Analysis

  • max time kernel
    47s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2023, 17:03

General

  • Target

    52d8af024085117c953e51448794db1ce4bc411436df0d7b692381626c84b9e1_JC.exe

  • Size

    300KB

  • MD5

    33487d7db4df8e52bbdfac0a3ee75c40

  • SHA1

    6f85b757c4ffc7075c83931901dc131eeeca1149

  • SHA256

    52d8af024085117c953e51448794db1ce4bc411436df0d7b692381626c84b9e1

  • SHA512

    9b08c2fa12d23335ef317820d4429b66ccfa5e1dae0359f23a94e4d904b53a1bca08a640bdf4e640d11b7fd985d6243786694d661d9e4c5a68afb0f7d0d321b6

  • SSDEEP

    6144:NGb3meV4m9q/EmtNsGyLP/r6pvEws/Hd:NgPVP9QTNsn/r6pvE9/9

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

38.181.25.43:3325

Attributes
  • auth_value

    082cde17c5630749ecb0376734fe99c9

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes
  • auth_value

    e94dff9a76da90d6b000642c4a52574b

Extracted

Family

amadey

Version

3.87

C2

http://79.137.192.18/9bDc8sQ/index.php

Attributes
  • install_dir

    577f58beff

  • install_file

    yiueea.exe

  • strings_key

    a5085075a537f09dec81cc154ec0af4d

rc4.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.38.95.107:42494

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\52d8af024085117c953e51448794db1ce4bc411436df0d7b692381626c84b9e1_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\52d8af024085117c953e51448794db1ce4bc411436df0d7b692381626c84b9e1_JC.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2184
  • C:\Users\Admin\AppData\Local\Temp\48EB.exe
    C:\Users\Admin\AppData\Local\Temp\48EB.exe
    1⤵
    • Executes dropped EXE
    PID:1172
  • C:\Users\Admin\AppData\Local\Temp\4A63.exe
    C:\Users\Admin\AppData\Local\Temp\4A63.exe
    1⤵
    • Executes dropped EXE
    PID:876
  • C:\Users\Admin\AppData\Local\Temp\4B00.exe
    C:\Users\Admin\AppData\Local\Temp\4B00.exe
    1⤵
    • Executes dropped EXE
    PID:4672
  • C:\Users\Admin\AppData\Local\Temp\59F5.exe
    C:\Users\Admin\AppData\Local\Temp\59F5.exe
    1⤵
    • Executes dropped EXE
    PID:2648
  • C:\Users\Admin\AppData\Local\Temp\5B8D.exe
    C:\Users\Admin\AppData\Local\Temp\5B8D.exe
    1⤵
    • Executes dropped EXE
    PID:2608
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\607F.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\607F.dll
      2⤵
      • Loads dropped DLL
      PID:4956
  • C:\Users\Admin\AppData\Local\Temp\6265.exe
    C:\Users\Admin\AppData\Local\Temp\6265.exe
    1⤵
    • Executes dropped EXE
    PID:2908
  • C:\Users\Admin\AppData\Local\Temp\64E6.exe
    C:\Users\Admin\AppData\Local\Temp\64E6.exe
    1⤵
    • Executes dropped EXE
    PID:564
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:4148
    • C:\Users\Admin\AppData\Local\Temp\6E7C.exe
      C:\Users\Admin\AppData\Local\Temp\6E7C.exe
      1⤵
      • Executes dropped EXE
      PID:2680
      • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
        "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
        2⤵
          PID:4476
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
            3⤵
            • Creates scheduled task(s)
            PID:1240
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
            3⤵
              PID:3696
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:1308
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "yiueea.exe" /P "Admin:N"
                  4⤵
                    PID:3716
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "yiueea.exe" /P "Admin:R" /E
                    4⤵
                      PID:3100
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      4⤵
                        PID:1168
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\577f58beff" /P "Admin:N"
                        4⤵
                          PID:3104
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\577f58beff" /P "Admin:R" /E
                          4⤵
                            PID:1516
                    • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
                      C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
                      1⤵
                        PID:400

