Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    76s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2023, 13:56

General

  • Target

    a5e065bd9a3a411cac043f60a0df9bf4f6839042dfed251f86deed1e336d10cd.exe

  • Size

    350KB

  • MD5

    bc6bb448a098b2cbd03bfd9c4fcf19a8

  • SHA1

    cbebe41adcde336a7346cfb8618f34dc6bd8158d

  • SHA256

    a5e065bd9a3a411cac043f60a0df9bf4f6839042dfed251f86deed1e336d10cd

  • SHA512

    b41be414d39f208e7aa18090350de4377f4fc42d637d9e3ec1e2f23df04dfa81e4eee5bc2d024e5dee4a8b761702579d9a424dfbcafe9a2cd48b75e0edb1fbb0

  • SSDEEP

    6144:DKW+GxGCfZKDTbH+wnUfVI+NflkPaaXWXVCV+:DKvGxDZKDTbewUa+LMa0wVCV

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

3.4

Botnet

e749025c61b2caca10aa829a9e1a65a1

C2

https://steamcommunity.com/profiles/76561199494593681

https://t.me/auftriebs

Attributes
  • profile_id_v2

    e749025c61b2caca10aa829a9e1a65a1

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0

Extracted

Family

redline

Botnet

1379752987

C2

107.167.69.80:28253

Attributes
  • auth_value

    94039ae8b5b0b9ec5346501cc0139461

Signatures

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • LoaderBot executable 1 IoCs
  • XMRig Miner payload 14 IoCs
  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5e065bd9a3a411cac043f60a0df9bf4f6839042dfed251f86deed1e336d10cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a5e065bd9a3a411cac043f60a0df9bf4f6839042dfed251f86deed1e336d10cd.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2160
  • C:\Users\Admin\AppData\Local\Temp\200B.exe
    C:\Users\Admin\AppData\Local\Temp\200B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:2692
  • C:\Users\Admin\AppData\Local\Temp\2DE7.exe
    C:\Users\Admin\AppData\Local\Temp\2DE7.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\2DE7.exe
      "C:\Users\Admin\AppData\Local\Temp\2DE7.exe"
      2⤵
      • Executes dropped EXE
      PID:3752
    • C:\Users\Admin\AppData\Local\Temp\2DE7.exe
      "C:\Users\Admin\AppData\Local\Temp\2DE7.exe"
      2⤵
      • Executes dropped EXE
      PID:1220
  • C:\Users\Admin\AppData\Local\Temp\3A8A.exe
    C:\Users\Admin\AppData\Local\Temp\3A8A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:2244
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
          PID:2964
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          2⤵
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 43vDzCah59pa7NjPUPS2ow6tp1drE7MUU188sTbUJ1wzNyfnvRyDdtic8C4kPMambW1PcRMbkBgvbM157NBNjs3tRWxYy83 -p x -k -v=0 --donate-level=0 -t 2
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2188
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2188 -s 760
              4⤵
              • Program crash
              PID:1752
          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 43vDzCah59pa7NjPUPS2ow6tp1drE7MUU188sTbUJ1wzNyfnvRyDdtic8C4kPMambW1PcRMbkBgvbM157NBNjs3tRWxYy83 -p x -k -v=0 --donate-level=0 -t 2
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1704
          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 43vDzCah59pa7NjPUPS2ow6tp1drE7MUU188sTbUJ1wzNyfnvRyDdtic8C4kPMambW1PcRMbkBgvbM157NBNjs3tRWxYy83 -p x -k -v=0 --donate-level=0 -t 2
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1224
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1540
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:3904
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:3516
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:2584
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:3020
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:3936
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:2848
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:4656
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:792
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 456 -p 2188 -ip 2188
                          1⤵
                            PID:2204

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\mozglue.dll

                            Filesize

                            593KB

                            MD5

                            c8fd9be83bc728cc04beffafc2907fe9

                            SHA1

                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                            SHA256

                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                            SHA512

                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          • C:\ProgramData\nss3.dll

