Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 15:24

General

  • Target

    3be3b9598ff79fbeb33c3f46d97cbdb2e243e5722dcc90c676fe2542f7b20629.exe

  • Size

    642KB

  • MD5

    5d84c4154146297bf41845a89da99c76

  • SHA1

    6032389b62279d71e8616a42bd8045bfe8f26333

  • SHA256

    3be3b9598ff79fbeb33c3f46d97cbdb2e243e5722dcc90c676fe2542f7b20629

  • SHA512

    8317f36bda76faaec1e7abe987c1d9ca9f498ce1c3986ae17a5fc5a4504b9f09a5a8f33bdfeb6cacd36fae832c4abee495c8fa1a37cd4f9f32b79f1938035069

  • SSDEEP

    12288:PMrLy90LYKsU6jjsud7209cXuuiPHmNXLccd97fTnsHGvCmJ5MLDiISL8pv8:cy0YHYiD9uiPHmNbXd9kHGP5c2ISLCv8

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

maxik

C2

77.91.124.156:19071

Attributes
  • auth_value

    a7714e1bc167c67e3fc8f9e368352269

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3be3b9598ff79fbeb33c3f46d97cbdb2e243e5722dcc90c676fe2542f7b20629.exe
    "C:\Users\Admin\AppData\Local\Temp\3be3b9598ff79fbeb33c3f46d97cbdb2e243e5722dcc90c676fe2542f7b20629.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9961383.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9961383.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4800857.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4800857.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9326210.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9326210.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6943523.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6943523.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3788
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6797113.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6797113.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3388
            • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
              "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2268
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1044
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:1104
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "pdates.exe" /P "Admin:N"
                    8⤵
                      PID:2780
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "pdates.exe" /P "Admin:R" /E
                      8⤵
                        PID:3004
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4960
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\925e7e99c5" /P "Admin:N"
                          8⤵
                            PID:2552
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\925e7e99c5" /P "Admin:R" /E
                            8⤵
                              PID:1000
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:396
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8404270.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8404270.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:2432
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3491648.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3491648.exe
                    3⤵
                    • Executes dropped EXE
                    PID:3288
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4600
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:3676
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4072

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9961383.exe

                Filesize

                515KB

                MD5

                b1c5d520f6e48ddf7060d54f713c5a6e

                SHA1

                dcb0c2768654be235a9a576fbee11813caddadda

                SHA256

                ccb9ea1968cb24b81172a5998088bf1cb92de220dbf392174f4ec645d67d1547

                SHA512

                8416222e3290bd889de1bdea368ed2598ed5fc67594809c61fd0b16d5615540e42971c85568791fe7f0e87fd913e6b46f08f287f5265d3114cb9cb73eda3cd74

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9961383.exe

                Filesize

                515KB

                MD5

                b1c5d520f6e48ddf7060d54f713c5a6e

                SHA1

                dcb0c2768654be235a9a576fbee11813caddadda

                SHA256

                ccb9ea1968cb24b81172a5998088bf1cb92de220dbf392174f4ec645d67d1547

                SHA512

                8416222e3290bd889de1bdea368ed2598ed5fc67594809c61fd0b16d5615540e42971c85568791fe7f0e87fd913e6b46f08f287f5265d3114cb9cb73eda3cd74

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3491648.exe

                Filesize

                174KB

                MD5

                164811e5dd25b298c32884cef7bf7ce0

                SHA1

                d85b4f7fc8791bb83701a29f27d4ccafcb800b9a

                SHA256

                0bd48b93bcabe4c0ca77788462c365db7c684a453dd4b61bcdd14094a1d3c820

                SHA512

                7c6f654f3aedef377c48403afc1605ba2d4e582d2618e7720fca39dbbcc8db381b50f12dd612fd341be12b2466bdebd42a29e651ddae701ff8b86a70ba40ba80

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d3491648.exe

                Filesize

                174KB

                MD5

                164811e5dd25b298c32884cef7bf7ce0

                SHA1

                d85b4f7fc8791bb83701a29f27d4ccafcb800b9a

                SHA256

                0bd48b93bcabe4c0ca77788462c365db7c684a453dd4b61bcdd14094a1d3c820

                SHA512

                7c6f654f3aedef377c48403afc1605ba2d4e582d2618e7720fca39dbbcc8db381b50f12dd612fd341be12b2466bdebd42a29e651ddae701ff8b86a70ba40ba80

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4800857.exe

                Filesize

                359KB

                MD5

                0feee56f7bff25cf77a213763b1e9dd4

                SHA1

                53a4f3da470c973eb3e5bb60596aa63886fb4c83

                SHA256

                e75b0f1461c5ec2d55ca658bab7250e579b84ef02f2a039129d51c33a1ea3fa0

                SHA512

                39ebbdf4aa15a5e48d432b87be440f0d49a35e7eb47754061c136965392bb37914acf52c184a2a881ef504cc7bc6092ba7514785982e71bcc1bbf7df982be8fa

