Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/12/2022, 08:10

General

  • Target

    804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe

  • Size

    2.4MB

  • MD5

    6e10b6107066da8b83187a14c8b68b23

  • SHA1

    bfe5bb0d1fbd503226abf58fbd88e91e8f17ba05

  • SHA256

    804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e

  • SHA512

    6f4715008d918f0a940bae3970e072c39b16a6c8fb66f10bc32c4b611c93a437b3475646d0fafa3e814af6d5013a518ba5893c2c984b558f66733b4d03f83461

  • SSDEEP

    49152:jp3TkvTxVW0z7cby/T8uzPI57F0KaCz2avq7aYm:gWMBzPI57F03C5Ym

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes
  • embedded_hash

    8F56CD73F6B5CD5D7B17B0BA61E70A82

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Blocklisted process makes network request 3 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe
    "C:\Users\Admin\AppData\Local\Temp\804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll,start
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 20185
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:8
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2208
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4368
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k LocalService
        1⤵
          PID:5080
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\reference assemblies\microsoft\back-arrow-disabled.dll",alQWV1VWWVhB
            2⤵
              PID:4896

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\100__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml

                  Filesize

                  466B

                  MD5

                  865d649c74b05aae53850125d6c23b41

                  SHA1

                  2b4ab47d5eee5a74cfb70f8231502d97dd2d97e6

                  SHA256

                  547242ffdf9a49692c655c9af71b90a815a20a78f4121538552bd73e05eeb978

                  SHA512

                  7fd6ac21920c68848517573d4048171ee7948aa87e682c71c01ff4e96c099b2d1166df8c4f0ae3dde738b96b6dba67cf66b3cc913588bcf28cee3908e2a9b5a8

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\128__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml

                  Filesize

                  701B

                  MD5

                  acc1cdd85db5e94b98bdbf55e2df877a

                  SHA1

                  cbd2b8777c65dbc039f5048024bac42e29e8202c

                  SHA256

                  3388bb0959f8f8c1c9d1ce2a9a4a8f7a762c6546c7141cc24e558dafd9205f33

                  SHA512

                  cb304a8bec037e9061ec6623af02e4ba701fa035c54a75bde608c3b9f0e61b5cde1931d26cf4ce8a4e88593c4d67c9259e713dff1b74bacde49045fcc4bf5ae0

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\133__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml

                  Filesize

                  642B

                  MD5

                  2e6bc0bb92d72bb64372bf703942c24e

                  SHA1

                  d59d856f0f76d02e3d0f2dc96ee1174d2b7e87ea

                  SHA256

                  1a5de55d12383de8fcaeacfbc5d6e1b7f3ff71e8b4382263324e41b70a201fac

                  SHA512

                  c747f79f6e4093759ca0b08be25d9682df7e5e1fbbc5def834cc08614fe929fc9f9bac1ed07c71427836e0e9865962ce76aeb29875370d7cedc86bf2af18396c

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\148__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml

                  Filesize

                  719B

                  MD5

                  20eb056633ed3c2eb2af5e2c5054a8a4

                  SHA1

                  7224188699892b93b3279079730cdee7f68a2e47

                  SHA256

                  c131acc27ce65721d37af2124d77f8504d14a1fa3d6777621c19c5102134d564

                  SHA512

                  0e2d24ede949fa21ce0778971b94fc5a18f4dd85af530542eb7f6b792e06604cc9215c03d080078fe4800c0e6a734f0e9ba9391cb39de3d2c30d5fc584dd2797

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\6ad6114fddb5b38e8504b0183a428c4b_16efa387-a50f-4c14-af28-bdcb77494366

                  Filesize

                  1KB

                  MD5

                  a7a381aa22cc03afaf1817419a76f4aa

                  SHA1

                  f73115fd60cc4a5f51ec3563c340fe48cd455e50

                  SHA256

                  da7cc077beb57aa89904af9b7f3b6a501cd4826216fdd377af72f13e74e75552

                  SHA512

                  4aea6ea9b528e8a7ae8a61e73715806dd4d81299256d5e450d69cc16c7f5017f0d3a7f151798b5f0320b77c3ec9199e71d8d25714e8f86ccd55537b8e4a05e7b

