Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2023, 06:57

General

  • Target

    f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9.exe

  • Size

    351KB

  • MD5

    0d8af3a7522b59cc391e352b69f85385

  • SHA1

    56aba5eb93234ee41f10c5a6b3fba953e8cf32cb

  • SHA256

    f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9

  • SHA512

    2fb6972c88133dec5184cba71aa2c02d1720c5240ade9f4eac9230216d9813078c4073a8a69f4c5085d792f49deef85ae35685c9a7cd4cfeb7bdc0ce248b1bbc

  • SSDEEP

    3072:ZAdczEbCQe8vsr6KC1gz77+jux4PcbEz3QQfyS7kEouXGAcm3Rt9LGKxDPux5Kgx:Kig08EMwYECzfX9XZcmBtDux5sRJO

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes
  • profile_id_v2

    e749025c61b2caca10aa829a9e1a65a1

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Extracted

Family

laplas

C2

http://185.106.92.74

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9.exe
    "C:\Users\Admin\AppData\Local\Temp\f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:852
  • C:\Users\Admin\AppData\Local\Temp\1993.exe
    C:\Users\Admin\AppData\Local\Temp\1993.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\ProgramData\10636498592212847743.exe
      "C:\ProgramData\10636498592212847743.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\10636498592212847743.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 0
          4⤵
            PID:2036
      • C:\ProgramData\58567381455058534041.exe
        "C:\ProgramData\58567381455058534041.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
          "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2200
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1993.exe" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 6
          3⤵
          • Delays execution with timeout.exe
          PID:844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1888
        2⤵
        • Program crash
        PID:2272
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:748
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:3800
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:5020
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:4816
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:2276
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:1260
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:3616
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:3408
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1800
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2384 -ip 2384
                        1⤵
                          PID:1452
                        • C:\Users\Admin\AppData\Roaming\gajidgd
                          C:\Users\Admin\AppData\Roaming\gajidgd
                          1⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:2936

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\10636498592212847743.exe

                          Filesize

                          4.3MB

                          MD5

                          c4ab3149ef02a36d663699a8c541933e

                          SHA1

                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                          SHA256

                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                          SHA512

                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                        • C:\ProgramData\10636498592212847743.exe

                          Filesize

                          4.3MB

                          MD5

                          c4ab3149ef02a36d663699a8c541933e

                          SHA1

                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                          SHA256

                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                          SHA512

                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                        • C:\ProgramData\10636498592212847743.exe

                          Filesize

                          4.3MB

                          MD5

                          c4ab3149ef02a36d663699a8c541933e

                          SHA1

                          67088f5eff9ec575775b711c9e3650d12d7f4d5c

                          SHA256

                          0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

                          SHA512

                          88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

                        • C:\ProgramData\58567381455058534041.exe

                          Filesize

                          7.2MB

                          MD5

                          c5e0fb4ecaa8a7481a283099d604f7a0

                          SHA1

                          df4b0c0cc823da2b0443076650c292b43dd9de33

                          SHA256

                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                          SHA512

                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                        • C:\ProgramData\58567381455058534041.exe

                          Filesize

                          7.2MB

                          MD5

                          c5e0fb4ecaa8a7481a283099d604f7a0

                          SHA1

                          df4b0c0cc823da2b0443076650c292b43dd9de33

                          SHA256

                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                          SHA512

                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                        • C:\ProgramData\58567381455058534041.exe

                          Filesize

                          7.2MB

                          MD5

                          c5e0fb4ecaa8a7481a283099d604f7a0

                          SHA1

                          df4b0c0cc823da2b0443076650c292b43dd9de33

                          SHA256

                          c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

                          SHA512

                          375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

                        • C:\ProgramData\mozglue.dll

                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                        • C:\ProgramData\nss3.dll

                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                        • C:\Users\Admin\AppData\Local\Temp\1993.exe

                          Filesize

                          471KB

                          MD5

                          c805ef938a1efb04a17234649f4e513c

                          SHA1

                          b7ac40a34d9d22c80752819b292a0a3131496d24

                          SHA256

                          088eead4af04d5734875c69c71ba1d2176e535fb3dc795bf21ca58a8b0d58428

                          SHA512

                          fe75a4c7bfb6c5f336e1a81a78fbe449054d72f53313d66e5fffdf154d5ae1fc9a3b8ec610fae0b4de1ca5b75f6f1d300050d77a24e62947fb11609ecd772c33

