Resubmissions

24-04-2021 06:39

210424-z9rcb7aepa 10

23-04-2021 19:10

210423-eqazybfbwe 10

23-04-2021 19:10

210423-11yc7me6fe 10

23-04-2021 18:20

210423-96m9f6fxjx 10

23-04-2021 13:38

210423-fv1qhsltzj 10

23-04-2021 13:38

210423-6hhapn6pdx 10

23-04-2021 13:38

210423-m5azl6mq1s 10

23-04-2021 13:38

210423-nlvbxenam6 10

23-04-2021 13:38

210423-y4rkc8l6ts 10

23-04-2021 05:23

210423-lejp16ex1n 10

Analysis

  • max time kernel
    1799s
  • max time network
    1620s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-04-2021 13:38

General

  • Target

    keygen-step-4.exe

  • Size

    4.6MB

  • MD5

    563107b1df2a00f4ec868acd9e08a205

  • SHA1

    9cb9c91d66292f5317aa50d92e38834861e9c9b7

  • SHA256

    bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9

  • SHA512

    99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2752
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2384
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2360
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2332
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2272
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1892
            • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
              "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4024
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
                2⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2460
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                  3⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1120
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1116
                • C:\ProgramData\1133188.exe
                  "C:\ProgramData\1133188.exe"
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:4408
                  • C:\ProgramData\Windows Host\Windows Host.exe
                    "C:\ProgramData\Windows Host\Windows Host.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4520
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4724
                • C:\Users\Admin\AppData\Local\Temp\is-K7966.tmp\Install.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-K7966.tmp\Install.tmp" /SL5="$6007E,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:4764
                  • C:\Users\Admin\AppData\Local\Temp\is-4F6IC.tmp\Ultra.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-4F6IC.tmp\Ultra.exe" /S /UID=burnerch1
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4896
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                      dw20.exe -x -s 1256
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5016
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1356
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1288
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1196
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1084
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:932
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:68
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2192
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1160

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Discovery

                        System Information Discovery

                        2
                        T1082

                        Query Registry

                        1
                        T1012

                        Command and Control

                        Web Service

                        1
                        T1102

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files\install.dat
                          MD5

                          806c3221a013fec9530762750556c332

                          SHA1

                          36475bcfd0a18555d7c0413d007bbe80f7d321b5

                          SHA256

                          9bcecc5fb84d21db673c81a7ed1d10b28686b8261f79136f748ab7bbad7752f7

                          SHA512

                          56bbaafe7b0883f4e5dcff00ae69339a3b81ac8ba90b304aeab3e4e7e7523b568fd9b269241fc38a39f74894084f1f252a91c22b79cc0a16f9e135859a13145e

                        • C:\Program Files\install.dll
                          MD5

                          fe60ddbeab6e50c4f490ddf56b52057c

                          SHA1

                          6a71fdf73761a1192fd9c6961f66754a63d6db17

                          SHA256

                          9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

                          SHA512

                          0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

                        • C:\ProgramData\1133188.exe
                          MD5

                          055a20b8347170594cbc8b8aa2197b2a

                          SHA1

                          9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

                          SHA256

                          03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

                          SHA512

                          914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

                        • C:\ProgramData\1133188.exe
                          MD5

                          055a20b8347170594cbc8b8aa2197b2a

                          SHA1

                          9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

                          SHA256

                          03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

                          SHA512

                          914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

                        • C:\ProgramData\Windows Host\Windows Host.exe
                          MD5

                          055a20b8347170594cbc8b8aa2197b2a

                          SHA1

                          9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

                          SHA256

                          03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

                          SHA512

                          914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

                        • C:\ProgramData\Windows Host\Windows Host.exe
                          MD5

                          055a20b8347170594cbc8b8aa2197b2a

                          SHA1

                          9bd84ab6cb4df6cb0fd1c7a0fe7efe31357e1f10

                          SHA256

                          03c8a390f7030ea876188436d6cbe99592b739d40a53e60ad0869c4c6194d828

                          SHA512

                          914c928a4060ddc2bda4e96918c22c4df14160e869a6c5b62eeafe7bb1044006993532e55929d2d89bac08c1b896619b016a2caf6011d155646fb7421ba3b6f2

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
                          MD5

                          41a5f4fd1ea7cac4aa94a87aebccfef0

                          SHA1

                          0d0abf079413a4c773754bf4fda338dc5b9a8ddc

                          SHA256

                          97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

                          SHA512

                          5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
                          MD5

                          41a5f4fd1ea7cac4aa94a87aebccfef0

                          SHA1

                          0d0abf079413a4c773754bf4fda338dc5b9a8ddc

                          SHA256

                          97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

                          SHA512

                          5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
                          MD5

                          3b1b318df4d314a35dce9e8fd89e5121

                          SHA1

                          55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

                          SHA256

                          4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

                          SHA512

                          f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
                          MD5

                          3b1b318df4d314a35dce9e8fd89e5121

                          SHA1

                          55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

                          SHA256

                          4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

                          SHA512

                          f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
                          MD5