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Daowpeywwstdp.tmp

                  Filesize

                  2.3MB

                  MD5

                  4cf8a5fb87b07d45e9dadccbcc20e741

                  SHA1

                  906bb9cd683531efb951800f5688306f518fb5ff

                  SHA256

                  f928068d51209a8d492fd3f5483d5ebaa240ac18af4ea58423acab1aca30d399

                  SHA512

                  801c09ed9f64ff5b0be9670f2cb822c22e086152efc079429462168dc14836052956769e809150ab946ede1913ce4343303c89d8d9db8280e0f1500f171adcb7

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml

                  Filesize

                  3KB

                  MD5

                  2dd9bafcbda61d5d509e48086cd0a986

                  SHA1

                  821e66af11451535cdc249ec1493e5bca4d2cad2

                  SHA256

                  2da208b3e33831803c1b830244636ca3d6cbc54fdd7e4add03059795c169002e

                  SHA512

                  6f79656269570b309a5697b007245dff4983e6c20b9c3857ba1cc088ad4f7aec3b465e5fafc4f97b584cca88f6984ef90bbbdc499c20440f0f15da04ea79d528

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\customizations.xml

                  Filesize

                  1KB

                  MD5

                  494911cc95a519e8870e4bb8e09f0ead

                  SHA1

                  28a2112f7102f51b75cc927f2b39c9cae68b717b

                  SHA256

                  c65e5536fe94e32553a7ac15969f679c0950d85840103e04f1886e436e2b053c

                  SHA512

                  b3b1433c71b3dd4825a0c62c1428a4c528f70014512169ef06eb207a3c20ecf80b6b627b52e50716a90c94f0f6695300497eb0b3fca13997663c35e49753ade2

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\msoutilstat.etw.man

                  Filesize

                  111KB

                  MD5

                  c1e8b625377c75454266f9d172d2f77d

                  SHA1

                  68ee3ac1b685d68bfdc434f430b6158a98073807

                  SHA256

                  7847e5ba06ca0a834454a3c62ec343dcaa4339e6ef2ed5bd42e460ade5331628

                  SHA512

                  1f04e28609f08a8616c7d1ebecfa6949f1eb939b29386365e72d4263dfd13fe81d036c8f9fce41f18b1e008f47b76c7278a00a770542411f751641fe7d756d21

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\overlay.png

                  Filesize

                  28KB

                  MD5

                  1f93b502e78190a2f496c2d9558e069d

                  SHA1

                  6ae6249493d36682270c0d5e3eb3c472fdd2766e

                  SHA256

                  5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e

                  SHA512

                  cf07724c203a82c9f202d53f63ea00ab0df2f97484bd3b9abe1a001f2e531f505ddd4ff8f2d5a2769dd9d2d60e9c1d03dd3ab5143542688f944cfd35c6f1cdf3

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\print_property.ico

                  Filesize

                  58KB

                  MD5

                  30d7062e069bc0a9b34f4034090c1aae

                  SHA1

                  e5fcedd8e4cc0463c0bc6912b1791f2876e28a61

                  SHA256

                  24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000

                  SHA512

                  85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6

                • C:\ProgramData\{1671AAA7-B856-DB35-F1BA-0081C45B4B58}\resource.xml

                  Filesize

                  1KB

                  MD5

                  6097c7d404561758417639b12d27baf9

                  SHA1

                  21d00beeae632bd9e507c9fa76d64ebfc72d4618

                  SHA256

                  df08eac8ede4a75785dcee3fc0819d22e2f9b6af07b2fe42149401aaa788f1d4

                  SHA512

                  b4716a20095942973f2ac292acf8693d6a68fdb96317438f057039a31d19de1030622b092b0f02b61a409a5b6581baf7506cd4c58f79c4c36cf01abc131cc3db

