smokeloader | e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc

Analysis

max time kernel
154s
max time network
144s
platform
windows7_x64
resource
win7v20201028
submitted
18-11-2020 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HYDRA.exe

Score

10^/10

smokeloader backdoor persistence trojan

Malware Config

Extracted

Family

smokeloader

Version

2017

http://92.53.105.14/

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 10 IoCs

Processes:

yaya.exeva.exeufx.exesant.exepower.exestarter.exeusc.exeservices.exeservices.exefoxcon.exe

pid process

2028 yaya.exe
1212 va.exe
1160 ufx.exe
1960 sant.exe
1292 power.exe
1764 starter.exe
1116 usc.exe
940 services.exe
788 services.exe
1140 foxcon.exe
Drops startup file 1 IoCs

Processes:

va.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe

pid	process
2028	yaya.exe
1212	va.exe
1160	ufx.exe
1960	sant.exe
1292	power.exe
1764	starter.exe
1116	usc.exe
940	services.exe
788	services.exe
1140	foxcon.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs	va.exe

Loads dropped DLL 12 IoCs

Processes:

HYDRA.exeyaya.exeufx.exe

pid	process
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
1028	HYDRA.exe
2028	yaya.exe
1160	ufx.exe
1160	ufx.exe
1160	ufx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppDataLow = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\gtbidieh\\gtgbhwif.exe"	explorer.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

sant.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	sant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	sant.exe

Drops file in System32 directory 2 IoCs

Processes:

foxcon.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT	foxcon.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT	foxcon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

972 SCHTASKS.exe

pid	process
972	SCHTASKS.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

services.exefoxcon.exeservices.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\FoxCond\{1945BBS40-8571-3DA1-BB29-HYDRA7A11A1E} = "C:\\Windows\\Temp\\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\\services.exe"	services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\GDIPlus	foxcon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\FoxCond\{1945BBS40-8571-3DA1-BB29-HYDRA7A11A1E} = "C:\\Windows\\Temp\\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\\services.exe"	services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\GDIPlus\FontCachePath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local"	foxcon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	services.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	services.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	services.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\FoxCond	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Foxcon Service Control = "C:\\Windows\\TEMP\\foxcon.exe"	foxcon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	foxcon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sant.exe

pid	process
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe
1960	sant.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

sant.exe

pid process

1960 sant.exe
1960 sant.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

usc.exestarter.exeservices.exeservices.exefoxcon.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1116	usc.exe
Token: SeDebugPrivilege	1764	starter.exe
Token: SeDebugPrivilege	940	services.exe
Token: SeDebugPrivilege	788	services.exe
Token: SeDebugPrivilege	1140	foxcon.exe
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

HYDRA.exeyaya.exeufx.exeusc.exesant.exestarter.execsc.execmd.exeservices.exepower.exe

description	pid	process	target process
PID 1028 wrote to memory of 2028	1028	HYDRA.exe	yaya.exe
PID 1028 wrote to memory of 2028	1028	HYDRA.exe	yaya.exe
PID 1028 wrote to memory of 2028	1028	HYDRA.exe	yaya.exe
PID 1028 wrote to memory of 2028	1028	HYDRA.exe	yaya.exe
PID 1028 wrote to memory of 1212	1028	HYDRA.exe	va.exe
PID 1028 wrote to memory of 1212	1028	HYDRA.exe	va.exe
PID 1028 wrote to memory of 1212	1028	HYDRA.exe	va.exe
PID 1028 wrote to memory of 1212	1028	HYDRA.exe	va.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1160	1028	HYDRA.exe	ufx.exe
PID 1028 wrote to memory of 1960	1028	HYDRA.exe	sant.exe
PID 1028 wrote to memory of 1960	1028	HYDRA.exe	sant.exe
PID 1028 wrote to memory of 1960	1028	HYDRA.exe	sant.exe
PID 1028 wrote to memory of 1960	1028	HYDRA.exe	sant.exe
PID 1028 wrote to memory of 1292	1028	HYDRA.exe	power.exe
PID 1028 wrote to memory of 1292	1028	HYDRA.exe	power.exe
PID 1028 wrote to memory of 1292	1028	HYDRA.exe	power.exe
PID 1028 wrote to memory of 1292	1028	HYDRA.exe	power.exe
PID 2028 wrote to memory of 1764	2028	yaya.exe	starter.exe
PID 2028 wrote to memory of 1764	2028	yaya.exe	starter.exe
PID 2028 wrote to memory of 1764	2028	yaya.exe	starter.exe
PID 2028 wrote to memory of 1764	2028	yaya.exe	starter.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1160 wrote to memory of 1116	1160	ufx.exe	usc.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1116 wrote to memory of 972	1116	usc.exe	SCHTASKS.exe
PID 1960 wrote to memory of 1708	1960	sant.exe	explorer.exe
PID 1960 wrote to memory of 1708	1960	sant.exe	explorer.exe
PID 1960 wrote to memory of 1708	1960	sant.exe	explorer.exe
PID 1960 wrote to memory of 1708	1960	sant.exe	explorer.exe
PID 1764 wrote to memory of 1156	1764	starter.exe	csc.exe
PID 1764 wrote to memory of 1156	1764	starter.exe	csc.exe
PID 1764 wrote to memory of 1156	1764	starter.exe	csc.exe
PID 1156 wrote to memory of 1956	1156	csc.exe	cvtres.exe
PID 1156 wrote to memory of 1956	1156	csc.exe	cvtres.exe
PID 1156 wrote to memory of 1956	1156	csc.exe	cvtres.exe
PID 960 wrote to memory of 940	960	cmd.exe	services.exe
PID 960 wrote to memory of 940	960	cmd.exe	services.exe
PID 960 wrote to memory of 940	960	cmd.exe	services.exe
PID 788 wrote to memory of 1140	788	services.exe	foxcon.exe
PID 788 wrote to memory of 1140	788	services.exe	foxcon.exe
PID 788 wrote to memory of 1140	788	services.exe	foxcon.exe
PID 1292 wrote to memory of 936	1292	power.exe	powershell.exe
PID 1292 wrote to memory of 936	1292	power.exe	powershell.exe
PID 1292 wrote to memory of 936	1292	power.exe	powershell.exe
PID 1292 wrote to memory of 936	1292	power.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\HYDRA.exe
"C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Roaming\yaya.exe
C:\Users\Admin\AppData\Roaming\yaya.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vuivrozc.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA88.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDA87.tmp"
5⤵
PID:1956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:1320