                          e72eb3a565d7b5b83c7ff6fad519c6c9

                          SHA1

                          1a2668a26b01828eec1415aa614743abb0a4fb70

                          SHA256

                          8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

                          SHA512

                          71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
                          MD5

                          e72eb3a565d7b5b83c7ff6fad519c6c9

                          SHA1

                          1a2668a26b01828eec1415aa614743abb0a4fb70

                          SHA256

                          8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

                          SHA512

                          71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

                        • C:\Users\Admin\AppData\Local\Temp\is-4F6IC.tmp\Ultra.exe
                          MD5

                          2321171d647af6aee7493ceaa711e6fb

                          SHA1

                          7a4e885025e1afe315e4dc8c74f9666243ac5c2a

                          SHA256

                          4ea355626a1c002680f773dc75af75ea0da8cf50226d0cee058b45385f438da9

                          SHA512

                          bacb1b360911cf798d92481e6bb26724bfb49cf70f199262639d376c39ca3e5d2d31ef1468884812d265f19b91a3e1c987756ab4616e870e5133998dfe2c818b

                        • C:\Users\Admin\AppData\Local\Temp\is-4F6IC.tmp\Ultra.exe
                          MD5

                          2321171d647af6aee7493ceaa711e6fb

                          SHA1

                          7a4e885025e1afe315e4dc8c74f9666243ac5c2a

                          SHA256

                          4ea355626a1c002680f773dc75af75ea0da8cf50226d0cee058b45385f438da9

                          SHA512

                          bacb1b360911cf798d92481e6bb26724bfb49cf70f199262639d376c39ca3e5d2d31ef1468884812d265f19b91a3e1c987756ab4616e870e5133998dfe2c818b

                        • C:\Users\Admin\AppData\Local\Temp\is-K7966.tmp\Install.tmp
                          MD5

                          45ca138d0bb665df6e4bef2add68c7bf

                          SHA1

                          12c1a48e3a02f319a3d3ca647d04442d55e09265

                          SHA256

                          3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

                          SHA512

                          cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

                        • C:\Users\Admin\Desktop\StopCopy.svgz
                          MD5

                          4240666c85d201924611ff9781d6bcf9

                          SHA1

                          cc0a749bec5029013d478a1c17a71540a6f3c5d9

                          SHA256

                          7f90110c83bb727d41906d0cfcb2aa1eafcb2f48b612c9de76fb85612474d880

                          SHA512

                          743d887bda33ea3b770d093d0b3a19e31f6fe5f0662363eabbe185cb027a1b4d0801b66b8f29a10b99fdffea115d14706bc5428c9c6a2ae6e4f07cc3a988b24c

                        • C:\Users\Admin\Desktop\UpdateRead.potm
                          MD5

                          d5759922e3821578e14a4efddd3f1e01

                          SHA1

                          9f9397b46ccd1f9189ce81231dc379bd0cd1da32

                          SHA256

                          095b112a6e1a1d781c00d16b4f64bbdef70c24f84630dc0a05f2fd2146a7be3c

                          SHA512

                          5ea607726a6f143f039f4cbfaad8c915f534f67ba16acfd05858dda48dad03921e899b763293efbb09f83a2d1a9d6fabbc5fc3b4d3faa4155832dcc9ffab1d99

                        • C:\Users\Admin\Desktop\UseReceive.mid
                          MD5

                          1d3e8dee4aa76d4e32b3534954a76502

                          SHA1

                          c142a051b0ff593d9542a95c3337c0175848abea

                          SHA256

                          329e5152f6a445c429eedec4a5e873c0fec3734bfb16f1397da5861f510b48db

                          SHA512

                          7b39636a50c1553cfccd99f200bd085000ef978be2140082f1e92587b3168fe067ff6ce4c84617f3981f50f7ae2d2bcbe60f5eb5551176033a98c2097b186dd5

                        • \Program Files\install.dll
                          MD5

                          fe60ddbeab6e50c4f490ddf56b52057c

                          SHA1

                          6a71fdf73761a1192fd9c6961f66754a63d6db17

                          SHA256

                          9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

                          SHA512

                          0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

                        • \Users\Admin\AppData\Local\Temp\is-4F6IC.tmp\idp.dll
                          MD5

                          8f995688085bced38ba7795f60a5e1d3

                          SHA1

                          5b1ad67a149c05c50d6e388527af5c8a0af4343a

                          SHA256

                          203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                          SHA512

                          043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                        • memory/68-247-0x0000015A8A7B0000-0x0000015A8A820000-memory.dmp
                          Filesize

                          448KB

                        • memory/68-166-0x0000015A8A140000-0x0000015A8A1B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/932-255-0x0000017366850000-0x00000173668C0000-memory.dmp
                          Filesize

                          448KB

                        • memory/932-165-0x0000017366760000-0x00000173667D0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1084-158-0x0000025C2FB40000-0x0000025C2FBB0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1084-253-0x0000025C2FBB0000-0x0000025C2FC20000-memory.dmp
                          Filesize

                          448KB

                        • memory/1116-126-0x0000000000610000-0x0000000000611000-memory.dmp
                          Filesize

