Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2022, 09:26

General

  • Target

    8b0f52e9c1e77d9a28a42c37b9e0f85e.exe

  • Size

    215KB

  • MD5

    8b0f52e9c1e77d9a28a42c37b9e0f85e

  • SHA1

    2366e4199e5337a4372d70ad61e9b0b5b4ebcbd3

  • SHA256

    5358987e29bbc904b8a14e89db649725e8fd97c2b2b369a30a3a3843357c76bf

  • SHA512

    d683fb13efc93431a81ea9f98a37d95471df12bc10f5c7db66f9a309613a16e7c6c062bea473363c8e4fc3f67bd0508e51077be326926f265d9cb5c800b331c3

  • SSDEEP

    3072:MhlgLV5saR9MAmVtSBS40za9JIOJXKaNRAtOba+OljcbImdzmuX:M3gLV5KAmVt5gnJX90/ljcbXF

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b0f52e9c1e77d9a28a42c37b9e0f85e.exe
    "C:\Users\Admin\AppData\Local\Temp\8b0f52e9c1e77d9a28a42c37b9e0f85e.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1800
  • C:\Users\Admin\AppData\Local\Temp\E767.exe
    C:\Users\Admin\AppData\Local\Temp\E767.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23949
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 528
      2⤵
      • Program crash
      PID:3832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3096 -ip 3096
    1⤵
      PID:2180
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1908
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k LocalService
        1⤵
        • Loads dropped DLL
        PID:3972
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\aic_file_icons.dll",RzUSQTE2
          2⤵
            PID:4856

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons.dll

                Filesize

                726KB

                MD5

                6014e6dfed68030eda7da4d3574f91ec

                SHA1

                88792bb19cf3c0885ffd24ac4f5707d505910c1a

                SHA256

                1c6c7ab3da054f0a76ecea29c7e61ab38d81b2d8855f97a1853629436a8ac2c7

                SHA512

                b6c6dd6534a17699d120dbfe698caa0920771463e55ee11e5b15ba983045a0d271e247e3ce626caa67a2cb813259d2562eeaaecc3c0db45956eefe523271ab62

              • C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons.dll

                Filesize

                726KB

                MD5

                6014e6dfed68030eda7da4d3574f91ec

                SHA1

                88792bb19cf3c0885ffd24ac4f5707d505910c1a

                SHA256

                1c6c7ab3da054f0a76ecea29c7e61ab38d81b2d8855f97a1853629436a8ac2c7

                SHA512

                b6c6dd6534a17699d120dbfe698caa0920771463e55ee11e5b15ba983045a0d271e247e3ce626caa67a2cb813259d2562eeaaecc3c0db45956eefe523271ab62

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.AsyncTextService_10.0.19041.1023_neutral__8wekyb3d8bbwe.xml

                Filesize

                2KB

                MD5

                2240070d6603ab019cd125005cf38b7b

                SHA1

                ca96d028f51a7d5ec16630b48935f26c72794b0a

                SHA256

                7b3b1b641ebbda5397a11af86cb347b0f644ab439341c62b1c81d6990e6f75bc

                SHA512

                95c6f48f717d9103d30c31e00b7ff3a0d235693a8fffed772c0a0c39107bf3003ac84d6c78e2af566d91a88fa523dcc2c523dcc707d19fc77799832d548f330c

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe.xml

                Filesize

                843B

                MD5

                8a33c96712ba9c043f7a07d4c437a3fd

                SHA1

                dbd78a66c461017ee26a751925f9cecdea2590da

                SHA256

                eb8b0de59dd2efc380f7081af8975f37a83ee72c9c06ef25873f63d224adea1e

                SHA512

                7b9a15d219e4a5cd9146f8e7ae1d7c3b6f843ed060edf52e4928e349edd821a2d527f8f8402f774559f6cf282c83b751f02d2feaf9e040771c07bc4038a59e5a