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\48EB.exe

                        Filesize

                        696KB

                        MD5

                        b5a67916054e01de81ec66ef37585346

                        SHA1

                        1ac7d03be26786858be1d45f34da5c9be73a78a5

                        SHA256

                        e883990293c39ceecaeb60f66867f802afce08920428540f1e7acf7bd383dd3c

                        SHA512

                        5bacbb1f56a6b59002eba592c14a965b32a415893a5d36ae1e59a87e307c940b2cc43786f13a09d47167b0ae27ac16ef7181bcc653972522c416f11b2c40677d

                      • C:\Users\Admin\AppData\Local\Temp\48EB.exe

                        Filesize

                        696KB

                        MD5

                        b5a67916054e01de81ec66ef37585346

                        SHA1

                        1ac7d03be26786858be1d45f34da5c9be73a78a5

                        SHA256

                        e883990293c39ceecaeb60f66867f802afce08920428540f1e7acf7bd383dd3c

                        SHA512

                        5bacbb1f56a6b59002eba592c14a965b32a415893a5d36ae1e59a87e307c940b2cc43786f13a09d47167b0ae27ac16ef7181bcc653972522c416f11b2c40677d

                      • C:\Users\Admin\AppData\Local\Temp\4A63.exe

                        Filesize

                        273KB

                        MD5

                        fc55462468d1a34e514d01aa30c0a5cd

                        SHA1

                        168e4cd58a14f9e4591d49877ab5cb08e9a142a0

                        SHA256

                        74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b

                        SHA512

                        e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

                      • C:\Users\Admin\AppData\Local\Temp\4A63.exe

                        Filesize

                        273KB

                        MD5

                        fc55462468d1a34e514d01aa30c0a5cd

                        SHA1

                        168e4cd58a14f9e4591d49877ab5cb08e9a142a0

                        SHA256

                        74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b

                        SHA512

                        e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

                      • C:\Users\Admin\AppData\Local\Temp\4B00.exe

                        Filesize

                        273KB

                        MD5

                        ed6778e6fe0c07587f4892c807d7f883

                        SHA1

                        3a94caa9336934ca2b12173b24fa815ea963edcb

                        SHA256

                        a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898

                        SHA512

                        b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

                      • C:\Users\Admin\AppData\Local\Temp\4B00.exe

                        Filesize

                        273KB

                        MD5

                        ed6778e6fe0c07587f4892c807d7f883

                        SHA1

                        3a94caa9336934ca2b12173b24fa815ea963edcb

                        SHA256

                        a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898

                        SHA512

                        b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

                      • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • C:\Users\Admin\AppData\Local\Temp\59F5.exe

                        Filesize

                        696KB

                        MD5

                        b5a67916054e01de81ec66ef37585346

                        SHA1

                        1ac7d03be26786858be1d45f34da5c9be73a78a5

                        SHA256

                        e883990293c39ceecaeb60f66867f802afce08920428540f1e7acf7bd383dd3c

                        SHA512

                        5bacbb1f56a6b59002eba592c14a965b32a415893a5d36ae1e59a87e307c940b2cc43786f13a09d47167b0ae27ac16ef7181bcc653972522c416f11b2c40677d

                      • C:\Users\Admin\AppData\Local\Temp\59F5.exe

                        Filesize

                        696KB

                        MD5

                        b5a67916054e01de81ec66ef37585346

                        SHA1

                        1ac7d03be26786858be1d45f34da5c9be73a78a5

                        SHA256

                        e883990293c39ceecaeb60f66867f802afce08920428540f1e7acf7bd383dd3c

                        SHA512

                        5bacbb1f56a6b59002eba592c14a965b32a415893a5d36ae1e59a87e307c940b2cc43786f13a09d47167b0ae27ac16ef7181bcc653972522c416f11b2c40677d

                      • C:\Users\Admin\AppData\Local\Temp\5B8D.exe

                        Filesize

                        573KB

                        MD5

                        c82816b9cae5ab07c38a317572f3453f

                        SHA1

                        ce1911787bf09e30932a07308e9f1b04dcf7f3dd

                        SHA256

                        07f738a9553af970e5b75ea53d566ae2a04fcdb19642f6c4fe9b820e46b60695

                        SHA512

                        0451c99010056aab9349295be93f4c41b1a4c9843c07cbc9f0c2a6e9ce7b69ff6ce0dafa05a6a81aebc952cd7bc20d4b74cfe4cacb14ca3c0fc568ef5593182b