                          4KB

                        • memory/1116-120-0x0000000000000000-mapping.dmp
                        • memory/1116-128-0x0000000000D10000-0x0000000000D11000-memory.dmp
                          Filesize

                          4KB

                        • memory/1116-147-0x000000001B290000-0x000000001B292000-memory.dmp
                          Filesize

                          8KB

                        • memory/1116-132-0x0000000000D40000-0x0000000000D41000-memory.dmp
                          Filesize

                          4KB

                        • memory/1116-131-0x0000000000D20000-0x0000000000D3C000-memory.dmp
                          Filesize

                          112KB

                        • memory/1120-119-0x0000000000000000-mapping.dmp
                        • memory/1120-130-0x0000000004260000-0x00000000042BC000-memory.dmp
                          Filesize

                          368KB

                        • memory/1120-129-0x0000000004155000-0x0000000004256000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/1160-205-0x00000201AB800000-0x00000201AB901000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/1160-162-0x00000201A9340000-0x00000201A93B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1160-135-0x00007FF642C74060-mapping.dmp
                        • memory/1196-261-0x000001A02C320000-0x000001A02C390000-memory.dmp
                          Filesize

                          448KB

                        • memory/1196-184-0x000001A02C240000-0x000001A02C2B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1288-263-0x00000202F2910000-0x00000202F2980000-memory.dmp
                          Filesize

                          448KB

                        • memory/1288-186-0x00000202F2340000-0x00000202F23B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1356-180-0x0000023DC6E00000-0x0000023DC6E70000-memory.dmp
                          Filesize

                          448KB

                        • memory/1356-257-0x0000023DC6E70000-0x0000023DC6EE0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1892-182-0x00000243BD940000-0x00000243BD9B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/1892-259-0x00000243BE340000-0x00000243BE3B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2192-151-0x0000019F4D870000-0x0000019F4D8E0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2192-233-0x0000019F4D410000-0x0000019F4D411000-memory.dmp
                          Filesize

                          4KB

                        • memory/2192-234-0x0000019F4D410000-0x0000019F4D414000-memory.dmp
                          Filesize

                          16KB

                        • memory/2192-236-0x0000019F4B2F0000-0x0000019F4B2F4000-memory.dmp
                          Filesize

                          16KB

                        • memory/2192-142-0x0000019F4D7B0000-0x0000019F4D7FB000-memory.dmp
                          Filesize

                          300KB

                        • memory/2192-232-0x0000019F4D4E0000-0x0000019F4D4E4000-memory.dmp
                          Filesize

                          16KB

                        • memory/2272-146-0x00000152B4A70000-0x00000152B4AE0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2272-249-0x00000152B4AE0000-0x00000152B4B50000-memory.dmp
                          Filesize

                          448KB

                        • memory/2332-251-0x0000018A66CA0000-0x0000018A66D10000-memory.dmp
                          Filesize

                          448KB

                        • memory/2332-153-0x0000018A666C0000-0x0000018A66730000-memory.dmp
                          Filesize

                          448KB

                        • memory/2360-188-0x000002A307730000-0x000002A3077A0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2360-265-0x000002A3077A0000-0x000002A307810000-memory.dmp
                          Filesize

                          448KB

                        • memory/2384-190-0x0000018BDBF60000-0x0000018BDBFD0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2384-267-0x0000018BDC040000-0x0000018BDC0B0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2460-116-0x0000000000000000-mapping.dmp
                        • memory/2752-159-0x0000022D02070000-0x0000022D020E0000-memory.dmp
                          Filesize

                          448KB

                        • memory/2752-245-0x0000022D02420000-0x0000022D02490000-memory.dmp
                          Filesize

                          448KB

                        • memory/4408-198-0x0000000009350000-0x0000000009351000-memory.dmp
                          Filesize

                          4KB

                        • memory/4408-197-0x0000000000B50000-0x0000000000B5E000-memory.dmp
                          Filesize

                          56KB

                        • memory/4408-201-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4408-191-0x0000000000000000-mapping.dmp
                        • memory/4408-194-0x00000000001E0000-0x00000000001E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4408-199-0x0000000004B70000-0x0000000004B71000-memory.dmp
                          Filesize

                          4KB

                        • memory/4408-196-0x0000000000C20000-0x0000000000C21000-memory.dmp
                          Filesize

                          4KB

                        • memory/4520-214-0x0000000005580000-0x0000000005581000-memory.dmp
                          Filesize

                          4KB

                        • memory/4520-202-0x0000000000000000-mapping.dmp
                        • memory/4520-215-0x000000000AF00000-0x000000000AF01000-memory.dmp
                          Filesize

                          4KB

                        • memory/4724-218-0x0000000000400000-0x000000000042B000-memory.dmp
                          Filesize

                          172KB

                        • memory/4724-216-0x0000000000000000-mapping.dmp
                        • memory/4764-225-0x00000000001E0000-0x00000000001E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4764-221-0x0000000000000000-mapping.dmp
                        • memory/4896-227-0x0000000000000000-mapping.dmp
                        • memory/4896-230-0x00000000024F0000-0x00000000024F2000-memory.dmp
                          Filesize

                          8KB

                        • memory/5016-231-0x0000000000000000-mapping.dmp