    178426800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    178426800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
    2100
  • Suspicious behavior: GetForegroundWindowSpam

    Reported IOCs

    pidprocess
    2100
  • Suspicious behavior: MapViewOfSection
    26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exeA22B.exeF212.exe

    Reported IOCs

    pidprocess
    178426800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    3744A22B.exe
    4336F212.exe
    2100
    2100
    2100
    2100
  • Suspicious use of AdjustPrivilegeToken
    WMIC.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege4820WMIC.exe
    Token: SeSecurityPrivilege4820WMIC.exe
    Token: SeTakeOwnershipPrivilege4820WMIC.exe
    Token: SeLoadDriverPrivilege4820WMIC.exe
    Token: SeSystemProfilePrivilege4820WMIC.exe
    Token: SeSystemtimePrivilege4820WMIC.exe
    Token: SeProfSingleProcessPrivilege4820WMIC.exe
    Token: SeIncBasePriorityPrivilege4820WMIC.exe
    Token: SeCreatePagefilePrivilege4820WMIC.exe
    Token: SeBackupPrivilege4820WMIC.exe
    Token: SeRestorePrivilege4820WMIC.exe
    Token: SeShutdownPrivilege4820WMIC.exe
    Token: SeDebugPrivilege4820WMIC.exe
    Token: SeSystemEnvironmentPrivilege4820WMIC.exe
    Token: SeRemoteShutdownPrivilege4820WMIC.exe
    Token: SeUndockPrivilege4820WMIC.exe
    Token: SeManageVolumePrivilege4820WMIC.exe
    Token: 334820WMIC.exe
    Token: 344820WMIC.exe
    Token: 354820WMIC.exe
    Token: 364820WMIC.exe
    Token: SeIncreaseQuotaPrivilege4820WMIC.exe
    Token: SeSecurityPrivilege4820WMIC.exe
    Token: SeTakeOwnershipPrivilege4820WMIC.exe
    Token: SeLoadDriverPrivilege4820WMIC.exe
    Token: SeSystemProfilePrivilege4820WMIC.exe
    Token: SeSystemtimePrivilege4820WMIC.exe
    Token: SeProfSingleProcessPrivilege4820WMIC.exe
    Token: SeIncBasePriorityPrivilege4820WMIC.exe
    Token: SeCreatePagefilePrivilege4820WMIC.exe
    Token: SeBackupPrivilege4820WMIC.exe
    Token: SeRestorePrivilege4820WMIC.exe
    Token: SeShutdownPrivilege4820WMIC.exe
    Token: SeDebugPrivilege4820WMIC.exe
    Token: SeSystemEnvironmentPrivilege4820WMIC.exe
    Token: SeRemoteShutdownPrivilege4820WMIC.exe
    Token: SeUndockPrivilege4820WMIC.exe
    Token: SeManageVolumePrivilege4820WMIC.exe
    Token: 334820WMIC.exe
    Token: 344820WMIC.exe
    Token: 354820WMIC.exe
    Token: 364820WMIC.exe
    Token: SeIncreaseQuotaPrivilege4528WMIC.exe
    Token: SeSecurityPrivilege4528WMIC.exe
    Token: SeTakeOwnershipPrivilege4528WMIC.exe
    Token: SeLoadDriverPrivilege4528WMIC.exe
    Token: SeSystemProfilePrivilege4528WMIC.exe
    Token: SeSystemtimePrivilege4528WMIC.exe
    Token: SeProfSingleProcessPrivilege4528WMIC.exe
    Token: SeIncBasePriorityPrivilege4528WMIC.exe
    Token: SeCreatePagefilePrivilege4528WMIC.exe
    Token: SeBackupPrivilege4528WMIC.exe
    Token: SeRestorePrivilege4528WMIC.exe
    Token: SeShutdownPrivilege4528WMIC.exe
    Token: SeDebugPrivilege4528WMIC.exe
    Token: SeSystemEnvironmentPrivilege4528WMIC.exe
    Token: SeRemoteShutdownPrivilege4528WMIC.exe
    Token: SeUndockPrivilege4528WMIC.exe
    Token: SeManageVolumePrivilege4528WMIC.exe
    Token: 334528WMIC.exe
    Token: 344528WMIC.exe
    Token: 354528WMIC.exe
    Token: 364528WMIC.exe
    Token: SeIncreaseQuotaPrivilege4528WMIC.exe
  • Suspicious use of WriteProcessMemory
    cmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2100 wrote to memory of 37442100A22B.exe
    PID 2100 wrote to memory of 37442100A22B.exe
    PID 2100 wrote to memory of 37442100A22B.exe
    PID 2100 wrote to memory of 43362100F212.exe
    PID 2100 wrote to memory of 43362100F212.exe
    PID 2100 wrote to memory of 43362100F212.exe
    PID 2100 wrote to memory of 47882100cmd.exe
    PID 2100 wrote to memory of 47882100cmd.exe
    PID 4788 wrote to memory of 48204788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 48204788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 45284788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 45284788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 48524788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 48524788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 47004788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 47004788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 17364788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 17364788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 41764788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 