Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    337s
  • max time network
    364s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    10-11-2021 14:52

General

  • Target

    9d608ed375a27a573add396e92f4f8e831cb71d344fa21f14b04c42788946511.exe

  • Size

    4.0MB

  • MD5

    4263d12dd5f4d595e9efae16102d9b6d

  • SHA1

    cbf93a6ea05b8da4214fd847c8f209151a0b76bd

  • SHA256

    9d608ed375a27a573add396e92f4f8e831cb71d344fa21f14b04c42788946511

  • SHA512

    d548edc17b06d9f047f48bb3190d0840b15b510784965acfa38fbf2b69cf975bc3ea2370484d26eefe79a8e4609a337dede4a783216e8b8de5fb07bcc3204018

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2688
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2604
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2584
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2500
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2364
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2340
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1860
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1416
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1292
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                  • Modifies registry class
                  PID:1232
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1080
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:796
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:1004
                    • C:\Users\Admin\AppData\Local\Temp\9d608ed375a27a573add396e92f4f8e831cb71d344fa21f14b04c42788946511.exe
                      "C:\Users\Admin\AppData\Local\Temp\9d608ed375a27a573add396e92f4f8e831cb71d344fa21f14b04c42788946511.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4236
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:3684
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe"
                        2⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4008
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DownFlSetup133.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DownFlSetup133.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2308
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub1.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub1.exe"
                        2⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:1628
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lows.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\lows.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:2172
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 656
                          3⤵
                          • Drops file in Windows directory
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4320
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 772
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4904
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 808
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4104
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 780
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4120
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1072
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4540
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 1064
                          3⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1684
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                      1⤵
                      • Process spawned unexpected child process
                      • Suspicious use of WriteProcessMemory
                      PID:3168
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                        2⤵
                        • Loads dropped DLL
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1496

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Credential Access

                    Credentials in Files

                    1
                    T1081

                    Discovery

                    System Information Discovery

                    4
                    T1082

                    Query Registry

                    2
                    T1012

                    Peripheral Device Discovery

                    1
                    T1120

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                      MD5

                      d684998e6678f1afb2f7976d0fa0edd6

                      SHA1

                      acbce6b78986e0308a147562e48f178dfb51ab7f

                      SHA256

                      959c377258ae9d3c71bfe97cf6595f389c5230af13b93f0fea697ea8b7dc2abf

                      SHA512

                      2a5e6597995255c03cf23898e0f9eb85bcbb0dc9491c3adaf87f2116b8d92bd8f233c3adc10803be97dfcf604dd4c256bf6602a2a01bd584769d5893c7b2c427

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                      MD5

                      d684998e6678f1afb2f7976d0fa0edd6

                      SHA1

                      acbce6b78986e0308a147562e48f178dfb51ab7f

                      SHA256

                      959c377258ae9d3c71bfe97cf6595f389c5230af13b93f0fea697ea8b7dc2abf

                      SHA512

                      2a5e6597995255c03cf23898e0f9eb85bcbb0dc9491c3adaf87f2116b8d92bd8f233c3adc10803be97dfcf604dd4c256bf6602a2a01bd584769d5893c7b2c427

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DownFlSetup133.exe
                      MD5

                      365638367e959033167959cd5c10ca1a

                      SHA1

                      456bd7101f0a560dd3172de8a160b168b9f0a45c

                      SHA256

                      fe02ea4f17676b8c6f303cee1d9cbf54656c2f6bbb56be9818c493b635c32273

                      SHA512

                      d6382b87a4fdd59b6acf09357234a5163d8ad68ece53879614fe85a807d305ef587c043f38ff3552fe8e6d38bd20525fbbba69b792c723d2ad7768a55c9aac40

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\DownFlSetup133.exe
                      MD5

                      365638367e959033167959cd5c10ca1a

                      SHA1

                      456bd7101f0a560dd3172de8a160b168b9f0a45c

                      SHA256

                      fe02ea4f17676b8c6f303cee1d9cbf54656c2f6bbb56be9818c493b635c32273

                      SHA512

                      d6382b87a4fdd59b6acf09357234a5163d8ad68ece53879614fe85a807d305ef587c043f38ff3552fe8e6d38bd20525fbbba69b792c723d2ad7768a55c9aac40

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lows.exe
                      MD5

                      4a10a29b5bd5a3e3665e8114b15c302e

                      SHA1

                      1fad984db744ae990a3dac9054f0213d4cf5d02d

                      SHA256

                      cf1e74162bb4ec83f3cae74cfc0852274b5de8be25eb61894bce8c1fa38e8c7d

                      SHA512

                      2200fd3dc676ee2aaf0a02d497bcba4955d88046360887ddd9a208bfc60c86d51986fef4115a77a1d4b07ad95c944e013963fd64053cc3d72e29742f72bf4865