                • C:\Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

                  Filesize

                  2.4MB

                  MD5

                  f992a7aac67173cafc435fdc7aabf080

                  SHA1

                  71d9f2987a524bd201954dd4d8d616835be693e3

                  SHA256

                  3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419

                  SHA512

                  170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

                • \??\c:\program files (x86)\reference assemblies\microsoft\back-arrow-disabled.dll

                  Filesize

                  2.4MB

                  MD5

                  c23de9d8e58de32582a872129418b786

                  SHA1

                  80e1a6a112a6fe675857fae3df1b5167d0b8b06a

                  SHA256

                  24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3

                  SHA512

                  e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

                • \Program Files (x86)\Reference Assemblies\Microsoft\back-arrow-disabled.dll

                  Filesize

                  2.4MB

                  MD5

                  c23de9d8e58de32582a872129418b786

                  SHA1

                  80e1a6a112a6fe675857fae3df1b5167d0b8b06a

                  SHA256

                  24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3

                  SHA512

                  e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

                • \Program Files (x86)\Reference Assemblies\Microsoft\back-arrow-disabled.dll

                  Filesize

                  2.4MB

                  MD5

                  c23de9d8e58de32582a872129418b786

                  SHA1

                  80e1a6a112a6fe675857fae3df1b5167d0b8b06a

                  SHA256

                  24c046c0d228d7594df2d76d5f122b4444f9e846ba41ce20f33f2746b60e17c3

                  SHA512

                  e220bd74b5361a0c1b6c3665d0599a31e4cd88580757456cd50b8b0a55383e86e050cecf99321a85cad78257d78ed98e9114f8fa7536c53487f57396f7d1e995

                • \Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

                  Filesize

                  2.4MB

                  MD5

                  f992a7aac67173cafc435fdc7aabf080

                  SHA1

                  71d9f2987a524bd201954dd4d8d616835be693e3

                  SHA256

                  3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419

                  SHA512

                  170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

                • \Users\Admin\AppData\Local\Temp\Iseiuaqptde.dll

                  Filesize

                  2.4MB

                  MD5

                  f992a7aac67173cafc435fdc7aabf080

                  SHA1

                  71d9f2987a524bd201954dd4d8d616835be693e3

                  SHA256

                  3e0cc5b098e28808a98128f7b1453cef51525572bd3fde5966de562735d03419

                  SHA512

                  170d1b62160bed7e8a40a2023eda1e5ad1fb823c3ea54c7d66cbd218f0dfdcf4723ede20908ac06684478430a99f1ea538775b11303b56dcee2a3dc7c664216e

                • memory/8-291-0x00000000006E0000-0x00000000008F9000-memory.dmp

                  Filesize

                  2.1MB

                • memory/8-292-0x0000025407A10000-0x0000025407C3A000-memory.dmp

                  Filesize

                  2.2MB

                • memory/2772-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-116-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-143-0x0000000002700000-0x0000000002A85000-memory.dmp

                  Filesize

                  3.5MB

                • memory/2772-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-161-0x0000000000400000-0x0000000000791000-memory.dmp

                  Filesize

                  3.6MB

                • memory/2772-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-117-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-173-0x0000000002700000-0x0000000002A85000-memory.dmp

                  Filesize

                  3.5MB

                • memory/2772-175-0x0000000000400000-0x0000000000791000-memory.dmp

                  Filesize

                  3.6MB

                • memory/2772-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-141-0x0000000000C00000-0x0000000000E51000-memory.dmp

                  Filesize

                  2.3MB

                • memory/2772-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2772-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-225-0x0000000000C30000-0x0000000000EA1000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4772-293-0x0000000005390000-0x0000000005AB5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4772-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-260-0x0000000000C30000-0x0000000000EA1000-memory.dmp

                  Filesize

                  2.4MB

                • memory/4772-277-0x0000000005390000-0x0000000005AB5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/4772-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4772-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/5080-391-0x0000000003D80000-0x00000000044A5000-memory.dmp

                  Filesize

                  7.1MB

                • memory/5080-357-0x0000000003300000-0x0000000003571000-memory.dmp

                  Filesize

                  2.4MB