41764788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 35644788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 35644788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 32964788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 32964788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 3044788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 3044788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 39764788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 39764788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 40084788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 40084788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 16004788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 16004788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 8124788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 8124788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 31284788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 31284788cmd.exeWMIC.exe
    PID 4788 wrote to memory of 9204788cmd.exeipconfig.exe
    PID 4788 wrote to memory of 9204788cmd.exeipconfig.exe
    PID 4788 wrote to memory of 49684788cmd.exeROUTE.EXE
    PID 4788 wrote to memory of 49684788cmd.exeROUTE.EXE
    PID 4788 wrote to memory of 39884788cmd.exenetsh.exe
    PID 4788 wrote to memory of 39884788cmd.exenetsh.exe
    PID 4788 wrote to memory of 34684788cmd.exesysteminfo.exe
    PID 4788 wrote to memory of 34684788cmd.exesysteminfo.exe
    PID 2100 wrote to memory of 2122100A8EF.exe
    PID 2100 wrote to memory of 2122100A8EF.exe
    PID 2100 wrote to memory of 2122100A8EF.exe
    PID 2100 wrote to memory of 14562100explorer.exe
    PID 2100 wrote to memory of 14562100explorer.exe
    PID 2100 wrote to memory of 14562100explorer.exe
    PID 2100 wrote to memory of 14562100explorer.exe
    PID 2100 wrote to memory of 21922100explorer.exe
    PID 2100 wrote to memory of 21922100explorer.exe
    PID 2100 wrote to memory of 21922100explorer.exe
Processes 26
  • C:\Users\Admin\AppData\Local\Temp\26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe
    "C:\Users\Admin\AppData\Local\Temp\26800011b9fe7e3d8944040da4e55acf2898e11634d29417c9016c4d22d0865a.exe"
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:1784
  • C:\Users\Admin\AppData\Local\Temp\A22B.exe
    C:\Users\Admin\AppData\Local\Temp\A22B.exe
    Executes dropped EXE
    Checks SCSI registry key(s)
    Suspicious behavior: MapViewOfSection
    PID:3744
  • C:\Users\Admin\AppData\Local\Temp\F212.exe
    C:\Users\Admin\AppData\Local\Temp\F212.exe
    Executes dropped EXE
    Checks SCSI registry key(s)
    Suspicious behavior: MapViewOfSection
    PID:4336
  • C:\Windows\system32\cmd.exe
    cmd
    Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
      Suspicious use of AdjustPrivilegeToken
      PID:4820
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
      Suspicious use of AdjustPrivilegeToken
      PID:4528
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
      PID:4852
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
      PID:4700
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
      PID:1736
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
      PID:4176
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
      PID:3564
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
      PID:3296
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
      PID:304
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
      PID:3976
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
      PID:4008
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
      PID:1600
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
      PID:812
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
      PID:3128
    • C:\Windows\system32\ipconfig.exe
      ipconfig /displaydns
      Gathers network information
      PID:920
    • C:\Windows\system32\ROUTE.EXE
      route print
      PID:4968
    • C:\Windows\system32\netsh.exe
      netsh firewall show state
      PID:3988
    • C:\Windows\system32\systeminfo.exe
      systeminfo
      Gathers system information
      PID:3468
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    PID:4916
  • C:\Users\Admin\AppData\Local\Temp\A8EF.exe
    C:\Users\Admin\AppData\Local\Temp\A8EF.exe
    Executes dropped EXE
    PID:212
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:1456
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:2192
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\A22B.exe