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\lows.exe
                      MD5

                      4a10a29b5bd5a3e3665e8114b15c302e

                      SHA1

                      1fad984db744ae990a3dac9054f0213d4cf5d02d

                      SHA256

                      cf1e74162bb4ec83f3cae74cfc0852274b5de8be25eb61894bce8c1fa38e8c7d

                      SHA512

                      2200fd3dc676ee2aaf0a02d497bcba4955d88046360887ddd9a208bfc60c86d51986fef4115a77a1d4b07ad95c944e013963fd64053cc3d72e29742f72bf4865

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe
                      MD5

                      66a17abdea10774b17f6e86ffe0e5c38

                      SHA1

                      48653bfe6cd3440800b5fd3149418b1024fb09b6

                      SHA256

                      bd264115a06569110f3ed280ca2317560f3189c6203ee9e877512b0ad3f82baf

                      SHA512

                      f3bb8f94eb8f2b628716e8c72292508eef7afba985238ca1b26b5e293d0e1533cdba4568b551b4097de304682261d3c97a5c86257ed0b0962e96fc2cc2109b62

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\md1_1eaf.exe
                      MD5

                      66a17abdea10774b17f6e86ffe0e5c38

                      SHA1

                      48653bfe6cd3440800b5fd3149418b1024fb09b6

                      SHA256

                      bd264115a06569110f3ed280ca2317560f3189c6203ee9e877512b0ad3f82baf

                      SHA512

                      f3bb8f94eb8f2b628716e8c72292508eef7afba985238ca1b26b5e293d0e1533cdba4568b551b4097de304682261d3c97a5c86257ed0b0962e96fc2cc2109b62

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub1.exe
                      MD5

                      fd13346d932febc588c1174e2ad0044f

                      SHA1

                      0f7515f2ccc4c3b0f72845746a68bd415d9a8c26

                      SHA256

                      1792eb23d98899601a4136e26151c7567b79d13663c20f8ed1fff3352472227a

                      SHA512

                      c36851fd657443bbb2c6bf327d88da206cdce88bf61e30489ed34a083174b3afd93574d1fbee53049b969bca31f4fc14fdbeca63480fb84a422bf02d192683c7

                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub1.exe
                      MD5

                      fd13346d932febc588c1174e2ad0044f

                      SHA1

                      0f7515f2ccc4c3b0f72845746a68bd415d9a8c26

                      SHA256

                      1792eb23d98899601a4136e26151c7567b79d13663c20f8ed1fff3352472227a

                      SHA512

                      c36851fd657443bbb2c6bf327d88da206cdce88bf61e30489ed34a083174b3afd93574d1fbee53049b969bca31f4fc14fdbeca63480fb84a422bf02d192683c7

                    • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                      MD5

                      291e4a775d05645fce92862291010ff6

                      SHA1

                      6668314aed9d1d6422bd087e45bd79eac9570673

                      SHA256

                      fc38e29e9c9ec4bbdc85ee591368e5214b9f6cc7b5b739ad1db76851f530e42e

                      SHA512

                      dbabbe2a22438a9462c0acf8c553a8b8cd8f600ea9ef6caa813e527505a51d603d191f2edc4a69c2cf214badff42d62eb4a2ef8757a90cf1f86e0beb452f3fb5

                    • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                      MD5

                      d2c3e38d64273ea56d503bb3fb2a8b5d

                      SHA1

                      177da7d99381bbc83ede6b50357f53944240d862

                      SHA256

                      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                      SHA512

                      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                    • \Users\Admin\AppData\Local\Temp\sqlite.dll
                      MD5

                      d2c3e38d64273ea56d503bb3fb2a8b5d

                      SHA1

                      177da7d99381bbc83ede6b50357f53944240d862

                      SHA256

                      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                      SHA512

                      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                    • memory/396-249-0x00000000006D0000-0x00000000006E5000-memory.dmp
                      Filesize

                      84KB

                    • memory/796-149-0x00000286DA9A0000-0x00000286DA9A2000-memory.dmp
                      Filesize

                      8KB

                    • memory/796-148-0x00000286DA9A0000-0x00000286DA9A2000-memory.dmp
                      Filesize

                      8KB

                    • memory/796-232-0x00000286DB350000-0x00000286DB3C2000-memory.dmp
                      Filesize

                      456KB

                    • memory/796-171-0x00000286DB260000-0x00000286DB2D2000-memory.dmp
                      Filesize

                      456KB

                    • memory/1004-216-0x00000218CA5A0000-0x00000218CA5A2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1004-167-0x00000218CAC40000-0x00000218CACB2000-memory.dmp
                      Filesize