                            Filesize

                            2.0MB

                            MD5

                            1cc453cdf74f31e4d913ff9c10acdde2

                            SHA1

                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                            SHA256

                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                            SHA512

                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2DE7.exe.log

                            Filesize

                            1KB

                            MD5

                            8ec831f3e3a3f77e4a7b9cd32b48384c

                            SHA1

                            d83f09fd87c5bd86e045873c231c14836e76a05c

                            SHA256

                            7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                            SHA512

                            26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                          • C:\Users\Admin\AppData\Local\Temp\200B.exe

                            Filesize

                            471KB

                            MD5

                            603e0b4083560a933494a6a844ecac4c

                            SHA1

                            604063cfe175b37c6e7b21b6c7173ecddd9227ba

                            SHA256

                            2b999d539dab833c70b1575a767273eafcc880cc95114707215a10b05d4c26d7

                            SHA512

                            9f8a45140c8343ff0772d76036aaf6ccc51e09dc22a37c6174422a06c37fe19a12e48b116be1654d22e7e21334e7cfa781953a4bed62dfe7b4c321bf5dbac9cd

                          • C:\Users\Admin\AppData\Local\Temp\200B.exe

                            Filesize

                            471KB

                            MD5

                            603e0b4083560a933494a6a844ecac4c

                            SHA1

                            604063cfe175b37c6e7b21b6c7173ecddd9227ba

                            SHA256

                            2b999d539dab833c70b1575a767273eafcc880cc95114707215a10b05d4c26d7

                            SHA512

                            9f8a45140c8343ff0772d76036aaf6ccc51e09dc22a37c6174422a06c37fe19a12e48b116be1654d22e7e21334e7cfa781953a4bed62dfe7b4c321bf5dbac9cd

                          • C:\Users\Admin\AppData\Local\Temp\2DE7.exe

                            Filesize

                            553KB

                            MD5

                            e0888920ecf5282f98cc62836905ecdd

                            SHA1

                            3e954e4030869d99ecbaf6503acafd1ef4a81dbf

                            SHA256

                            f57536badf2858c34c301bc1fd7e237a1f700f3e48c6563cdf4ada287d1151f2

                            SHA512

                            ab8fd95c90930875b3db507c75ec5d883b1b73966129df31dc300ebe2d6ee6b7fb540d7bd46e5dedcf88ab3affa5713ae408f57081dd54e6323ee06f99b9a7ea

                          • C:\Users\Admin\AppData\Local\Temp\2DE7.exe

                            Filesize

                            553KB

                            MD5

                            e0888920ecf5282f98cc62836905ecdd

                            SHA1

                            3e954e4030869d99ecbaf6503acafd1ef4a81dbf

                            SHA256

                            f57536badf2858c34c301bc1fd7e237a1f700f3e48c6563cdf4ada287d1151f2

                            SHA512

                            ab8fd95c90930875b3db507c75ec5d883b1b73966129df31dc300ebe2d6ee6b7fb540d7bd46e5dedcf88ab3affa5713ae408f57081dd54e6323ee06f99b9a7ea

                          • C:\Users\Admin\AppData\Local\Temp\2DE7.exe

                            Filesize

                            553KB

                            MD5

                            e0888920ecf5282f98cc62836905ecdd

                            SHA1

                            3e954e4030869d99ecbaf6503acafd1ef4a81dbf

                            SHA256

                            f57536badf2858c34c301bc1fd7e237a1f700f3e48c6563cdf4ada287d1151f2

                            SHA512

                            ab8fd95c90930875b3db507c75ec5d883b1b73966129df31dc300ebe2d6ee6b7fb540d7bd46e5dedcf88ab3affa5713ae408f57081dd54e6323ee06f99b9a7ea