                      MD5

                      26337dba80f6771e3a16b16903e57b7c

                      SHA1

                      8b11d6a96d6e409456cb00f6e46e227426b29c08

                      SHA256

                      05aa0199c301a1971d1972af7210922af9ae6886e1333c9d4b463e889bd9eda1

                      SHA512

                      45c320ece64bfd88acab6ca44ccca042e888bce09ea34e342b5e86c7f6b522e0c61a6bfa4affdc7e14ddceab8ec4d20cfc5fb0d9d42de37752610af3c91b85bc

                    • C:\Users\Admin\AppData\Local\Temp\A22B.exe

                      MD5

                      26337dba80f6771e3a16b16903e57b7c

                      SHA1

                      8b11d6a96d6e409456cb00f6e46e227426b29c08

                      SHA256

                      05aa0199c301a1971d1972af7210922af9ae6886e1333c9d4b463e889bd9eda1

                      SHA512

                      45c320ece64bfd88acab6ca44ccca042e888bce09ea34e342b5e86c7f6b522e0c61a6bfa4affdc7e14ddceab8ec4d20cfc5fb0d9d42de37752610af3c91b85bc

                    • C:\Users\Admin\AppData\Local\Temp\A8EF.exe

                      MD5

                      4f8a7c030aa8784e5f9726de742be5b5

                      SHA1

                      b458828a0383defa2b1c79dc043d7e7e8cc712c4

                      SHA256

                      b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

                      SHA512

                      0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

                    • C:\Users\Admin\AppData\Local\Temp\A8EF.exe

                      MD5

                      4f8a7c030aa8784e5f9726de742be5b5

                      SHA1

                      b458828a0383defa2b1c79dc043d7e7e8cc712c4

                      SHA256

                      b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

                      SHA512

                      0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

                    • C:\Users\Admin\AppData\Local\Temp\F212.exe

                      MD5

                      cfbe64a303fb6e0000c7859bfb13a1a2

                      SHA1

                      a6b85217a3bd9ef76f1235a9ab92384b96b7fede

                      SHA256

                      256340cafa360c86852d0f2b648e85a9e0957a66f58c0bc572f6b7482bb75135

                      SHA512

                      c411656d43d9b709db77c153da224e2930d26200dc081082d0a4beb0be23b6e63c9e747ec3d650cd670f72c08d79ba40d49c9091344e305a01657916109284b1

                    • C:\Users\Admin\AppData\Local\Temp\F212.exe

                      MD5

                      cfbe64a303fb6e0000c7859bfb13a1a2

                      SHA1

                      a6b85217a3bd9ef76f1235a9ab92384b96b7fede

                      SHA256

                      256340cafa360c86852d0f2b648e85a9e0957a66f58c0bc572f6b7482bb75135

                      SHA512

                      c411656d43d9b709db77c153da224e2930d26200dc081082d0a4beb0be23b6e63c9e747ec3d650cd670f72c08d79ba40d49c9091344e305a01657916109284b1

                    • memory/212-256-0x0000000000000000-mapping.dmp

                    • memory/304-246-0x0000000000000000-mapping.dmp

                    • memory/812-250-0x0000000000000000-mapping.dmp

                    • memory/920-252-0x0000000000000000-mapping.dmp

                    • memory/1456-296-0x0000000000000000-mapping.dmp

                    • memory/1600-249-0x0000000000000000-mapping.dmp

                    • memory/1736-240-0x0000000000000000-mapping.dmp

                    • memory/1784-138-0x00000000007D1000-0x00000000007E1000-memory.dmp

                    • memory/1784-128-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-129-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-130-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-131-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-132-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-133-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-134-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-135-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-136-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-137-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-127-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-139-0x00000000005C0000-0x00000000005C9000-memory.dmp

                    • memory/1784-140-0x0000000000400000-0x000000000048D000-memory.dmp

                    • memory/1784-141-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-142-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-143-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-144-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-145-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-146-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-147-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-148-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-126-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-124-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-123-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-122-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-121-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-120-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-119-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-118-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-117-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-116-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-115-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-149-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-114-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/1784-125-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/2100-234-0x0000000004D10000-0x0000000004D1F000-memory.dmp

                    • memory/2100-191-0x0000000002AD0000-0x0000000002AE6000-memory.dmp

                    • memory/2100-150-0x0000000000AF0000-0x0000000000B06000-memory.dmp

                    • memory/2100-231-0x00000000045E0000-0x00000000045F6000-memory.dmp

                    • memory/2192-323-0x0000000000000000-mapping.dmp

                    • memory/3128-251-0x0000000000000000-mapping.dmp

                    • memory/3296-245-0x0000000000000000-mapping.dmp

                    • memory/3468-255-0x0000000000000000-mapping.dmp

                    • memory/3564-244-0x0000000000000000-mapping.dmp

                    • memory/3744-188-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-174-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-175-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-176-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-177-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-178-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-179-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-180-0x0000000000590000-0x00000000006DA000-memory.dmp

                    • memory/3744-182-0x0000000000570000-0x0000000000579000-memory.dmp

                    • memory/3744-184-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-183-0x0000000000400000-0x000000000048E000-memory.dmp

                    • memory/3744-181-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-173-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-187-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-186-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-185-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-172-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-162-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-159-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-157-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-158-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-156-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-155-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-153-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-170-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-171-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-154-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-169-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-163-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-151-0x0000000000000000-mapping.dmp

                    • memory/3744-167-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-166-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-165-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-164-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3744-168-0x0000000076F70000-0x00000000770FE000-memory.dmp

                    • memory/3976-247-0x0000000000000000-mapping.dmp

                    • memory/3988-254-0x0000000000000000-mapping.dmp

                    • memory/4008-248-0x0000000000000000-mapping.dmp

                    • memory/4176-243-0x0000000000000000-mapping.dmp

                    • memory/4336-222-0x0000000000400000-0x000000000048D000-memory.dmp

                    • memory/4336-220-0x00000000001D0000-0x00000000001D9000-memory.dmp

                    • memory/4336-219-0x00000000006F1000-0x0000000000702000-memory.dmp

                    • memory/4336-192-0x0000000000000000-mapping.dmp

                    • memory/4528-237-0x0000000000000000-mapping.dmp

                    • memory/4700-239-0x0000000000000000-mapping.dmp

                    • memory/4788-235-0x0000000000000000-mapping.dmp

                    • memory/4820-236-0x0000000000000000-mapping.dmp

                    • memory/4852-238-0x0000000000000000-mapping.dmp

                    • memory/4968-253-0x0000000000000000-mapping.dmp