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe.xml

                Filesize

                27KB

                MD5

                539930de67b99bab23fe2c67000eeddb

                SHA1

                6b0e5ece46ecb0b019ec71caa44facf122647059

                SHA256

                2f578443ca2045e8432f4a39bcd367ae343405e8daf368dff91e9198fa1a658c

                SHA512

                ddddcd7011ad0fb53fc816056a6df2045a7956158c009d8a708eafd0b2eaeccc55a847c96894ee04542315cec373165efc0e331da6316ceb9e5768f8861946ce

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftNotepad.xml

                Filesize

                957B

                MD5

                06f405331f1f99bd455f4afa7b8ee0cc

                SHA1

                815d8d81c01208aef4bc1a0048b2d4f4171b26f6

                SHA256

                b752d2c5a3c66c338fd6cd92224d5995be0eac8fd47092b8cd6ea2cc28a5e790

                SHA512

                a2a771f97346a5db7ee8e948cba2c9e223848e1c395eb335a6e3609739c125e0414e7a254f5ac81ca4a28b04cf4e631ee69edaaf24ef534b96c01c30f96c3a2c

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOffice2010Win64.xml

                Filesize

                71KB

                MD5

                490d1e0a28234dcd02db60d5a87f0691

                SHA1

                6edc0f7aa19150b49df1b96b5c6bbee036c0ef7a

                SHA256

                06ce8cb39081cd09df95911494f46ae85b27e37e4f83aa9c80b887bf69e87e22

                SHA512

                0ea4a0b0030371c031de694df115a284fa2d3a7697071072e2a7d83afbb60201313787e4d537a6111ba716e78d9dcfcac523633e2667bc00bbe1b125fb6641eb

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOffice2013BackupWin64.xml

                Filesize

                12KB

                MD5

                d24bea7d3b999f28e375d1d061a03d97

                SHA1

                95b207708762aa4752c77728128cbe3033646204

                SHA256

                57184b71b7d7525fbd75b1dda77bd26a5344b5cbd58ec5070fa5e1b4e073aef2

                SHA512

                3d3f06cd59a5bf8e9284ed1972a373ac1c63b0cba997d9559834db748ec41a90e42650d0ba05bf351456c2de12970f79d2d34f7a6c6445d2e55812682a5b406e

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftOffice2013Office365Win32.xml

                Filesize

                10KB

                MD5

                01c9f9a623fc35be445dde3e94c2dfaa

                SHA1

                a018155617cf96d2337b151513e05f6531f7aba4

                SHA256

                b9fad09698d5891e5f3d9e707895540f47cb0f480c21732a41fdb6ef2cc0f84d

                SHA512

                74303d4e827e974e59d7f4f6fc82f3092ff3d64616c3d17392987b23163761218d9516623349c87d728499011bc9867e7bd121f973f01d2cf70626c1eae8149a

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftSkypeForBusiness2016Win32.xml

                Filesize

                2KB

                MD5

                a96d6b6a930974c1144c83310d0ed0c9

                SHA1

                9d2152987585aafcc5af45ea15ccf0ba8f781b39

                SHA256

                f0da16198da1b68ab87d913b5def804cd36f4da16df22a7cba52f4f12fe7475d

                SHA512

                57b622ced6ae1432086130e9a8604ba8d572eb0d6ee6033d5d0cee4740648fc23208ad93b66031cd76661026be794093f4a4e199568f11cbee631529229f9596

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                Filesize

                2.3MB

                MD5

                49fc0b0c5939cf071399aa6f2cb5491b

                SHA1

                ddd0d4089167d47bf1a7754a02d216d9dfa26b1d

                SHA256

                5de32ae784595e58cb4ab71cb6301b1e65cd56a19ef9ef0607eb3d8c879e351c

                SHA512

                a09b6e3ba6609e4571d2645cc5de551bbede188b6fa0811ace64f725c074307424acd1bf1d4988fcd6a2b2bee8e031a0f29fde3983927bd91948be3afacd3161

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

                Filesize

                2.3MB

                MD5

                85ab8b1becb45709ea092c81d9cbfb6d

                SHA1

                544b12a0310f6303f56a2c5739cf56a532149550

                SHA256

                fd4e2d7b18a353724bfa0b870dea42cc8fcb13f73d667374216e9ae8737d77ef

                SHA512

                81d97bf12176d069a354b2445d61348a0df6e1df7f04e4a293a82c81ccd113731d7acbeb06669d7627fd688c8e57f0f5faa426c8682c940ce6f3219bbcf850cc