C:\Windows\System32\cmd.exe
/K services.exe && clear
4⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
services.exe
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:1664

C:\Windows\System32\cmd.exe
net localgroup administrators %username% /add
4⤵
PID:648

C:\Users\Admin\AppData\Roaming\va.exe
C:\Users\Admin\AppData\Roaming\va.exe
2⤵
- Executes dropped EXE
- Drops startup file
PID:1212

C:\Users\Admin\AppData\Roaming\ufx.exe
C:\Users\Admin\AppData\Roaming\ufx.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\ProgramData\ucp\usc.exe
"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\SCHTASKS.exe
SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe
4⤵
- Creates scheduled task(s)
PID:972

C:\Users\Admin\AppData\Roaming\sant.exe
C:\Users\Admin\AppData\Roaming\sant.exe
2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds Run key to start application
PID:1708

C:\Users\Admin\AppData\Roaming\power.exe
C:\Users\Admin\AppData\Roaming\power.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\TEMP\foxcon.exe
"C:\Windows\TEMP\foxcon.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ucp\usc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDA88.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuivrozc.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuivrozc.pdb

Download Submit
C:\Users\Admin\AppData\Roaming\power.exe

Download Submit
C:\Users\Admin\AppData\Roaming\sant.exe

Download Submit
C:\Users\Admin\AppData\Roaming\sant.exe

Download Submit
C:\Users\Admin\AppData\Roaming\ufx.exe

Download Submit
C:\Users\Admin\AppData\Roaming\ufx.exe

Download Submit
C:\Users\Admin\AppData\Roaming\va.exe

Download Submit
C:\Users\Admin\AppData\Roaming\yaya.exe

Download Submit
C:\Users\Admin\AppData\Roaming\yaya.exe

Download Submit
C:\Windows\TEMP\foxcon.exe

Download Submit
C:\Windows\Temp\foxcon.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\Newtonsoft.Json.dll

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\foxcon.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe

Download Submit
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCDA87.tmp

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vuivrozc.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vuivrozc.cmdline

Download Submit
\ProgramData\ucp\usc.exe

Download Submit
\ProgramData\ucp\usc.exe

Download Submit
\ProgramData\ucp\usc.exe

Download Submit
\Users\Admin\AppData\Roaming\power.exe

Download Submit
\Users\Admin\AppData\Roaming\power.exe

Download Submit
\Users\Admin\AppData\Roaming\sant.exe

Download Submit
\Users\Admin\AppData\Roaming\sant.exe

Download Submit
\Users\Admin\AppData\Roaming\ufx.exe

Download Submit
\Users\Admin\AppData\Roaming\va.exe

Download Submit
\Users\Admin\AppData\Roaming\va.exe

Download Submit
\Users\Admin\AppData\Roaming\yaya.exe

Download Submit
\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe

Download Submit
memory/788-54-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/788-53-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/856-36-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp

Filesize
2.5MB

Download
memory/936-63-0x0000000000000000-mapping.dmp

Download
memory/936-64-0x0000000072B50000-0x000000007323E000-memory.dmp

Filesize
6.9MB

Download
memory/936-65-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/936-66-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/936-67-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/936-68-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/940-50-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/940-51-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/940-47-0x0000000000000000-mapping.dmp

Download
memory/972-34-0x0000000000000000-mapping.dmp

Download
memory/1116-31-0x0000000000000000-mapping.dmp

Download
memory/1140-60-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/1140-59-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/1140-56-0x0000000000000000-mapping.dmp

Download
memory/1156-39-0x0000000000000000-mapping.dmp

Download
memory/1160-9-0x0000000000000000-mapping.dmp

Download
memory/1212-5-0x0000000000000000-mapping.dmp

Download
memory/1292-21-0x0000000000000000-mapping.dmp

Download
memory/1708-37-0x0000000000000000-mapping.dmp

Download
memory/1708-38-0x0000000000520000-0x00000000007A1000-memory.dmp

Filesize
2.5MB

Download
memory/1764-33-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/1764-35-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/1764-25-0x0000000000000000-mapping.dmp

Download
memory/1956-42-0x0000000000000000-mapping.dmp

Download
memory/1960-15-0x0000000000000000-mapping.dmp

Download
memory/2028-23-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/2028-11-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x0000000000000000-mapping.dmp

Download