Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/07/2023, 18:24

General

  • Target

    17007c10b1f95256b04d7fe639e23b5a6095960dc43ef941c1427a6ef1577fd0.exe

  • Size

    515KB

  • MD5

    ecb1a71e10f63edb00f25122225d8406

  • SHA1

    6d38f6b15ef58a1c5ea43b5927a4af73d2fda5c5

  • SHA256

    17007c10b1f95256b04d7fe639e23b5a6095960dc43ef941c1427a6ef1577fd0

  • SHA512

    5f86a104dcb272081881dd3317031ac8274a53d315038b466335c657493707c4b0ca55808774395a462b8dcce7f6443b11b9df16cf6214326a32d4b667bd8b48

  • SSDEEP

    12288:lMrVy90+PiTk4YkZg9joHRKR6Bs+gh+WMdjid:Ay9PL4Lq9H6Bqh+de

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

news

C2

77.91.68.68:19071

Attributes
  • auth_value

    99ba2ffe8d72ebe9fdc7e758c94db148

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17007c10b1f95256b04d7fe639e23b5a6095960dc43ef941c1427a6ef1577fd0.exe
    "C:\Users\Admin\AppData\Local\Temp\17007c10b1f95256b04d7fe639e23b5a6095960dc43ef941c1427a6ef1577fd0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5447242.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5447242.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6751539.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6751539.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3339872.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3339872.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4776
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7873612.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7873612.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
            "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:2148
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1960
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:3996
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:N"
                  7⤵
                    PID:5000
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "danke.exe" /P "Admin:R" /E
                    7⤵
                      PID:2628
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4544
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:N"
                        7⤵
                          PID:1332
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\3ec1f323b5" /P "Admin:R" /E
                          7⤵
                            PID:4580
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4648
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9091105.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9091105.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:1688
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0366841.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0366841.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4964
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:4168
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:3060
              • C:\Users\Admin\AppData\Local\Temp\5654.exe
                C:\Users\Admin\AppData\Local\Temp\5654.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2236
                • C:\Windows\SysWOW64\regsvr32.exe
                  "C:\Windows\System32\regsvr32.exe" /s zMJ3IIjC.d /u
                  2⤵
                  • Loads dropped DLL
                  PID:2780

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\5654.exe

                Filesize

                1.4MB

                MD5

                9b35016b88e2225f337464a2807d94bb

                SHA1

                340938de5bce6e43cdc989e744ff185602637524

                SHA256

                0f41b6b8bf3de86321062740eb2bee3aacd1b5314630fc254dfa543ea445b118

                SHA512

                6cde8b4cd054c2ae25282f769553409d09e659e9246f9ac25c118a0aef35b88d0dc84b67532e00d6453221fcc75712445faa2ba3b66828aad9b80677d613f775

              • C:\Users\Admin\AppData\Local\Temp\5654.exe

                Filesize

                1.4MB

                MD5

                9b35016b88e2225f337464a2807d94bb

                SHA1

                340938de5bce6e43cdc989e744ff185602637524

                SHA256

                0f41b6b8bf3de86321062740eb2bee3aacd1b5314630fc254dfa543ea445b118

                SHA512

                6cde8b4cd054c2ae25282f769553409d09e659e9246f9ac25c118a0aef35b88d0dc84b67532e00d6453221fcc75712445faa2ba3b66828aad9b80677d613f775

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0366841.exe

                Filesize

                174KB

                MD5

                a2eac5b5692178b2ced166f46c3cd721

                SHA1

                86eca6278c5dac288a66fddc38bc6ce6d9bb29c0

                SHA256

                4402387083f5e1152797fbc7f4d73c0ca143b42cac5db9b14dc89368a909d883

                SHA512

                d30690ad2b3c8db8a72a0595b00d6c32e9ed09a08cb63f01b6008dcef838dbed174be396a9e263ffd3aad2602460b139164d00a023f1ece8ce7e092adc857d4b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0366841.exe

                Filesize

                174KB

                MD5

                a2eac5b5692178b2ced166f46c3cd721

                SHA1

                86eca6278c5dac288a66fddc38bc6ce6d9bb29c0

                SHA256

                4402387083f5e1152797fbc7f4d73c0ca143b42cac5db9b14dc89368a909d883

                SHA512

                d30690ad2b3c8db8a72a0595b00d6c32e9ed09a08cb63f01b6008dcef838dbed174be396a9e263ffd3aad2602460b139164d00a023f1ece8ce7e092adc857d4b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5447242.exe