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\folder.ico

                Filesize

                52KB

                MD5

                bbf9dbdc079c0cd95f78d728aa3912d4

                SHA1

                051f76cc8c6520768bac9559bb329abeebd70d7c

                SHA256

                bef53904908769ceeb60f8e0976c3194e73534f00f4afb65497c2091121b98b2

                SHA512

                af110c52c983f1cf55b3db7d375e03c8c9308e3cf9ee1c154c2b25cb3f8299f0c0ba87b47445f09f98659eb536184c245887a341733c11af713e9ecc15288b5d

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\setup.exe

                Filesize

                453KB

                MD5

                96f7cb9f7481a279bd4bc0681a3b993e

                SHA1

                deaedb5becc6c0bd263d7cf81e0909b912a1afd4

                SHA256

                d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290

                SHA512

                694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\tasks.xml

                Filesize

                10KB

                MD5

                c949974e2fc5c8909c2efafb92f7640d

                SHA1

                ec68489a4a4fa022e5b60901f7221d733365a9c9

                SHA256

                1131721b6f906cedebbcefe223725ae0f5c7ad0a96219eabaa49dc8d38cedf40

                SHA512

                8fc8e3cdcb66ec98962d0f888f0abe90e1a18db09144e00494dda9f56eaf7ed623e0ee13efd8a29fbf72c7094bbc9f489baf2d54e8170bb4b04d5363ec354362

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\telemetry.P-Eco3PTelDefault.json

                Filesize

                57B

                MD5

                b658c06c14ff523bce634e14236c9441

                SHA1

                aa15105fc5cbee478303c5a1d8814a88197573be

                SHA256

                29633ff726d1c72f895545fd97d546035e7045a046b3d2888ff0950e67b8eb82

                SHA512

                3326a97db218aa09814e80317c1150f8a6808e8b6aab07af27c8126688b30964cc85936940d310c1d4d6190c49eaa01ee51d598775ec8c156676bbfd53f8f4cc

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\user-40.png

                Filesize

                525B

                MD5

                3bde564b05fe619b8082900b5c83b536

                SHA1

                656b402ff5e478471b1053e50ed8e5bfcc011a11

                SHA256

                1fa751b71307c22ceb94e3af09688c0e123b26ae8c16e1c521510f309bca4308

                SHA512

                00303409ca69ee71e6e2702d8f06a8ee5418d01e2e0f726394042b0af4b6a5b35f66d5a70664f031feb7e28d13c124b5d08e4b3998b443a2cba3574c4996ca0b

              • C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\user.png

                Filesize

                5KB

                MD5

                d7ee4543371744836d520e0ce24a9ee6

                SHA1

                a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0

                SHA256

                98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9

                SHA512

                e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808

              • C:\Users\Admin\AppData\Local\Temp\E767.exe

                Filesize

                1.1MB

                MD5

                d4fe627b0bc66a57bfdb76c531c06ce6

                SHA1

                1a9ff0a579460a2e90266ebbfbad127514a74e7a

                SHA256

                9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

                SHA512

                bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617

              • C:\Users\Admin\AppData\Local\Temp\E767.exe

                Filesize

                1.1MB

                MD5

                d4fe627b0bc66a57bfdb76c531c06ce6

                SHA1

                1a9ff0a579460a2e90266ebbfbad127514a74e7a

                SHA256

                9292bc6aec169cc1f3f223470669c6307f1d3e61687544c0a228846c1cf0df97

                SHA512

                bea169646b86ca0659efe0989856d58098efcc70d8b8953045635ddd7d4293aed656771d8d0a1e5e4e87a4f272b8e6b69f4eeacd7d7f7220d5b6e50535aa2617

              • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                Filesize

                726KB

                MD5

                6ea8a6cc5fed6c664df1b3ef7c56b55d

                SHA1

                6b244d708706441095ae97294928967ddf28432b

                SHA256

                2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                SHA512

                4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

              • C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

                Filesize

                726KB

                MD5

                6ea8a6cc5fed6c664df1b3ef7c56b55d

                SHA1

                6b244d708706441095ae97294928967ddf28432b

                SHA256

                2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

                SHA512

                4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

              • \??\c:\program files (x86)\windowspowershell\modules\aic_file_icons.dll

                Filesize

                726KB

                MD5

                6014e6dfed68030eda7da4d3574f91ec

                SHA1

                88792bb19cf3c0885ffd24ac4f5707d505910c1a

                SHA256

                1c6c7ab3da054f0a76ecea29c7e61ab38d81b2d8855f97a1853629436a8ac2c7

                SHA512

                b6c6dd6534a17699d120dbfe698caa0920771463e55ee11e5b15ba983045a0d271e247e3ce626caa67a2cb813259d2562eeaaecc3c0db45956eefe523271ab62

              • memory/1800-134-0x0000000000400000-0x000000000045D000-memory.dmp

                Filesize

                372KB

              • memory/1800-135-0x0000000000400000-0x000000000045D000-memory.dmp

                Filesize

                372KB

              • memory/1800-132-0x0000000000548000-0x0000000000559000-memory.dmp

                Filesize

                68KB

              • memory/1800-133-0x00000000004D0000-0x00000000004D9000-memory.dmp

                Filesize

                36KB

              • memory/2096-151-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-155-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-147-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-157-0x0000000007E90000-0x0000000007EA0000-memory.dmp

                Filesize

                64KB

              • memory/2096-149-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-150-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-152-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-167-0x0000000007E90000-0x0000000007EA0000-memory.dmp

                Filesize

                64KB

              • memory/2096-168-0x0000000007E90000-0x0000000007EA0000-memory.dmp

                Filesize

                64KB

              • memory/2096-136-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-137-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-138-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-139-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-140-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-141-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-144-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-142-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-153-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-154-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-148-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-145-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-156-0x0000000002A50000-0x0000000002A60000-memory.dmp

                Filesize

                64KB

              • memory/2096-146-0x0000000007E90000-0x0000000007EA0000-memory.dmp

                Filesize

                64KB

              • memory/2520-182-0x00000146FCE10000-0x00000146FD03A000-memory.dmp

                Filesize

                2.2MB

              • memory/2520-181-0x0000000000A80000-0x0000000000C99000-memory.dmp

                Filesize

                2.1MB

              • memory/2520-179-0x00000146FE7E0000-0x00000146FE920000-memory.dmp

                Filesize

                1.2MB

              • memory/2520-178-0x00000146FE7E0000-0x00000146FE920000-memory.dmp

                Filesize

                1.2MB

              • memory/3096-166-0x0000000000400000-0x0000000000517000-memory.dmp

                Filesize

                1.1MB

              • memory/3096-165-0x0000000002300000-0x0000000002415000-memory.dmp

                Filesize

                1.1MB

              • memory/3096-164-0x0000000002126000-0x00000000021FC000-memory.dmp

                Filesize

                856KB

              • memory/3972-187-0x0000000003100000-0x0000000003825000-memory.dmp

                Filesize

                7.1MB

              • memory/3972-203-0x0000000003100000-0x0000000003825000-memory.dmp

                Filesize

                7.1MB

              • memory/4528-172-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-173-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-183-0x0000000004850000-0x0000000004F75000-memory.dmp

                Filesize

                7.1MB

              • memory/4528-180-0x0000000005199000-0x000000000519B000-memory.dmp

                Filesize

                8KB

              • memory/4528-176-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-175-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-174-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-169-0x0000000004850000-0x0000000004F75000-memory.dmp

                Filesize

                7.1MB

              • memory/4528-171-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4528-170-0x0000000004850000-0x0000000004F75000-memory.dmp

                Filesize

                7.1MB

              • memory/4856-206-0x0000000003CB0000-0x00000000043D5000-memory.dmp

                Filesize

                7.1MB

              • memory/4856-207-0x0000000003CB0000-0x00000000043D5000-memory.dmp

                Filesize

                7.1MB