Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2023, 10:00

General

  • Target

    bd7adc4a910dd1433eef94e8660718759ce60887d5540f0733e0b5179c1460fb.exe

  • Size

    198KB

  • MD5

    7b160ddabf10aaaf6a5533b519ea64c8

  • SHA1

    89db6e0dca5bce8e22e82be4dbb7ed3ab2f7bfee

  • SHA256

    bd7adc4a910dd1433eef94e8660718759ce60887d5540f0733e0b5179c1460fb

  • SHA512

    3602930295116e011e9184e4d0c9f8a66501bb884b50fc574ea728cfce1ce940c81fd11ff8f964eee0f5d081fbaab977a9da1d2979fffd78386af073dd748bce

  • SSDEEP

    3072:IHRRsAKdinlM6bbMQOg9MrKZOY1qAndSPCCTAajbj537flXBjx:+CcnlZPMUyesgbndSPCCTAajl7ffjx

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
rc4.i32

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes
  • profile_id_v2

    e749025c61b2caca10aa829a9e1a65a1

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Extracted

Family

laplas

C2

http://185.106.92.74

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd7adc4a910dd1433eef94e8660718759ce60887d5540f0733e0b5179c1460fb.exe
    "C:\Users\Admin\AppData\Local\Temp\bd7adc4a910dd1433eef94e8660718759ce60887d5540f0733e0b5179c1460fb.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4224
  • C:\Users\Admin\AppData\Local\Temp\DCD8.exe
    C:\Users\Admin\AppData\Local\Temp\DCD8.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\ProgramData\04341253597388250304.exe
      "C:\ProgramData\04341253597388250304.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\04341253597388250304.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 0
          4⤵
            PID:1304
      • C:\ProgramData\64959137204529053722.exe
        "C:\ProgramData\64959137204529053722.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
          "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\DCD8.exe" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 6
          3⤵
          • Delays execution with timeout.exe
          PID:3272
    • C:\Users\Admin\AppData\Local\Temp\F226.exe
      C:\Users\Admin\AppData\Local\Temp\F226.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        2⤵
        • Executes dropped EXE
        PID:4692
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:2616
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:3756
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:3564
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:1004
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:664
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:2956
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:4084
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:580
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1224

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\04341253597388250304.exe

                        Filesize

                        4.3MB

                        MD5

                        c4ab3149ef02a36d663699a8c541933e

                        SHA1

                        67088f5eff9ec575775b711c9e3650d12d7f4d5c

                        SHA256

                        0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                        SHA512

                        88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                      • C:\ProgramData\04341253597388250304.exe

                        Filesize

                        4.3MB

                        MD5

                        c4ab3149ef02a36d663699a8c541933e

                        SHA1

                        67088f5eff9ec575775b711c9e3650d12d7f4d5c

                        SHA256

                        0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                        SHA512

                        88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                      • C:\ProgramData\04341253597388250304.exe

                        Filesize

                        4.3MB

                        MD5

                        c4ab3149ef02a36d663699a8c541933e

                        SHA1

                        67088f5eff9ec575775b711c9e3650d12d7f4d5c

                        SHA256

                        0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                        SHA512

                        88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                      • C:\ProgramData\64959137204529053722.exe

                        Filesize

                        7.2MB

                        MD5

                        c5e0fb4ecaa8a7481a283099d604f7a0

                        SHA1

                        df4b0c0cc823da2b0443076650c292b43dd9de33

                        SHA256

                        c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                        SHA512

                        375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                      • C:\ProgramData\64959137204529053722.exe

                        Filesize

                        7.2MB

                        MD5

                        c5e0fb4ecaa8a7481a283099d604f7a0

                        SHA1

                        df4b0c0cc823da2b0443076650c292b43dd9de33

                        SHA256

                        c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                        SHA512

                        375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                      • C:\ProgramData\64959137204529053722.exe

                        Filesize

                        7.2MB

                        MD5

                        c5e0fb4ecaa8a7481a283099d604f7a0

                        SHA1

                        df4b0c0cc823da2b0443076650c292b43dd9de33

                        SHA256

                        c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                        SHA512

