Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16-08-2021 09:10

General

  • Target

    a1d1f7a632006fcdb0ed9d0c635a8f0b.exe

  • Size

    181KB

  • MD5

    a1d1f7a632006fcdb0ed9d0c635a8f0b

  • SHA1

    d4b2ea32696887a8c0fadcbd9616a50311b1826d

  • SHA256

    1a471836c805bbee8b08512c7a813aa00c5df6dcb11888d39bf652afb7ab36f6

  • SHA512

    97c192e933de166ca442174288e272bd9625200b51ec9be53323d5d2fb2edbced5f692ec2ec8d7205dd3e02c4202f5721bdd04aeb251054e069f930a72f81be7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 32 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1d1f7a632006fcdb0ed9d0c635a8f0b.exe
    "C:\Users\Admin\AppData\Local\Temp\a1d1f7a632006fcdb0ed9d0c635a8f0b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Users\Admin\AppData\Local\Temp\a1d1f7a632006fcdb0ed9d0c635a8f0b.exe
      "C:\Users\Admin\AppData\Local\Temp\a1d1f7a632006fcdb0ed9d0c635a8f0b.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2224
  • C:\Users\Admin\AppData\Local\Temp\2B47.exe
    C:\Users\Admin\AppData\Local\Temp\2B47.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:4080
  • C:\Users\Admin\AppData\Local\Temp\3337.exe
    C:\Users\Admin\AppData\Local\Temp\3337.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2240
  • C:\Users\Admin\AppData\Local\Temp\378D.exe
    C:\Users\Admin\AppData\Local\Temp\378D.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 732
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 744
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 844
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 864
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1184
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2780
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1304
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1296
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1248
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1296
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1336
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1236
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1228
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1216
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1180
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1136
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1320
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1228
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1268
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1184
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1240
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1324
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1272
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1268
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1428
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1356
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1324
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1336
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1396
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1912
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1276
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1388
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1432
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1420
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1528
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:2684
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:1124
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:912
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:1952
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:1692
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:2700
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:944
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:3016
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:1480

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Defense Evasion

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Credential Access

                    Credentials in Files

                    2
                    T1081

                    Discovery

                    Query Registry

                    4
                    T1012

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    System Information Discovery

                    3
                    T1082

                    Peripheral Device Discovery

                    1
                    T1120

                    Collection

                    Data from Local System

                    2
                    T1005

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\2B47.exe
                      MD5

                      1e0e17859c0a32b53ae0bafc4e55563b

                      SHA1

                      590ef228cac03f6da4bdbc1b7e40557d61a3a043

                      SHA256

                      76d03b8781c66aa25d74ec788dc9c1370ee01000926882c8be7f89f5dcb01d31

                      SHA512

                      4494ad485fb73538b3e6f5e8e94a073bdddaf6ac50877051078646828c80b71a1e50a09d0ce84f65b021cc1bb0b4d22f317c2eef0dc29513ee927a9c8e7cdf72

                    • C:\Users\Admin\AppData\Local\Temp\2B47.exe
                      MD5

                      1e0e17859c0a32b53ae0bafc4e55563b

                      SHA1

                      590ef228cac03f6da4bdbc1b7e40557d61a3a043

                      SHA256

                      76d03b8781c66aa25d74ec788dc9c1370ee01000926882c8be7f89f5dcb01d31

                      SHA512

                      4494ad485fb73538b3e6f5e8e94a073bdddaf6ac50877051078646828c80b71a1e50a09d0ce84f65b021cc1bb0b4d22f317c2eef0dc29513ee927a9c8e7cdf72

                    • C:\Users\Admin\AppData\Local\Temp\3337.exe
                      MD5

                      fa2170ab2dfa330d961cccf8e93c757b

                      SHA1

                      d3fd7ae0be7954a547169e29a44d467f14dfb340

                      SHA256

                      78f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0

                      SHA512

                      3880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e

                    • C:\Users\Admin\AppData\Local\Temp\3337.exe
                      MD5

                      fa2170ab2dfa330d961cccf8e93c757b

                      SHA1

                      d3fd7ae0be7954a547169e29a44d467f14dfb340

                      SHA256

                      78f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0

                      SHA512

                      3880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e

                    • C:\Users\Admin\AppData\Local\Temp\378D.exe
                      MD5

                      dc3688fa0caa86c31c983d5d531b0b85

                      SHA1

                      d5ee18441cd152a649298761d3955810f610767f

                      SHA256

                      1780d48983335a99ff7054cae2740df7b87e3412d46e99e6a1160769946ff2f8

                      SHA512

                      9a547d5eec2c091b068740227ba566c8ddda9ff29fe6f93c7f1a11d5224fc047db5d8e825d831cd4e2c741b6998bbcb98e4c91e93f4dc8490a6bb447b35cda51

                    • C:\Users\Admin\AppData\Local\Temp\378D.exe
                      MD5

                      dc3688fa0caa86c31c983d5d531b0b85

                      SHA1

                      d5ee18441cd152a649298761d3955810f610767f

                      SHA256

                      1780d48983335a99ff7054cae2740df7b87e3412d46e99e6a1160769946ff2f8

                      SHA512

                      9a547d5eec2c091b068740227ba566c8ddda9ff29fe6f93c7f1a11d5224fc047db5d8e825d831cd4e2c741b6998bbcb98e4c91e93f4dc8490a6bb447b35cda51