                        • C:\Users\Admin\AppData\Local\Temp\1993.exe

                          Filesize

                          471KB

                          MD5

                          c805ef938a1efb04a17234649f4e513c

                          SHA1

                          b7ac40a34d9d22c80752819b292a0a3131496d24

                          SHA256

                          088eead4af04d5734875c69c71ba1d2176e535fb3dc795bf21ca58a8b0d58428

                          SHA512

                          fe75a4c7bfb6c5f336e1a81a78fbe449054d72f53313d66e5fffdf154d5ae1fc9a3b8ec610fae0b4de1ca5b75f6f1d300050d77a24e62947fb11609ecd772c33

                        • C:\Users\Admin\AppData\Roaming\gajidgd

                          Filesize

                          351KB

                          MD5

                          0d8af3a7522b59cc391e352b69f85385

                          SHA1

                          56aba5eb93234ee41f10c5a6b3fba953e8cf32cb

                          SHA256

                          f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9

                          SHA512

                          2fb6972c88133dec5184cba71aa2c02d1720c5240ade9f4eac9230216d9813078c4073a8a69f4c5085d792f49deef85ae35685c9a7cd4cfeb7bdc0ce248b1bbc

                        • C:\Users\Admin\AppData\Roaming\gajidgd

                          Filesize

                          351KB

                          MD5

                          0d8af3a7522b59cc391e352b69f85385

                          SHA1

                          56aba5eb93234ee41f10c5a6b3fba953e8cf32cb

                          SHA256

                          f9038539b288cae94a755fcd671298095bfbffa554c88462afbde563957b74f9

                          SHA512

                          2fb6972c88133dec5184cba71aa2c02d1720c5240ade9f4eac9230216d9813078c4073a8a69f4c5085d792f49deef85ae35685c9a7cd4cfeb7bdc0ce248b1bbc

                        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                          Filesize

                          540.8MB

                          MD5

                          470bc7e1e8751b9d9089ec3ef6e5264b

                          SHA1

                          31e8318e9d9b86841a07eb24886348b9b1223ca1

                          SHA256

                          07273b71bfb3188a265b581f91bcd6764fda40879bf523f03c0197d67d6dc732

                          SHA512

                          3edc530867eb4f10382ea4d92f41cb7807aebf891de9cb99ec2027736281b194ea348ed6c09090044fdb9215b9d903cbd6f9fa483e10dc6af17d90ec9ecca741

                        • C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

                          Filesize

                          550.4MB

                          MD5

                          5d43c1e6b4cba9eb9033b34ea9d6819c

                          SHA1

                          b6b8249c69f26d57610ff9c7bad45198798d9560

                          SHA256

                          a172d83d4ce42f5bdc2e4c7b721d4656c65982bbe2f036220814f3bfd84ac7dc

                          SHA512

                          fc0813e47a4b4e62673d0b8ac0bb525be7049e5df8e4e6da65b095dd5975d8bea4d30a29ade69d3221371e5d0c7e08fc987c063939cbad3ea727002cd7538402