                        375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                      • C:\ProgramData\mozglue.dll

                        Filesize

                        593KB

                        MD5

                        c8fd9be83bc728cc04beffafc2907fe9

                        SHA1

                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                        SHA256

                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                        SHA512

                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      • C:\ProgramData\nss3.dll

                        Filesize

                        2.0MB

                        MD5

                        1cc453cdf74f31e4d913ff9c10acdde2

                        SHA1

                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                        SHA256

                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                        SHA512

                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      • C:\Users\Admin\AppData\Local\Temp\DCD8.exe

                        Filesize

                        309KB

                        MD5

                        f85f5d81701dfd84269fbb2890903d0a

                        SHA1

                        db21b987f5e260ea0747091fbc183497c5ecceb5

                        SHA256

                        6c26e5a25958830af43246a52754d4f6686b44cf7c96facce8be29c496561c29

                        SHA512

                        2e6d4a74a802553008389a0b0d7b9d6b31050e430ed98c17a9e21c5fe95a17ac7b67f99c5dcfa20a91596167461e0b1d13123780b770b54f99477059ce188209

                      • C:\Users\Admin\AppData\Local\Temp\DCD8.exe

                        Filesize

                        309KB

                        MD5

                        f85f5d81701dfd84269fbb2890903d0a

                        SHA1

                        db21b987f5e260ea0747091fbc183497c5ecceb5

                        SHA256

                        6c26e5a25958830af43246a52754d4f6686b44cf7c96facce8be29c496561c29

                        SHA512

                        2e6d4a74a802553008389a0b0d7b9d6b31050e430ed98c17a9e21c5fe95a17ac7b67f99c5dcfa20a91596167461e0b1d13123780b770b54f99477059ce188209

                      • C:\Users\Admin\AppData\Local\Temp\F226.exe

                        Filesize

                        1.8MB

                        MD5

                        484f306b6b2cddfa346936023aa886a5

                        SHA1

                        8b6a851469319d5b1df0449775aa95b0138d8a8c

                        SHA256

                        3a4712fe53943012eabe3d9b70436588be5f7d3b5d2c6abeaf3070e26cb4eafb

                        SHA512

                        542eb0acd401d52fcea808e248a32f6f4c929f7a31eb9a5c6c6d04555ad9f1b30fdd15f1e71c9701c25efbd2cf562da0f39f3b423db854a324a711f2f0a7ceb5

                      • C:\Users\Admin\AppData\Local\Temp\F226.exe

                        Filesize

                        1.8MB

                        MD5

                        484f306b6b2cddfa346936023aa886a5

                        SHA1

                        8b6a851469319d5b1df0449775aa95b0138d8a8c

                        SHA256

                        3a4712fe53943012eabe3d9b70436588be5f7d3b5d2c6abeaf3070e26cb4eafb

                        SHA512

                        542eb0acd401d52fcea808e248a32f6f4c929f7a31eb9a5c6c6d04555ad9f1b30fdd15f1e71c9701c25efbd2cf562da0f39f3b423db854a324a711f2f0a7ceb5

                      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

                        Filesize

                        707.8MB

                        MD5

                        b1185509df1f5a2915487ffa8cfbcfe5

                        SHA1

                        0313f000f3e3b1e4092d3df4fd93d3ca85659a88

                        SHA256

                        bb8a5546c131875c759517695a6ccf6455aa87b20f9eba7684c55134a47a0d49

                        SHA512

                        89a1f8e1295b7acd2fed314b45fc098b6fbd6835817226732be25f77dddb714a1d342805d4319dca98ba71251d9e971608d6c371eca06491649412843b1576b6

                      • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

                        Filesize

                        707.8MB

                        MD5

                        b1185509df1f5a2915487ffa8cfbcfe5

                        SHA1

                        0313f000f3e3b1e4092d3df4fd93d3ca85659a88

                        SHA256

                        bb8a5546c131875c759517695a6ccf6455aa87b20f9eba7684c55134a47a0d49

                        SHA512

                        89a1f8e1295b7acd2fed314b45fc098b6fbd6835817226732be25f77dddb714a1d342805d4319dca98ba71251d9e971608d6c371eca06491649412843b1576b6