                          • C:\Users\Admin\AppData\Local\Temp\2DE7.exe

                            Filesize

                            553KB

                            MD5

                            e0888920ecf5282f98cc62836905ecdd

                            SHA1

                            3e954e4030869d99ecbaf6503acafd1ef4a81dbf

                            SHA256

                            f57536badf2858c34c301bc1fd7e237a1f700f3e48c6563cdf4ada287d1151f2

                            SHA512

                            ab8fd95c90930875b3db507c75ec5d883b1b73966129df31dc300ebe2d6ee6b7fb540d7bd46e5dedcf88ab3affa5713ae408f57081dd54e6323ee06f99b9a7ea

                          • C:\Users\Admin\AppData\Local\Temp\3A8A.exe

                            Filesize

                            5.0MB

                            MD5

                            8b1f945c3be65f087ce41188397403be

                            SHA1

                            aa9bc2cf10e61c12b5ab418179e0d2ec40c0202c

                            SHA256

                            e82ddd25a062bc207cc82773a9c8f902be0e3343a7a644d95de765d74ff60ab9

                            SHA512

                            ee743eb12a28dc67b4bd1be96549d6cfca2dfc640d3f55606cbf83f07196ef64fac017f2889acf2ca0120ea1814737dbce2b911c45bc40ba5d3c1345a132b871

                          • C:\Users\Admin\AppData\Local\Temp\3A8A.exe

                            Filesize

                            5.0MB

                            MD5

                            8b1f945c3be65f087ce41188397403be

                            SHA1

                            aa9bc2cf10e61c12b5ab418179e0d2ec40c0202c

                            SHA256

                            e82ddd25a062bc207cc82773a9c8f902be0e3343a7a644d95de765d74ff60ab9

                            SHA512

                            ee743eb12a28dc67b4bd1be96549d6cfca2dfc640d3f55606cbf83f07196ef64fac017f2889acf2ca0120ea1814737dbce2b911c45bc40ba5d3c1345a132b871

                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

                            Filesize

                            3.9MB

                            MD5

                            02569a7a91a71133d4a1023bf32aa6f4

                            SHA1

                            0f16bcb3f3f085d3d3be912195558e9f9680d574

                            SHA256

                            8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

                            SHA512

                            534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

                            Filesize

                            3.9MB

                            MD5

                            02569a7a91a71133d4a1023bf32aa6f4

                            SHA1

                            0f16bcb3f3f085d3d3be912195558e9f9680d574

                            SHA256

                            8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

                            SHA512

                            534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

                            Filesize

                            3.9MB

                            MD5

                            02569a7a91a71133d4a1023bf32aa6f4

                            SHA1

                            0f16bcb3f3f085d3d3be912195558e9f9680d574

                            SHA256

                            8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

                            SHA512

                            534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

                            Filesize

                            3.9MB

                            MD5

                            02569a7a91a71133d4a1023bf32aa6f4

                            SHA1

                            0f16bcb3f3f085d3d3be912195558e9f9680d574

                            SHA256

                            8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

                            SHA512

                            534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

                            Filesize

                            3.9MB

                            MD5

                            02569a7a91a71133d4a1023bf32aa6f4

                            SHA1

                            0f16bcb3f3f085d3d3be912195558e9f9680d574

                            SHA256

                            8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

                            SHA512

                            534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

                          • memory/792-277-0x0000000000EE0000-0x0000000000EED000-memory.dmp

                            Filesize

                            52KB

                          • memory/792-246-0x0000000000EE0000-0x0000000000EED000-memory.dmp

                            Filesize

                            52KB

                          • memory/792-247-0x00000000005D0000-0x00000000005DB000-memory.dmp

                            Filesize

                            44KB

                          • memory/792-245-0x00000000005D0000-0x00000000005DB000-memory.dmp

                            Filesize

                            44KB

                          • memory/1220-299-0x00000000051D0000-0x00000000052DA000-memory.dmp

                            Filesize

                            1.0MB

                          • memory/1220-292-0x0000000000400000-0x0000000000430000-memory.dmp

                            Filesize

                            192KB

                          • memory/1220-309-0x0000000008430000-0x000000000895C000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/1220-308-0x0000000007D30000-0x0000000007EF2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/1220-307-0x00000000050B0000-0x00000000050C0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1220-298-0x00000000056E0000-0x0000000005CF8000-memory.dmp

