Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/12/2022, 16:51

General

  • Target

    34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba.exe

  • Size

    231KB

  • MD5

    835a1fad6b22d9f656514e6450243fea

  • SHA1

    ad7dce22f1e1b66a28f4b6caf2ebecae0fe075cc

  • SHA256

    34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba

  • SHA512

    e95304f0c388794264286584cbf4487588a6952e54290c9181a8559585ad335e41d0984697ea28140f47d72ea776a240c2975aa29293c66c8e3afacecdc0adda

  • SSDEEP

    3072:4qPkLtGo5D5zN3l3y5C1s0TwPxFwRtJ/nJJxgISNPw7RkxmJZs:4zLssdj3y5C1uw3J/nFgXNPGymI

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes
  • auth_value

    107e09eee63158d2488feb03dac75204

Extracted

Family

aurora

C2

195.43.142.218:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba.exe
    "C:\Users\Admin\AppData\Local\Temp\34dc14528893caf025173bef0104f2229adb26c23f0bd5cbb4c6653d80c306ba.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2656
  • C:\Users\Admin\AppData\Local\Temp\2480.exe
    C:\Users\Admin\AppData\Local\Temp\2480.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:4936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:3524
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:5076
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:4708
          • C:\Users\Admin\AppData\Local\Temp\278E.exe
            C:\Users\Admin\AppData\Local\Temp\278E.exe
            1⤵
            • Executes dropped EXE
            PID:3200
          • C:\Users\Admin\AppData\Local\Temp\2CFD.exe
            C:\Users\Admin\AppData\Local\Temp\2CFD.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4532
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:4800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 240
                2⤵
                • Program crash
                PID:4112
            • C:\Users\Admin\AppData\Local\Temp\33B5.exe
              C:\Users\Admin\AppData\Local\Temp\33B5.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get Caption
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5064
              • C:\Windows\system32\cmd.exe
                cmd /C "wmic path win32_VideoController get name"
                2⤵
                  PID:4784
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic path win32_VideoController get name
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4996
                • C:\Windows\system32\cmd.exe
                  cmd /C "wmic cpu get name"
                  2⤵
                    PID:5100
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic cpu get name
                      3⤵
                        PID:3292
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:4756
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:5012
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:4736
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:5108
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1700
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:2296
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:1644
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe
                                  1⤵
                                    PID:4160
                                  • C:\Windows\SysWOW64\explorer.exe
                                    C:\Windows\SysWOW64\explorer.exe
                                    1⤵
                                      PID:2608

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\2480.exe

                                      Filesize

                                      67KB

                                      MD5

                                      666d8f33d37064fd5d14e2166c9bfa69

                                      SHA1

                                      3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

                                      SHA256

                                      7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

                                      SHA512

                                      ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

                                    • C:\Users\Admin\AppData\Local\Temp\2480.exe

                                      Filesize

                                      67KB

                                      MD5

                                      666d8f33d37064fd5d14e2166c9bfa69

                                      SHA1

                                      3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

                                      SHA256

                                      7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

                                      SHA512

                                      ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

                                    • C:\Users\Admin\AppData\Local\Temp\278E.exe

                                      Filesize

                                      4KB

                                      MD5

                                      9748489855d9dd82ab09da5e3e55b19e

                                      SHA1

                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                      SHA256

                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                      SHA512

                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                    • C:\Users\Admin\AppData\Local\Temp\278E.exe

                                      Filesize

                                      4KB

                                      MD5

                                      9748489855d9dd82ab09da5e3e55b19e

                                      SHA1

                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                      SHA256

                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                      SHA512

                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                    • C:\Users\Admin\AppData\Local\Temp\2CFD.exe