                      • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                        Filesize

                        201.1MB

                        MD5

                        22640cc24f6b0d806aa779aa024cb621

                        SHA1

                        844e27c30b4ba2686beccfa5d28e9df9b45d813a

                        SHA256

                        0e1e862adb8bf7c85e9baa077ddee65ee40d86244293daf65463126879f2a65c

                        SHA512

                        624bca8136fdd09e21cbcd433d481c1d4e6978b16b25004ad7fd236702dd8fd51914ed7f78da0987c7297b6d0f9c4455abc837a3f398baf42e59fc4dbb77d09a

                      • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                        Filesize

                        203.2MB

                        MD5

                        877b37557700198eca7cfabade12a262

                        SHA1

                        bc100ae7d026eb0e20f9377dcf978d65967c264c

                        SHA256

                        081234926dfe72ca142a0b738c286c4bdf9d899f2ed2e912585603ba4d7d8d2c

                        SHA512

                        06a4cac770401dfbdf070d8456206a30156c93cdc5dc7b6849d8ae940720a5613babc78a7c8757a4c6cec99b27b67793fb9345ff0d7f2cdb95a128bb91c85c84

                      • memory/580-268-0x00000000005E0000-0x00000000005E7000-memory.dmp

                        Filesize

                        28KB

                      • memory/580-269-0x00000000005D0000-0x00000000005DD000-memory.dmp

                        Filesize

                        52KB

                      • memory/580-266-0x00000000005D0000-0x00000000005DD000-memory.dmp

                        Filesize

                        52KB

                      • memory/664-310-0x00000000012F0000-0x0000000001312000-memory.dmp

                        Filesize

                        136KB

                      • memory/664-252-0x00000000012C0000-0x00000000012E7000-memory.dmp

                        Filesize

                        156KB

                      • memory/664-249-0x00000000012C0000-0x00000000012E7000-memory.dmp

                        Filesize

                        156KB

                      • memory/664-251-0x00000000012F0000-0x0000000001312000-memory.dmp

                        Filesize

                        136KB

                      • memory/828-335-0x0000000001460000-0x0000000001461000-memory.dmp

                        Filesize

                        4KB

                      • memory/828-336-0x0000000001470000-0x0000000001471000-memory.dmp

                        Filesize

                        4KB

                      • memory/828-337-0x00000000004A0000-0x0000000000FDA000-memory.dmp

                        Filesize

                        11.2MB

                      • memory/1004-308-0x00000000007A0000-0x00000000007A6000-memory.dmp

                        Filesize

                        24KB

                      • memory/1004-248-0x0000000000790000-0x000000000079C000-memory.dmp

                        Filesize

                        48KB

                      • memory/1004-246-0x0000000000790000-0x000000000079C000-memory.dmp

                        Filesize

                        48KB

                      • memory/1004-247-0x00000000007A0000-0x00000000007A6000-memory.dmp

                        Filesize

                        24KB

                      • memory/1224-278-0x00000000004F0000-0x00000000004F8000-memory.dmp

                        Filesize

                        32KB

                      • memory/1224-279-0x00000000004E0000-0x00000000004EB000-memory.dmp

                        Filesize

                        44KB

                      • memory/1224-314-0x00000000004F0000-0x00000000004F8000-memory.dmp

                        Filesize

                        32KB

                      • memory/1224-272-0x00000000004E0000-0x00000000004EB000-memory.dmp

                        Filesize

                        44KB

                      • memory/1336-250-0x0000000000400000-0x00000000004BB000-memory.dmp

                        Filesize

                        748KB

                      • memory/1336-150-0x00000000020B0000-0x0000000002107000-memory.dmp

                        Filesize

                        348KB

                      • memory/1336-160-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                        Filesize