                            Filesize

                            6.1MB

                          • memory/1220-304-0x00000000063F0000-0x0000000006440000-memory.dmp

                            Filesize

                            320KB

                          • memory/1220-303-0x0000000005470000-0x00000000054E6000-memory.dmp

                            Filesize

                            472KB

                          • memory/1220-302-0x00000000050B0000-0x00000000050C0000-memory.dmp

                            Filesize

                            64KB

                          • memory/1220-301-0x0000000005160000-0x000000000519C000-memory.dmp

                            Filesize

                            240KB

                          • memory/1220-300-0x0000000005100000-0x0000000005112000-memory.dmp

                            Filesize

                            72KB

                          • memory/1224-315-0x0000000001EE0000-0x0000000001F00000-memory.dmp

                            Filesize

                            128KB

                          • memory/1224-319-0x0000000001EE0000-0x0000000001F00000-memory.dmp

                            Filesize

                            128KB

                          • memory/1224-297-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-311-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-306-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-325-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-323-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-313-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-314-0x0000000000510000-0x0000000000530000-memory.dmp

                            Filesize

                            128KB

                          • memory/1224-317-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-321-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1224-318-0x0000000000510000-0x0000000000530000-memory.dmp

                            Filesize

                            128KB

                          • memory/1540-220-0x0000000000550000-0x000000000055B000-memory.dmp

                            Filesize

                            44KB

                          • memory/1540-263-0x0000000004B30000-0x0000000004B40000-memory.dmp

                            Filesize

                            64KB

                          • memory/1540-218-0x0000000000550000-0x000000000055B000-memory.dmp

                            Filesize

                            44KB

                          • memory/1540-219-0x0000000004B30000-0x0000000004B40000-memory.dmp

                            Filesize

                            64KB

                          • memory/1704-287-0x0000000001FE0000-0x0000000002000000-memory.dmp

                            Filesize

                            128KB

                          • memory/1704-285-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1704-272-0x0000000000420000-0x0000000000440000-memory.dmp

                            Filesize

                            128KB

                          • memory/1704-280-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1704-286-0x0000000001FC0000-0x0000000001FE0000-memory.dmp

                            Filesize

                            128KB

                          • memory/1704-270-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1704-282-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1704-279-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/1704-284-0x0000000001FE0000-0x0000000002000000-memory.dmp

                            Filesize

                            128KB

                          • memory/1704-283-0x0000000001FC0000-0x0000000001FE0000-memory.dmp

                            Filesize

                            128KB

                          • memory/2160-134-0x0000000000960000-0x0000000000969000-memory.dmp

                            Filesize

                            36KB

                          • memory/2160-136-0x0000000000400000-0x00000000007FC000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/2188-264-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/2188-262-0x00000000004D0000-0x00000000004E4000-memory.dmp

                            Filesize

                            80KB

                          • memory/2188-261-0x0000000140000000-0x0000000140B75000-memory.dmp

                            Filesize

                            11.5MB

                          • memory/2584-273-0x0000000000A50000-0x0000000000A59000-memory.dmp

                            Filesize

                            36KB

                          • memory/2584-234-0x0000000000F10000-0x0000000000F1C000-memory.dmp

                            Filesize

                            48KB

                          • memory/2584-231-0x0000000000F10000-0x0000000000F1C000-memory.dmp

                            Filesize

                            48KB

                          • memory/2584-233-0x0000000000A50000-0x0000000000A59000-memory.dmp

                            Filesize

                            36KB

                          • memory/2692-228-0x0000000000400000-0x000000000081A000-memory.dmp

                            Filesize

                            4.1MB

                          • memory/2692-150-0x0000000000A70000-0x0000000000AC7000-memory.dmp

                            Filesize

                            348KB

                          • memory/2692-169-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                            Filesize