                                      Filesize

                                      399KB

                                      MD5

                                      ac508206006eb41c605373e9793e7622

                                      SHA1

                                      3223ac24de6fd4650bbcf1495e73944085bc0e07

                                      SHA256

                                      775f35230e0d3bd996440811af08110905803280094996a22b02f6b7b85c6b32

                                      SHA512

                                      9aa4d2d50a915919f1f238f0838636cfa6f7fc3e634508f5a110ac4097c919d9076753612af7c2e1c9013281ca4e1a209743560d2f0f01c8c9329c47b113ba2c

                                    • C:\Users\Admin\AppData\Local\Temp\2CFD.exe

                                      Filesize

                                      399KB

                                      MD5

                                      ac508206006eb41c605373e9793e7622

                                      SHA1

                                      3223ac24de6fd4650bbcf1495e73944085bc0e07

                                      SHA256

                                      775f35230e0d3bd996440811af08110905803280094996a22b02f6b7b85c6b32

                                      SHA512

                                      9aa4d2d50a915919f1f238f0838636cfa6f7fc3e634508f5a110ac4097c919d9076753612af7c2e1c9013281ca4e1a209743560d2f0f01c8c9329c47b113ba2c

                                    • C:\Users\Admin\AppData\Local\Temp\33B5.exe

                                      Filesize

                                      1.8MB

                                      MD5

                                      3e8b9e2a1f3d5a7a2322bce514e90a27

                                      SHA1

                                      d0e6cf406c70bb223ebaa41aa12f3b34ac217e7f

                                      SHA256

                                      00c142f59684f5582673779b0a21edb9309ac9bf24392e41b621899a626cc6d5

                                      SHA512

                                      b75b86bcc939946944239222f7dc0498f0fad890a61325d53114431f6b746bb4853f6a15f65716c7880afd5c21dd85b91f10e4235b503643314e2371aa4648b7

                                    • C:\Users\Admin\AppData\Local\Temp\33B5.exe

                                      Filesize

                                      1.8MB

                                      MD5

                                      3e8b9e2a1f3d5a7a2322bce514e90a27

                                      SHA1

                                      d0e6cf406c70bb223ebaa41aa12f3b34ac217e7f

                                      SHA256

                                      00c142f59684f5582673779b0a21edb9309ac9bf24392e41b621899a626cc6d5

                                      SHA512

                                      b75b86bcc939946944239222f7dc0498f0fad890a61325d53114431f6b746bb4853f6a15f65716c7880afd5c21dd85b91f10e4235b503643314e2371aa4648b7

                                    • memory/1644-648-0x0000000000630000-0x0000000000636000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/1644-1057-0x0000000000630000-0x0000000000636000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/1644-674-0x0000000000620000-0x000000000062B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/1700-601-0x0000000000330000-0x0000000000357000-memory.dmp

                                      Filesize

                                      156KB

                                    • memory/1700-597-0x0000000000360000-0x0000000000382000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1700-1056-0x0000000000360000-0x0000000000382000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2296-644-0x00000000003A0000-0x00000000003A5000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/2296-646-0x0000000000390000-0x0000000000399000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2296-1058-0x00000000003A0000-0x00000000003A5000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/2608-1059-0x0000000003110000-0x0000000003118000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2608-675-0x0000000003110000-0x0000000003118000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2608-676-0x0000000003100000-0x000000000310B000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/2656-136-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-139-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-148-0x00000000004F0000-0x000000000063A000-memory.dmp

                                      Filesize

                                      1.3MB

                                    • memory/2656-149-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-150-0x0000000002170000-0x0000000002179000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2656-147-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-151-0x0000000000400000-0x000000000045E000-memory.dmp

                                      Filesize

                                      376KB

                                    • memory/2656-152-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-153-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-154-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-155-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-156-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-157-0x0000000000400000-0x000000000045E000-memory.dmp