                Filesize

                359KB

                MD5

                6950b51dd7dc720f19f3bcf8cd1f3141

                SHA1

                ae668d45ae1f28d551500e7bf70355f95ff6516d

                SHA256

                99670e6f5b623c24cf69a66b06266392b7d15ab8da396422aec93c91f642ff52

                SHA512

                3031fb8a8e597e639855b79fa191ab5b489fbe4450e98a1f1d3382feab3e2729d68043f79cd1f6a274f36cf760f78d1bb80e07856d276250825dd92b80844868

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5447242.exe

                Filesize

                359KB

                MD5

                6950b51dd7dc720f19f3bcf8cd1f3141

                SHA1

                ae668d45ae1f28d551500e7bf70355f95ff6516d

                SHA256

                99670e6f5b623c24cf69a66b06266392b7d15ab8da396422aec93c91f642ff52

                SHA512

                3031fb8a8e597e639855b79fa191ab5b489fbe4450e98a1f1d3382feab3e2729d68043f79cd1f6a274f36cf760f78d1bb80e07856d276250825dd92b80844868

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9091105.exe

                Filesize

                34KB

                MD5

                1bdf713cbdc39fe3210bb37aa5dcc95d

                SHA1

                fb642a6df3d6643804eec46fdd961103f8bda456

                SHA256

                d5f9493db1289d60abb89b22d2f1fa088d12547144e81ccbcd23877f4de0d99b

                SHA512

                b69b8c5b7168bdf1589dfe5de3c66704cfec882b94d87a0a0d33031ca5ae663f4c807b22120d763aed061cfb38cc99588a173d851e1a931ef3dcace2ae672794

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c9091105.exe

                Filesize

                34KB

                MD5

                1bdf713cbdc39fe3210bb37aa5dcc95d

                SHA1

                fb642a6df3d6643804eec46fdd961103f8bda456

                SHA256

                d5f9493db1289d60abb89b22d2f1fa088d12547144e81ccbcd23877f4de0d99b

                SHA512

                b69b8c5b7168bdf1589dfe5de3c66704cfec882b94d87a0a0d33031ca5ae663f4c807b22120d763aed061cfb38cc99588a173d851e1a931ef3dcace2ae672794

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6751539.exe

                Filesize

                234KB

                MD5

                e1856c4dbc967eacd2fe05fa5de1bfb7

                SHA1

                b9fedf02e404c3e4499480c9c46d9bf3b8a93c0c

                SHA256

                fef2f1b314a5264467fea80f6abe7e0ac99f36d7789303bf9f4380780acbe4a9

                SHA512

                b82ebbed9ece087547610b0f3d78505c019eab310fb70cfaa2157cad75f89d935a6f1121cc6c6886b296381663c33ef078d5f9d75c8700ae28c2a5e9e5bc9a07

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6751539.exe

                Filesize

                234KB

                MD5

                e1856c4dbc967eacd2fe05fa5de1bfb7

                SHA1

                b9fedf02e404c3e4499480c9c46d9bf3b8a93c0c

                SHA256

                fef2f1b314a5264467fea80f6abe7e0ac99f36d7789303bf9f4380780acbe4a9

                SHA512

                b82ebbed9ece087547610b0f3d78505c019eab310fb70cfaa2157cad75f89d935a6f1121cc6c6886b296381663c33ef078d5f9d75c8700ae28c2a5e9e5bc9a07

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3339872.exe

                Filesize

                12KB

                MD5

                a4a90c12051936be81b13f5b4778409b

                SHA1

                e4a10b3fd62e25b6935dd56c07043205cdbb4188

                SHA256

                dc6cbbb27e8f1a11f42d484ba7c6d5d0675aafdc479bd99397d374711e427aac

                SHA512

                36066408c153b7da5efe90ce707845829492358f181ce076dc48893d5352c7957b82a8d092c1ac1e65d93911a309f7dda3b013310ddb876709cb325fce372851

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3339872.exe

                Filesize

                12KB

                MD5

                a4a90c12051936be81b13f5b4778409b

                SHA1

                e4a10b3fd62e25b6935dd56c07043205cdbb4188

                SHA256

                dc6cbbb27e8f1a11f42d484ba7c6d5d0675aafdc479bd99397d374711e427aac

                SHA512

                36066408c153b7da5efe90ce707845829492358f181ce076dc48893d5352c7957b82a8d092c1ac1e65d93911a309f7dda3b013310ddb876709cb325fce372851

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7873612.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7873612.exe

                Filesize

                230KB

                MD5

                14e3f45f93b22bf0809aa316acaca40f

                SHA1

                bb2a4363551c625b8ff6b210b65f59b80e2754cb

                SHA256

                3a6245afa215c46c0b545513cf347f3159f5cfb132b9b37a61f0e28af9d3809e

                SHA512

                0bc83a86192be4ed492a198e43dc5a2d0670d11165f08616e59c056fd1838bb215c7123bd86fabf245dfb43acfd482dfe97b04a796c2830b1ea4760abf296d0a