                    • \Users\Admin\AppData\LocalLow\sqlite3.dll
                      MD5

                      f964811b68f9f1487c2b41e1aef576ce

                      SHA1

                      b423959793f14b1416bc3b7051bed58a1034025f

                      SHA256

                      83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                      SHA512

                      565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                    • memory/912-153-0x0000000000000000-mapping.dmp
                    • memory/912-154-0x0000000002CB0000-0x0000000002CB7000-memory.dmp
                      Filesize

                      28KB

                    • memory/912-155-0x0000000002CA0000-0x0000000002CAB000-memory.dmp
                      Filesize

                      44KB

                    • memory/944-174-0x00000000028D0000-0x00000000028D4000-memory.dmp
                      Filesize

                      16KB

                    • memory/944-175-0x00000000028C0000-0x00000000028C9000-memory.dmp
                      Filesize

                      36KB

                    • memory/944-173-0x0000000000000000-mapping.dmp
                    • memory/1124-150-0x0000000000000000-mapping.dmp
                    • memory/1124-152-0x0000000000B70000-0x0000000000B7C000-memory.dmp
                      Filesize

                      48KB

                    • memory/1124-151-0x0000000000B80000-0x0000000000B87000-memory.dmp
                      Filesize

                      28KB

                    • memory/1480-180-0x0000000002F30000-0x0000000002F35000-memory.dmp
                      Filesize

                      20KB

                    • memory/1480-179-0x0000000000000000-mapping.dmp
                    • memory/1480-181-0x0000000002F20000-0x0000000002F29000-memory.dmp
                      Filesize

                      36KB

                    • memory/1692-168-0x0000000003050000-0x0000000003055000-memory.dmp
                      Filesize

                      20KB

                    • memory/1692-169-0x0000000003040000-0x0000000003049000-memory.dmp
                      Filesize

                      36KB

                    • memory/1692-164-0x0000000000000000-mapping.dmp
                    • memory/1832-136-0x0000000000000000-mapping.dmp
                    • memory/1832-145-0x0000000004A20000-0x0000000004AB1000-memory.dmp
                      Filesize

                      580KB

                    • memory/1832-146-0x0000000000400000-0x0000000002D05000-memory.dmp
                      Filesize

                      41.0MB

                    • memory/1952-156-0x0000000000000000-mapping.dmp
                    • memory/1952-162-0x0000000001010000-0x0000000001019000-memory.dmp
                      Filesize

                      36KB

                    • memory/1952-163-0x0000000001000000-0x000000000100F000-memory.dmp
                      Filesize

                      60KB

                    • memory/2224-114-0x0000000000400000-0x0000000000409000-memory.dmp
                      Filesize

                      36KB

                    • memory/2224-115-0x0000000000402E1A-mapping.dmp
                    • memory/2240-128-0x0000000000000000-mapping.dmp
                    • memory/2240-143-0x0000000006290000-0x0000000006291000-memory.dmp
                      Filesize

                      4KB

                    • memory/2240-142-0x0000000077320000-0x00000000774AE000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/2240-133-0x0000000001340000-0x0000000001341000-memory.dmp
                      Filesize

                      4KB

                    • memory/2684-149-0x0000000002C00000-0x0000000002C6B000-memory.dmp
                      Filesize

                      428KB

                    • memory/2684-148-0x0000000002C70000-0x0000000002CE4000-memory.dmp
                      Filesize

                      464KB

                    • memory/2684-147-0x0000000000000000-mapping.dmp
                    • memory/2700-170-0x0000000000000000-mapping.dmp
                    • memory/2700-172-0x0000000000F20000-0x0000000000F2C000-memory.dmp
                      Filesize

                      48KB

                    • memory/2700-171-0x0000000000F30000-0x0000000000F36000-memory.dmp
                      Filesize

                      24KB

                    • memory/3016-177-0x00000000001E0000-0x00000000001E5000-memory.dmp
                      Filesize

                      20KB

                    • memory/3016-176-0x0000000000000000-mapping.dmp
                    • memory/3016-178-0x00000000001D0000-0x00000000001D9000-memory.dmp
                      Filesize

                      36KB

                    • memory/3052-117-0x0000000000AD0000-0x0000000000AE6000-memory.dmp
                      Filesize

                      88KB

                    • memory/3188-116-0x0000000002CC0000-0x0000000002D6E000-memory.dmp
                      Filesize

                      696KB

                    • memory/4080-166-0x0000000007320000-0x0000000007321000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-124-0x0000000005EB0000-0x0000000005EB1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-126-0x0000000005850000-0x0000000005851000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-125-0x00000000057F0000-0x00000000057F1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-165-0x0000000007200000-0x0000000007201000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-127-0x00000000058A0000-0x00000000058A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-131-0x0000000005A50000-0x0000000005A51000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-167-0x00000000072A0000-0x00000000072A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-123-0x0000000077320000-0x00000000774AE000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/4080-121-0x00000000003E0000-0x00000000003E1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-132-0x0000000005890000-0x0000000005891000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-161-0x0000000007010000-0x0000000007011000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-160-0x0000000007A00000-0x0000000007A01000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-118-0x0000000000000000-mapping.dmp
                    • memory/4080-158-0x00000000074D0000-0x00000000074D1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4080-157-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
                      Filesize

                      4KB