                            972KB

                          • memory/2848-275-0x0000000000A00000-0x0000000000A09000-memory.dmp

                            Filesize

                            36KB

                          • memory/2848-240-0x0000000000D30000-0x0000000000D3B000-memory.dmp

                            Filesize

                            44KB

                          • memory/2848-241-0x0000000000D30000-0x0000000000D3B000-memory.dmp

                            Filesize

                            44KB

                          • memory/3020-235-0x0000000000F10000-0x0000000000F1C000-memory.dmp

                            Filesize

                            48KB

                          • memory/3020-232-0x00000000005D0000-0x00000000005F7000-memory.dmp

                            Filesize

                            156KB

                          • memory/3020-236-0x00000000005D0000-0x00000000005F7000-memory.dmp

                            Filesize

                            156KB

                          • memory/3120-135-0x0000000000B00000-0x0000000000B16000-memory.dmp

                            Filesize

                            88KB

                          • memory/3516-227-0x0000000000A50000-0x0000000000A59000-memory.dmp

                            Filesize

                            36KB

                          • memory/3516-229-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/3516-230-0x0000000000A50000-0x0000000000A59000-memory.dmp

                            Filesize

                            36KB

                          • memory/3516-271-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/3904-268-0x0000000000550000-0x000000000055B000-memory.dmp

                            Filesize

                            44KB

                          • memory/3904-222-0x0000000000FF0000-0x0000000000FFF000-memory.dmp

                            Filesize

                            60KB

                          • memory/3904-225-0x0000000000FF0000-0x0000000000FFF000-memory.dmp

                            Filesize

                            60KB

                          • memory/3904-224-0x0000000000550000-0x000000000055B000-memory.dmp

                            Filesize

                            44KB

                          • memory/3936-274-0x00000000005D0000-0x00000000005F7000-memory.dmp

                            Filesize

                            156KB

                          • memory/3936-237-0x0000000000A00000-0x0000000000A09000-memory.dmp

                            Filesize

                            36KB

                          • memory/3936-238-0x00000000005D0000-0x00000000005F7000-memory.dmp

                            Filesize

                            156KB

                          • memory/3936-239-0x0000000000A00000-0x0000000000A09000-memory.dmp

                            Filesize

                            36KB

                          • memory/4016-221-0x0000000000400000-0x00000000007FE000-memory.dmp

                            Filesize

                            4.0MB

                          • memory/4016-269-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4016-250-0x00000000055B0000-0x0000000005616000-memory.dmp

                            Filesize

                            408KB

                          • memory/4016-226-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                            Filesize

                            64KB

                          • memory/4444-156-0x0000000005290000-0x0000000005834000-memory.dmp

                            Filesize

                            5.6MB

                          • memory/4444-168-0x0000000004B30000-0x0000000004B40000-memory.dmp

                            Filesize

                            64KB

                          • memory/4444-167-0x0000000004C40000-0x0000000004C4A000-memory.dmp

                            Filesize

                            40KB

                          • memory/4444-166-0x0000000004BA0000-0x0000000004C32000-memory.dmp

                            Filesize

                            584KB

                          • memory/4444-155-0x0000000000150000-0x00000000001E0000-memory.dmp

                            Filesize

                            576KB

                          • memory/4444-289-0x0000000005C70000-0x0000000005D0C000-memory.dmp

                            Filesize

                            624KB

                          • memory/4444-249-0x0000000004B30000-0x0000000004B40000-memory.dmp

                            Filesize

                            64KB

                          • memory/4656-242-0x0000000000EE0000-0x0000000000EED000-memory.dmp

                            Filesize

                            52KB

                          • memory/4656-243-0x0000000000D30000-0x0000000000D3B000-memory.dmp

                            Filesize

                            44KB

                          • memory/4656-244-0x0000000000EE0000-0x0000000000EED000-memory.dmp

                            Filesize

                            52KB

                          • memory/4656-276-0x0000000000D30000-0x0000000000D3B000-memory.dmp

                            Filesize

                            44KB