                      • C:\Users\Admin\AppData\Local\Temp\5B8D.exe

                        Filesize

                        573KB

                        MD5

                        c82816b9cae5ab07c38a317572f3453f

                        SHA1

                        ce1911787bf09e30932a07308e9f1b04dcf7f3dd

                        SHA256

                        07f738a9553af970e5b75ea53d566ae2a04fcdb19642f6c4fe9b820e46b60695

                        SHA512

                        0451c99010056aab9349295be93f4c41b1a4c9843c07cbc9f0c2a6e9ce7b69ff6ce0dafa05a6a81aebc952cd7bc20d4b74cfe4cacb14ca3c0fc568ef5593182b

                      • C:\Users\Admin\AppData\Local\Temp\607F.dll

                        Filesize

                        2.8MB

                        MD5

                        cd473f96a31e502950837fb6ed2fe819

                        SHA1

                        87bf2e1161ef159b56db4a6350d4dfe219f30683

                        SHA256

                        b862581cd97d94bcd7f955ab75da813d84c182e86722695e3b03f8229c4d6d5c

                        SHA512

                        509881a3eeec7f6bc7fb6973f0df61dfe631f1636f4fb19024915dc5b6a1c51c1882037a76afad897d3ea67c618ac08ae0b318809626ed06dbbd9dd86a731d94

                      • C:\Users\Admin\AppData\Local\Temp\607F.dll

                        Filesize

                        2.8MB

                        MD5

                        cd473f96a31e502950837fb6ed2fe819

                        SHA1

                        87bf2e1161ef159b56db4a6350d4dfe219f30683

                        SHA256

                        b862581cd97d94bcd7f955ab75da813d84c182e86722695e3b03f8229c4d6d5c

                        SHA512

                        509881a3eeec7f6bc7fb6973f0df61dfe631f1636f4fb19024915dc5b6a1c51c1882037a76afad897d3ea67c618ac08ae0b318809626ed06dbbd9dd86a731d94

                      • C:\Users\Admin\AppData\Local\Temp\6265.exe

                        Filesize

                        696KB

                        MD5

                        c2273e3679c0660d8b4cd294ec6f88a7

                        SHA1

                        1b01c714e54dca1c562ccb77e746a9645eee7cfc

                        SHA256

                        d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664

                        SHA512

                        afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

                      • C:\Users\Admin\AppData\Local\Temp\6265.exe

                        Filesize

                        696KB

                        MD5

                        c2273e3679c0660d8b4cd294ec6f88a7

                        SHA1

                        1b01c714e54dca1c562ccb77e746a9645eee7cfc

                        SHA256

                        d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664

                        SHA512

                        afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d

                      • C:\Users\Admin\AppData\Local\Temp\64E6.exe

                        Filesize

                        1.8MB

                        MD5

                        c7b34cc95676afe2b43fce196202d3fa

                        SHA1

                        92eb09a6883ef684d3d175ece6599a61266bada9

                        SHA256

                        8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060

                        SHA512

                        0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

                      • C:\Users\Admin\AppData\Local\Temp\64E6.exe

                        Filesize

                        1.8MB

                        MD5

                        c7b34cc95676afe2b43fce196202d3fa

                        SHA1

                        92eb09a6883ef684d3d175ece6599a61266bada9

                        SHA256

                        8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060

                        SHA512

                        0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

                      • C:\Users\Admin\AppData\Local\Temp\6E7C.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • C:\Users\Admin\AppData\Local\Temp\6E7C.exe

                        Filesize

                        307KB

                        MD5

                        55f845c433e637594aaf872e41fda207

                        SHA1

                        1188348ca7e52f075e7d1d0031918c2cea93362e

                        SHA256

                        f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

                        SHA512

                        5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

                      • memory/876-36-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/876-76-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/876-86-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                        Filesize

                        64KB

                      • memory/876-25-0x0000000000400000-0x0000000000445000-memory.dmp

                        Filesize

                        276KB

                      • memory/876-99-0x0000000006B30000-0x0000000006B80000-memory.dmp

                        Filesize

                        320KB

                      • memory/876-43-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                        Filesize