              • C:\Users\Admin\AppData\Local\Temp\zMJ3IIjC.d

                Filesize

                1.2MB

                MD5

                c3043b9343eb77146eb6078c03e3ca06

                SHA1

                552e419e3181c195a6c2a35526493c8a48b93950

                SHA256

                bfda18816e6bafcbfd0862f839341c8ff8645802ec6b39b851a1bedbd0758caf

                SHA512

                caf95c5856fa80707a1a43da2563e71d93456401f0e0ef07c73e50d16ca6f1dd8e59d8a2058f36672c8da38bcac1f3d1c7d2b8282dfc03fe9045195cc596b799

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                272B

                MD5

                d867eabb1be5b45bc77bb06814e23640

                SHA1

                3139a51ce7e8462c31070363b9532c13cc52c82d

                SHA256

                38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349

                SHA512

                afc40d5fa7bcd41b8445f597990d150d57e3621ddef9400af742471aa0d14c2e66cfecc34482dadbaeb6f20912fda8ab786e584bf7fd1ad5fa23d3b95425fd59

              • \Users\Admin\AppData\Local\Temp\zMj3IijC.d

                Filesize

                1.2MB

                MD5

                c3043b9343eb77146eb6078c03e3ca06

                SHA1

                552e419e3181c195a6c2a35526493c8a48b93950

                SHA256

                bfda18816e6bafcbfd0862f839341c8ff8645802ec6b39b851a1bedbd0758caf

                SHA512

                caf95c5856fa80707a1a43da2563e71d93456401f0e0ef07c73e50d16ca6f1dd8e59d8a2058f36672c8da38bcac1f3d1c7d2b8282dfc03fe9045195cc596b799

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                dc587d08b8ca3cd62e5dc057d41a966b

                SHA1

                0ba6a88377c74a0c53b956d405ad17dd5f8c4164

                SHA256

                7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426

                SHA512

                7300ecc40bfa1129d907a9b074e8406fa01b5ff893c7c281e4441f8cc6a546bcb5e099d6635b2f9714ec1f0453dc41de19f2fca3475f36f62babc425892699a9

              • memory/1688-160-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/1688-162-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2780-209-0x0000000000400000-0x000000000053D000-memory.dmp

                Filesize

                1.2MB

              • memory/2780-216-0x00000000048D0000-0x00000000049B1000-memory.dmp

                Filesize

                900KB

              • memory/2780-215-0x00000000048D0000-0x00000000049B1000-memory.dmp

                Filesize

                900KB

              • memory/2780-213-0x00000000048D0000-0x00000000049B1000-memory.dmp

                Filesize

                900KB

              • memory/2780-212-0x00000000048D0000-0x00000000049B1000-memory.dmp

                Filesize

                900KB

              • memory/2780-211-0x00000000047D0000-0x00000000048CA000-memory.dmp

                Filesize

                1000KB

              • memory/2780-208-0x0000000000B50000-0x0000000000B56000-memory.dmp

                Filesize

                24KB

              • memory/3244-161-0x0000000000B40000-0x0000000000B56000-memory.dmp

                Filesize

                88KB

              • memory/4776-143-0x0000000000730000-0x000000000073A000-memory.dmp

                Filesize

                40KB

              • memory/4776-146-0x00007FFDC6DC0000-0x00007FFDC77AC000-memory.dmp

                Filesize

                9.9MB

              • memory/4776-144-0x00007FFDC6DC0000-0x00007FFDC77AC000-memory.dmp

                Filesize

                9.9MB

              • memory/4964-173-0x000000000A7A0000-0x000000000A7B2000-memory.dmp

                Filesize

                72KB

              • memory/4964-170-0x0000000005220000-0x0000000005226000-memory.dmp

                Filesize

                24KB

              • memory/4964-169-0x0000000071990000-0x000000007207E000-memory.dmp

                Filesize

                6.9MB

              • memory/4964-171-0x000000000AD50000-0x000000000B356000-memory.dmp

                Filesize

                6.0MB

              • memory/4964-172-0x000000000A870000-0x000000000A97A000-memory.dmp

                Filesize

                1.0MB

              • memory/4964-175-0x000000000A980000-0x000000000A9CB000-memory.dmp

                Filesize

                300KB

              • memory/4964-174-0x000000000A800000-0x000000000A83E000-memory.dmp

                Filesize

                248KB

              • memory/4964-177-0x0000000071990000-0x000000007207E000-memory.dmp

                Filesize

                6.9MB

              • memory/4964-168-0x0000000000A60000-0x0000000000A90000-memory.dmp

                Filesize

                192KB