                      456KB

                    • memory/1004-141-0x00000218CA5A0000-0x00000218CA5A2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1004-140-0x00000218CA5A0000-0x00000218CA5A2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1004-228-0x00000218CACC0000-0x00000218CAD32000-memory.dmp
                      Filesize

                      456KB

                    • memory/1080-146-0x000001E9DB290000-0x000001E9DB292000-memory.dmp
                      Filesize

                      8KB

                    • memory/1080-170-0x000001E9DBD70000-0x000001E9DBDE2000-memory.dmp
                      Filesize

                      456KB

                    • memory/1080-231-0x000001E9DBE60000-0x000001E9DBED2000-memory.dmp
                      Filesize

                      456KB

                    • memory/1080-147-0x000001E9DB290000-0x000001E9DB292000-memory.dmp
                      Filesize

                      8KB

                    • memory/1232-154-0x0000024644D10000-0x0000024644D12000-memory.dmp
                      Filesize

                      8KB

                    • memory/1232-155-0x0000024644D10000-0x0000024644D12000-memory.dmp
                      Filesize

                      8KB

                    • memory/1232-174-0x0000024645020000-0x0000024645092000-memory.dmp
                      Filesize

                      456KB

                    • memory/1232-235-0x0000024645610000-0x0000024645682000-memory.dmp
                      Filesize

                      456KB

                    • memory/1292-157-0x00000208C91E0000-0x00000208C91E2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1292-156-0x00000208C91E0000-0x00000208C91E2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1292-175-0x00000208C9880000-0x00000208C98F2000-memory.dmp
                      Filesize

                      456KB

                    • memory/1292-236-0x00000208C9DB0000-0x00000208C9E22000-memory.dmp
                      Filesize

                      456KB

                    • memory/1416-150-0x000001F8E4EE0000-0x000001F8E4EE2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1416-172-0x000001F8E50C0000-0x000001F8E5132000-memory.dmp
                      Filesize

                      456KB

                    • memory/1416-151-0x000001F8E4EE0000-0x000001F8E4EE2000-memory.dmp
                      Filesize

                      8KB

                    • memory/1416-233-0x000001F8E5800000-0x000001F8E5872000-memory.dmp
                      Filesize

                      456KB

                    • memory/1496-130-0x0000000004F76000-0x0000000005077000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/1496-131-0x00000000036B0000-0x000000000370D000-memory.dmp
                      Filesize

                      372KB

                    • memory/1496-124-0x0000000000000000-mapping.dmp
                    • memory/1628-243-0x00000000001D0000-0x00000000001D9000-memory.dmp
                      Filesize

                      36KB

                    • memory/1628-244-0x0000000000400000-0x00000000016C4000-memory.dmp
                      Filesize

                      18.8MB

                    • memory/1628-239-0x0000000000000000-mapping.dmp
                    • memory/1860-234-0x000002149FFB0000-0x00000214A0022000-memory.dmp
                      Filesize

                      456KB

                    • memory/1860-153-0x000002149F240000-0x000002149F242000-memory.dmp
                      Filesize

                      8KB

                    • memory/1860-152-0x000002149F240000-0x000002149F242000-memory.dmp
                      Filesize

                      8KB

                    • memory/1860-173-0x000002149F560000-0x000002149F5D2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2172-245-0x0000000000000000-mapping.dmp
                    • memory/2172-250-0x00000000017E0000-0x000000000192A000-memory.dmp
                      Filesize

                      1.3MB

                    • memory/2172-251-0x0000000000400000-0x00000000016CF000-memory.dmp
                      Filesize

                      18.8MB

                    • memory/2308-203-0x0000000000000000-mapping.dmp
                    • memory/2308-206-0x0000000000180000-0x0000000000181000-memory.dmp
                      Filesize

                      4KB

                    • memory/2308-208-0x0000000000890000-0x0000000000891000-memory.dmp
                      Filesize

                      4KB

                    • memory/2308-209-0x00000000021E0000-0x00000000021E2000-memory.dmp
                      Filesize

                      8KB

                    • memory/2340-169-0x0000023740F80000-0x0000023740FF2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2340-144-0x0000023740690000-0x0000023740692000-memory.dmp
                      Filesize

                      8KB

                    • memory/2340-145-0x0000023740690000-0x0000023740692000-memory.dmp
                      Filesize

                      8KB

                    • memory/2340-230-0x00000237414B0000-0x0000023741522000-memory.dmp
                      Filesize

                      456KB

                    • memory/2364-229-0x0000027E80730000-0x0000027E807A2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2364-168-0x0000027E80640000-0x0000027E806B2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2364-142-0x0000027E80150000-0x0000027E80152000-memory.dmp
                      Filesize

                      8KB

                    • memory/2364-143-0x0000027E80150000-0x0000027E80152000-memory.dmp
                      Filesize