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4800857.exe

                Filesize

                359KB

                MD5

                0feee56f7bff25cf77a213763b1e9dd4

                SHA1

                53a4f3da470c973eb3e5bb60596aa63886fb4c83

                SHA256

                e75b0f1461c5ec2d55ca658bab7250e579b84ef02f2a039129d51c33a1ea3fa0

                SHA512

                39ebbdf4aa15a5e48d432b87be440f0d49a35e7eb47754061c136965392bb37914acf52c184a2a881ef504cc7bc6092ba7514785982e71bcc1bbf7df982be8fa

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8404270.exe

                Filesize

                39KB

                MD5

                9ae76fff7a6f1969677b53702e706885

                SHA1

                50d8a83287ff5cee4fc47ed3fd11cba656c0fd25

                SHA256

                05073cd73f8b270ef261819654f448a6e5d623e9e23fcba7e4783cbc063638a9

                SHA512

                b6433d5b7f3139cdf4137b3ad9ab3546c2903f402504101d7a5ad4ef6eae5d36b64031e18f5a3bd680ebe9ab43a702724a78b9f953885ace137cedb9cb8661a8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c8404270.exe

                Filesize

                39KB

                MD5

                9ae76fff7a6f1969677b53702e706885

                SHA1

                50d8a83287ff5cee4fc47ed3fd11cba656c0fd25

                SHA256

                05073cd73f8b270ef261819654f448a6e5d623e9e23fcba7e4783cbc063638a9

                SHA512

                b6433d5b7f3139cdf4137b3ad9ab3546c2903f402504101d7a5ad4ef6eae5d36b64031e18f5a3bd680ebe9ab43a702724a78b9f953885ace137cedb9cb8661a8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9326210.exe

                Filesize

                234KB

                MD5

                ecebdd07b9237a3f9e38eee99da90560

                SHA1

                bfc5059f9919d238a9541984fd560067d72c1c58

                SHA256

                d7e0a481d069f3d94ca3f44ef1d33bbce2f2acb87b2b77b3be3973680f656a1c

                SHA512

                aa9259c51ad9ddb4c537568fe80a773432636a8760a251f3dce77ff0adc985b4841880c86b6f25295609ecdf1597f1d97221d9bd30aa7112cf56d5f12cc40788

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9326210.exe

                Filesize

                234KB

                MD5

                ecebdd07b9237a3f9e38eee99da90560

                SHA1

                bfc5059f9919d238a9541984fd560067d72c1c58

                SHA256

                d7e0a481d069f3d94ca3f44ef1d33bbce2f2acb87b2b77b3be3973680f656a1c

                SHA512

                aa9259c51ad9ddb4c537568fe80a773432636a8760a251f3dce77ff0adc985b4841880c86b6f25295609ecdf1597f1d97221d9bd30aa7112cf56d5f12cc40788

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6943523.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a6943523.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6797113.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b6797113.exe

                Filesize

                230KB

                MD5

                d0c204b790127ffb5df700dce5b7ddc1

                SHA1

                5189edff0c08ccbb50d9a7229deb9263c60c5fc8

                SHA256

                1d10ff6a5e5b6bd045c0adcd5d879f1879bece728f7fa8a073f54b51b1f7cc6b

                SHA512

                30a8bc657e80e3fa0ba23a4aaff72e56d04eb7b2736ffd7e1e28227b95ed0d3e758ef4842069e3b0a9662cb4286c2ef4def19ec76c4e35268e1deab9f3c103fd

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                2392b231cf4a80739b5cb09bf808127d

                SHA1

                41b5cf81c50884954911d96444fe83cfd0da465b

                SHA256

                2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

                SHA512

                19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                9851b884bf4aadfade57d911a3f03332

                SHA1

                aaadd1c1856c22844bb9fbb030cf4f586ed8866a

                SHA256

                03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f

                SHA512

                a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327

              • memory/1020-183-0x0000000003280000-0x0000000003296000-memory.dmp

                Filesize

                88KB

              • memory/2432-181-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2432-184-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/3288-193-0x0000000004F00000-0x000000000500A000-memory.dmp

                Filesize

                1.0MB

              • memory/3288-195-0x0000000004E40000-0x0000000004E52000-memory.dmp

                Filesize

                72KB

              • memory/3288-194-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

                Filesize

                64KB

              • memory/3288-196-0x0000000004EA0000-0x0000000004EDC000-memory.dmp

                Filesize

                240KB

              • memory/3288-197-0x0000000072800000-0x0000000072FB0000-memory.dmp

                Filesize

                7.7MB

              • memory/3288-198-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

                Filesize

                64KB

              • memory/3288-192-0x0000000005410000-0x0000000005A28000-memory.dmp

                Filesize

                6.1MB

              • memory/3288-191-0x0000000072800000-0x0000000072FB0000-memory.dmp

                Filesize

                7.7MB

              • memory/3288-190-0x0000000000370000-0x00000000003A0000-memory.dmp

                Filesize

                192KB

              • memory/3788-164-0x00007FF8ECEF0000-0x00007FF8ED9B1000-memory.dmp

                Filesize

                10.8MB

              • memory/3788-162-0x00007FF8ECEF0000-0x00007FF8ED9B1000-memory.dmp

                Filesize

                10.8MB

              • memory/3788-161-0x0000000000160000-0x000000000016A000-memory.dmp

                Filesize

                40KB