                        • memory/748-297-0x0000000002380000-0x00000000023D7000-memory.dmp

                          Filesize

                          348KB

                        • memory/748-186-0x00000000009A0000-0x00000000009AB000-memory.dmp

                          Filesize

                          44KB

                        • memory/748-196-0x0000000002380000-0x00000000023D7000-memory.dmp

                          Filesize

                          348KB

                        • memory/748-197-0x00000000009A0000-0x00000000009AB000-memory.dmp

                          Filesize

                          44KB

                        • memory/852-134-0x0000000002530000-0x0000000002539000-memory.dmp

                          Filesize

                          36KB

                        • memory/852-136-0x0000000000400000-0x00000000007FC000-memory.dmp

                          Filesize

                          4.0MB

                        • memory/1260-279-0x0000000001290000-0x0000000001299000-memory.dmp

                          Filesize

                          36KB

                        • memory/1260-312-0x00000000004B0000-0x00000000004D7000-memory.dmp

                          Filesize

                          156KB

                        • memory/1260-282-0x0000000001290000-0x0000000001299000-memory.dmp

                          Filesize

                          36KB

                        • memory/1260-281-0x00000000004B0000-0x00000000004D7000-memory.dmp

                          Filesize

                          156KB

                        • memory/1696-307-0x0000000000830000-0x0000000001693000-memory.dmp

                          Filesize

                          14.4MB

                        • memory/1696-310-0x0000000000830000-0x0000000001693000-memory.dmp

                          Filesize

                          14.4MB

                        • memory/1800-294-0x0000000000340000-0x000000000034B000-memory.dmp

                          Filesize

                          44KB

                        • memory/1800-295-0x0000000000E80000-0x0000000000E8D000-memory.dmp

                          Filesize

                          52KB

                        • memory/1800-296-0x0000000000340000-0x000000000034B000-memory.dmp

                          Filesize

                          44KB

                        • memory/2200-364-0x0000000001340000-0x0000000001341000-memory.dmp

                          Filesize

                          4KB

                        • memory/2276-276-0x00000000004B0000-0x00000000004D7000-memory.dmp

                          Filesize

                          156KB

                        • memory/2276-278-0x00000000004B0000-0x00000000004D7000-memory.dmp

                          Filesize

                          156KB

                        • memory/2276-277-0x00000000010F0000-0x00000000010FC000-memory.dmp

                          Filesize

                          48KB

                        • memory/2384-200-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                        • memory/2384-184-0x0000000002380000-0x00000000023D7000-memory.dmp

                          Filesize

                          348KB

                        • memory/2384-291-0x0000000000400000-0x000000000081A000-memory.dmp

                          Filesize

                          4.1MB

                        • memory/3176-169-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-168-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-183-0x00000000024D0000-0x00000000024D1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3176-181-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-178-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-175-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-176-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-397-0x0000000001340000-0x0000000001341000-memory.dmp

                          Filesize

                          4KB

                        • memory/3176-396-0x0000000001340000-0x0000000001341000-memory.dmp

                          Filesize

                          4KB

                        • memory/3176-174-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-135-0x0000000002A80000-0x0000000002A96000-memory.dmp

                          Filesize

                          88KB

                        • memory/3176-173-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-172-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-145-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-388-0x0000000001340000-0x0000000001341000-memory.dmp

                          Filesize

                          4KB

                        • memory/3176-378-0x0000000001340000-0x0000000001341000-memory.dmp

                          Filesize

                          4KB

                        • memory/3176-146-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-147-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-152-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-171-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-182-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-148-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-170-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-167-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-166-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-359-0x00000000042C0000-0x00000000042C2000-memory.dmp

                          Filesize

                          8KB

                        • memory/3176-346-0x00000000042C0000-0x00000000042C2000-memory.dmp

                          Filesize

                          8KB

                        • memory/3176-180-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-150-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-149-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-161-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-160-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-158-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-159-0x0000000004300000-0x0000000004310000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-151-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-157-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-156-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-155-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-154-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-179-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3176-153-0x00000000042F0000-0x0000000004300000-memory.dmp

                          Filesize

                          64KB

                        • memory/3408-314-0x00000000012F0000-0x00000000012FB000-memory.dmp

                          Filesize

                          44KB

                        • memory/3408-292-0x00000000012F0000-0x00000000012FB000-memory.dmp

                          Filesize

                          44KB

                        • memory/3408-290-0x0000000000E80000-0x0000000000E8D000-memory.dmp

                          Filesize

                          52KB

                        • memory/3408-293-0x0000000000E80000-0x0000000000E8D000-memory.dmp

                          Filesize

                          52KB

                        • memory/3616-280-0x00000000012F0000-0x00000000012FB000-memory.dmp

                          Filesize

                          44KB

                        • memory/3616-283-0x00000000012F0000-0x00000000012FB000-memory.dmp

                          Filesize

                          44KB

                        • memory/3616-313-0x0000000001290000-0x0000000001299000-memory.dmp

                          Filesize

                          36KB

                        • memory/3672-333-0x00000000012B0000-0x00000000012B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3800-299-0x00000000009A0000-0x00000000009AB000-memory.dmp

                          Filesize

                          44KB

                        • memory/3800-198-0x00000000009D0000-0x00000000009DF000-memory.dmp

                          Filesize

                          60KB

                        • memory/3800-199-0x00000000009D0000-0x00000000009DF000-memory.dmp

                          Filesize

                          60KB

                        • memory/4816-274-0x00000000001A0000-0x00000000001A9000-memory.dmp

                          Filesize

                          36KB

                        • memory/4816-273-0x00000000010F0000-0x00000000010FC000-memory.dmp

                          Filesize

                          48KB

                        • memory/4816-275-0x00000000010F0000-0x00000000010FC000-memory.dmp

                          Filesize

                          48KB

                        • memory/4816-309-0x00000000001A0000-0x00000000001A9000-memory.dmp

                          Filesize

                          36KB

                        • memory/5020-272-0x00000000001A0000-0x00000000001A9000-memory.dmp

                          Filesize

                          36KB

                        • memory/5020-271-0x00000000009D0000-0x00000000009DF000-memory.dmp

                          Filesize

                          60KB

                        • memory/5020-201-0x00000000001A0000-0x00000000001A9000-memory.dmp

                          Filesize

                          36KB