                        64KB

                      • memory/876-27-0x00000000020A0000-0x00000000020D0000-memory.dmp

                        Filesize

                        192KB

                      • memory/876-44-0x0000000005380000-0x0000000005392000-memory.dmp

                        Filesize

                        72KB

                      • memory/876-107-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/2184-1-0x00000000025F0000-0x00000000026F0000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2184-9-0x0000000003EA0000-0x0000000003EA9000-memory.dmp

                        Filesize

                        36KB

                      • memory/2184-6-0x0000000000400000-0x0000000002291000-memory.dmp

                        Filesize

                        30.6MB

                      • memory/2184-4-0x0000000000400000-0x0000000002291000-memory.dmp

                        Filesize

                        30.6MB

                      • memory/2184-3-0x0000000000400000-0x0000000002291000-memory.dmp

                        Filesize

                        30.6MB

                      • memory/2184-2-0x0000000003EA0000-0x0000000003EA9000-memory.dmp

                        Filesize

                        36KB

                      • memory/2608-92-0x000001C2611D0000-0x000001C2611E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2608-51-0x000001C246CB0000-0x000001C246D44000-memory.dmp

                        Filesize

                        592KB

                      • memory/2608-53-0x00007FFEDAC00000-0x00007FFEDB6C1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/2608-55-0x000001C2611D0000-0x000001C2611E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2608-52-0x000001C261150000-0x000001C26116A000-memory.dmp

                        Filesize

                        104KB

                      • memory/2608-91-0x00007FFEDAC00000-0x00007FFEDB6C1000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/3132-5-0x00000000032A0000-0x00000000032B6000-memory.dmp

                        Filesize

                        88KB

                      • memory/4148-108-0x0000000005290000-0x00000000052A0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4148-93-0x0000000000400000-0x0000000000430000-memory.dmp

                        Filesize

                        192KB

                      • memory/4148-117-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4148-104-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4148-98-0x0000000005290000-0x00000000052A0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4148-95-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4672-97-0x0000000006510000-0x0000000006A3C000-memory.dmp

                        Filesize

                        5.2MB

                      • memory/4672-28-0x00000000008F0000-0x0000000000920000-memory.dmp

                        Filesize

                        192KB

                      • memory/4672-88-0x00000000024E0000-0x00000000024F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4672-89-0x00000000056B0000-0x0000000005716000-memory.dmp

                        Filesize

                        408KB

                      • memory/4672-75-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4672-35-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4672-37-0x0000000004B60000-0x0000000005178000-memory.dmp

                        Filesize

                        6.1MB

                      • memory/4672-96-0x0000000006340000-0x0000000006502000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/4672-85-0x00000000055C0000-0x0000000005652000-memory.dmp

                        Filesize

                        584KB

                      • memory/4672-49-0x0000000005290000-0x00000000052CC000-memory.dmp

                        Filesize

                        240KB

                      • memory/4672-84-0x0000000005540000-0x00000000055B6000-memory.dmp

                        Filesize

                        472KB

                      • memory/4672-87-0x0000000005C90000-0x0000000006234000-memory.dmp

                        Filesize

                        5.6MB

                      • memory/4672-103-0x0000000074D80000-0x0000000075530000-memory.dmp

                        Filesize

                        7.7MB

                      • memory/4672-41-0x0000000005180000-0x000000000528A000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/4672-26-0x0000000000400000-0x0000000000445000-memory.dmp

                        Filesize

                        276KB

                      • memory/4672-45-0x00000000024E0000-0x00000000024F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4956-109-0x0000000002080000-0x0000000002182000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/4956-110-0x0000000010000000-0x00000000102D3000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/4956-111-0x0000000002510000-0x00000000025F8000-memory.dmp

                        Filesize

                        928KB

                      • memory/4956-112-0x0000000002510000-0x00000000025F8000-memory.dmp

                        Filesize

                        928KB

                      • memory/4956-114-0x0000000002510000-0x00000000025F8000-memory.dmp

                        Filesize

                        928KB

                      • memory/4956-115-0x0000000002510000-0x00000000025F8000-memory.dmp

                        Filesize

                        928KB

                      • memory/4956-65-0x00000000004A0000-0x00000000004A6000-memory.dmp

                        Filesize

                        24KB

                      • memory/4956-66-0x0000000010000000-0x00000000102D3000-memory.dmp

                        Filesize

                        2.8MB