                      8KB

                    • memory/2500-227-0x000001F2A8F10000-0x000001F2A8F82000-memory.dmp
                      Filesize

                      456KB

                    • memory/2500-164-0x000001F2A8880000-0x000001F2A88F2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2500-136-0x000001F2A8500000-0x000001F2A8502000-memory.dmp
                      Filesize

                      8KB

                    • memory/2500-137-0x000001F2A8500000-0x000001F2A8502000-memory.dmp
                      Filesize

                      8KB

                    • memory/2500-215-0x000001F2A8500000-0x000001F2A8502000-memory.dmp
                      Filesize

                      8KB

                    • memory/2584-159-0x000001B4AAAF0000-0x000001B4AAAF2000-memory.dmp
                      Filesize

                      8KB

                    • memory/2584-158-0x000001B4AAAF0000-0x000001B4AAAF2000-memory.dmp
                      Filesize

                      8KB

                    • memory/2584-237-0x000001B4AC1A0000-0x000001B4AC212000-memory.dmp
                      Filesize

                      456KB

                    • memory/2584-176-0x000001B4ABB40000-0x000001B4ABBB2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2604-161-0x000001C608FC0000-0x000001C608FC2000-memory.dmp
                      Filesize

                      8KB

                    • memory/2604-163-0x000001C608FC0000-0x000001C608FC2000-memory.dmp
                      Filesize

                      8KB

                    • memory/2604-166-0x000001C609570000-0x000001C6095E2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2604-238-0x000001C609930000-0x000001C6099A2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2688-200-0x000001AEDF3E0000-0x000001AEDF3FB000-memory.dmp
                      Filesize

                      108KB

                    • memory/2688-139-0x000001AEDF390000-0x000001AEDF392000-memory.dmp
                      Filesize

                      8KB

                    • memory/2688-138-0x000001AEDF390000-0x000001AEDF392000-memory.dmp
                      Filesize

                      8KB

                    • memory/2688-165-0x000001AEDF640000-0x000001AEDF6B2000-memory.dmp
                      Filesize

                      456KB

                    • memory/2688-135-0x00007FF7CA584060-mapping.dmp
                    • memory/2688-196-0x000001AEDF390000-0x000001AEDF392000-memory.dmp
                      Filesize

                      8KB

                    • memory/2688-197-0x000001AEDF390000-0x000001AEDF392000-memory.dmp
                      Filesize

                      8KB

                    • memory/2688-201-0x000001AEE1D00000-0x000001AEE1E05000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/3684-120-0x0000000000000000-mapping.dmp
                    • memory/4008-177-0x0000000003C90000-0x0000000003CA0000-memory.dmp
                      Filesize

                      64KB

                    • memory/4008-132-0x0000000000030000-0x0000000000033000-memory.dmp
                      Filesize

                      12KB

                    • memory/4008-198-0x0000000004EA0000-0x0000000004EA8000-memory.dmp
                      Filesize

                      32KB

                    • memory/4008-202-0x0000000004DC0000-0x0000000004DC8000-memory.dmp
                      Filesize

                      32KB

                    • memory/4008-195-0x0000000004DC0000-0x0000000004DC8000-memory.dmp
                      Filesize

                      32KB

                    • memory/4008-194-0x0000000004DC0000-0x0000000004DC8000-memory.dmp
                      Filesize

                      32KB

                    • memory/4008-183-0x0000000003E30000-0x0000000003E40000-memory.dmp
                      Filesize

                      64KB

                    • memory/4008-199-0x0000000004DC0000-0x0000000004DC8000-memory.dmp
                      Filesize

                      32KB

                    • memory/4008-127-0x0000000000000000-mapping.dmp
                    • memory/4236-119-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4236-118-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4624-214-0x000001F680160000-0x000001F680164000-memory.dmp
                      Filesize

                      16KB

                    • memory/4624-162-0x000001F6801D0000-0x000001F680242000-memory.dmp
                      Filesize

                      456KB

                    • memory/4624-134-0x000001F680250000-0x000001F680252000-memory.dmp
                      Filesize

                      8KB

                    • memory/4624-133-0x000001F680250000-0x000001F680252000-memory.dmp
                      Filesize

                      8KB

                    • memory/4624-211-0x000001F680160000-0x000001F680161000-memory.dmp
                      Filesize

                      4KB

                    • memory/4624-212-0x000001F680170000-0x000001F680174000-memory.dmp
                      Filesize

                      16KB

                    • memory/4624-210-0x000001F680170000-0x000001F680174000-memory.dmp
                      Filesize

                      16KB

                    • memory/4624-160-0x000001F680110000-0x000001F68015D000-memory.dmp
                      Filesize

                      308KB