                                      Filesize

                                      376KB

                                    • memory/2656-145-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-144-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-143-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-141-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-140-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-137-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-146-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-138-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-121-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-120-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-127-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-128-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-135-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-134-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-132-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-122-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-133-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-131-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-123-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-130-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-129-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-126-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-125-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2656-124-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3200-179-0x0000000000900000-0x0000000000908000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/3584-192-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-244-0x00000000051F0000-0x0000000005256000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/3584-188-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-189-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-184-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-190-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-175-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-186-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-185-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-174-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-166-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-196-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-193-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-182-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-207-0x0000000000A10000-0x0000000000A26000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/3584-160-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-183-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-181-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-161-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-187-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-178-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-260-0x0000000005260000-0x0000000005280000-memory.dmp

                                      Filesize

                                      128KB

                                    • memory/3584-162-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-171-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-172-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-163-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-170-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-164-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-165-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-167-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-180-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3584-169-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/4160-1050-0x0000000001220000-0x0000000001227000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/4160-513-0x0000000001210000-0x000000000121D000-memory.dmp

                                      Filesize

                                      52KB

                                    • memory/4160-508-0x0000000001220000-0x0000000001227000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/4532-197-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/4532-195-0x0000000077560000-0x00000000776EE000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/4736-1049-0x0000000003150000-0x0000000003155000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/4736-500-0x0000000003150000-0x0000000003155000-memory.dmp

                                      Filesize

                                      20KB

                                    • memory/4736-504-0x0000000003140000-0x0000000003149000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/4756-789-0x0000000000B00000-0x0000000000B07000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/4756-424-0x0000000000AF0000-0x0000000000AFB000-memory.dmp

                                      Filesize

                                      44KB

                                    • memory/4756-419-0x0000000000B00000-0x0000000000B07000-memory.dmp

                                      Filesize

                                      28KB

                                    • memory/4800-677-0x00000000098A0000-0x0000000009932000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/4800-1043-0x000000000C090000-0x000000000C106000-memory.dmp

                                      Filesize

                                      472KB

                                    • memory/4800-408-0x0000000009580000-0x000000000968A000-memory.dmp

                                      Filesize

                                      1.0MB

                                    • memory/4800-403-0x0000000009A60000-0x000000000A066000-memory.dmp

                                      Filesize

                                      6.0MB

                                    • memory/4800-1044-0x000000000C110000-0x000000000C160000-memory.dmp

                                      Filesize

                                      320KB

                                    • memory/4800-418-0x00000000094B0000-0x00000000094C2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4800-428-0x0000000009510000-0x000000000954E000-memory.dmp

                                      Filesize

                                      248KB

                                    • memory/4800-696-0x000000000B340000-0x000000000B86C000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/4800-323-0x0000000000400000-0x0000000000432000-memory.dmp

                                      Filesize

                                      200KB

                                    • memory/4800-695-0x000000000AC40000-0x000000000AE02000-memory.dmp

                                      Filesize

                                      1.8MB

                                    • memory/4800-678-0x000000000A570000-0x000000000AA6E000-memory.dmp

                                      Filesize

                                      5.0MB

                                    • memory/4800-440-0x0000000009690000-0x00000000096DB000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/4828-1060-0x0000000000860000-0x0000000000C4A000-memory.dmp

                                      Filesize

                                      3.9MB

                                    • memory/4828-228-0x0000000000860000-0x0000000000C4A000-memory.dmp

                                      Filesize

                                      3.9MB

                                    • memory/4828-265-0x00000166D62A0000-0x00000166D62E9000-memory.dmp

                                      Filesize

                                      292KB

                                    • memory/5012-683-0x0000000000E00000-0x0000000000E09000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/5012-297-0x0000000000BF0000-0x0000000000BFF000-memory.dmp

                                      Filesize

                                      60KB

                                    • memory/5012-294-0x0000000000E00000-0x0000000000E09000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/5108-377-0x00000000005D0000-0x00000000005DC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/5108-374-0x00000000005E0000-0x00000000005E6000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/5108-788-0x00000000005E0000-0x00000000005E6000-memory.dmp

                                      Filesize

                                      24KB