                        972KB

                      • memory/1336-301-0x0000000000400000-0x00000000004BB000-memory.dmp

                        Filesize

                        748KB

                      • memory/1680-240-0x0000000002790000-0x0000000002B60000-memory.dmp

                        Filesize

                        3.8MB

                      • memory/1680-282-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1680-307-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1980-298-0x0000000000780000-0x00000000012BA000-memory.dmp

                        Filesize

                        11.2MB

                      • memory/1980-297-0x0000000001740000-0x0000000001741000-memory.dmp

                        Filesize

                        4KB

                      • memory/1980-296-0x00000000013F0000-0x00000000013F1000-memory.dmp

                        Filesize

                        4KB

                      • memory/2432-280-0x0000000000420000-0x0000000001283000-memory.dmp

                        Filesize

                        14.4MB

                      • memory/2432-281-0x0000000000420000-0x0000000001283000-memory.dmp

                        Filesize

                        14.4MB

                      • memory/2616-286-0x0000000000F70000-0x0000000000F77000-memory.dmp

                        Filesize

                        28KB

                      • memory/2616-193-0x0000000000F70000-0x0000000000F77000-memory.dmp

                        Filesize

                        28KB

                      • memory/2616-184-0x0000000000F60000-0x0000000000F6B000-memory.dmp

                        Filesize

                        44KB

                      • memory/2616-194-0x0000000000F60000-0x0000000000F6B000-memory.dmp

                        Filesize

                        44KB

                      • memory/2956-311-0x00000000012C0000-0x00000000012E7000-memory.dmp

                        Filesize

                        156KB

                      • memory/2956-261-0x00000000012C0000-0x00000000012E7000-memory.dmp

                        Filesize

                        156KB

                      • memory/2956-253-0x0000000000A00000-0x0000000000A09000-memory.dmp

                        Filesize

                        36KB

                      • memory/2956-262-0x0000000000A00000-0x0000000000A09000-memory.dmp

                        Filesize

                        36KB

                      • memory/3220-135-0x0000000002E60000-0x0000000002E76000-memory.dmp

                        Filesize

                        88KB

                      • memory/3564-244-0x0000000001210000-0x0000000001215000-memory.dmp

                        Filesize

                        20KB

                      • memory/3564-302-0x0000000001210000-0x0000000001215000-memory.dmp

                        Filesize

                        20KB

                      • memory/3564-245-0x0000000001200000-0x0000000001209000-memory.dmp

                        Filesize

                        36KB

                      • memory/3564-243-0x0000000001200000-0x0000000001209000-memory.dmp

                        Filesize

                        36KB

                      • memory/3756-295-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

                        Filesize

                        36KB

                      • memory/3756-241-0x0000000000BE0000-0x0000000000BE9000-memory.dmp

                        Filesize

                        36KB

                      • memory/3756-242-0x0000000000BD0000-0x0000000000BDF000-memory.dmp

                        Filesize

                        60KB

                      • memory/3756-224-0x0000000000BD0000-0x0000000000BDF000-memory.dmp

                        Filesize

                        60KB

                      • memory/4084-265-0x00000000001B0000-0x00000000001BB000-memory.dmp

                        Filesize

                        44KB

                      • memory/4084-263-0x00000000001B0000-0x00000000001BB000-memory.dmp

                        Filesize

                        44KB

                      • memory/4084-313-0x00000000001C0000-0x00000000001C6000-memory.dmp

                        Filesize

                        24KB

                      • memory/4084-264-0x00000000001C0000-0x00000000001C6000-memory.dmp

                        Filesize

                        24KB

                      • memory/4224-134-0x0000000000730000-0x0000000000739000-memory.dmp

                        Filesize

                        36KB

                      • memory/4224-137-0x0000000000400000-0x00000000004A0000-memory.dmp

                        Filesize

                        640KB

                      • memory/4692-326-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-328-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-329-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-327-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-324-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-333-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-334-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-323-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-322-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-309-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/4692-340-0x0000000000400000-0x0000000000803000-memory.dmp

                        Filesize

                        4.0MB