Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2023, 11:04

General

  • Target

    5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac.exe

  • Size

    288KB

  • MD5

    44cad3753db6dfdf68a61dda7583fb24

  • SHA1

    cc6b309afa20c1aa47ad040b5948c3bb223c3d2c

  • SHA256

    5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac

  • SHA512

    08eaa46f565f42e4c9eee4bca45af4de39ee3e92c3312fd954c60fa4fd0b4bd3f52ccfccbbf5e291f669837701bab24220ebf651aedfec7f95745a6c16004436

  • SSDEEP

    3072:DcSin8xWnDYovrV6FNlACYYJt/2VkPEyWtIxEpwzQjS4/a9:riuWc+rV6/+CYyeuPENTpA

Malware Config

Extracted

Family

smokeloader

Botnet

0024

Extracted

Family

smokeloader

Version

2022

C2

https://utah-saints.com/search.php

https://atlanta-newspaper.com/search.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac.exe
    "C:\Users\Admin\AppData\Local\Temp\5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:432
  • C:\Windows\system32\cmd.exe
    cmd
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1056
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
      2⤵
        PID:1008
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
        2⤵
          PID:4908
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
          2⤵
            PID:4672
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
            2⤵
              PID:4168
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
              2⤵
                PID:1832
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
                2⤵
                  PID:1472
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
                  2⤵
                    PID:1636
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
                    2⤵
                      PID:3356
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
                      2⤵
                        PID:796
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
                        2⤵
                          PID:4492
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
                          2⤵
                            PID:1332
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
                            2⤵
                              PID:4612
                            • C:\Windows\system32\ipconfig.exe
                              ipconfig /displaydns
                              2⤵
                              • Gathers network information
                              PID:3760
                            • C:\Windows\system32\ROUTE.EXE
                              route print
                              2⤵
                                PID:1844
                              • C:\Windows\system32\netsh.exe
                                netsh firewall show state
                                2⤵
                                • Modifies Windows Firewall
                                PID:112
                              • C:\Windows\system32\systeminfo.exe
                                systeminfo
                                2⤵
                                • Gathers system information
                                PID:4532
                              • C:\Windows\system32\tasklist.exe
                                tasklist /v
                                2⤵
                                • Enumerates processes with tasklist
                                PID:3976
                              • C:\Windows\system32\net.exe
                                net accounts /domain
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4944
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 accounts /domain
                                  3⤵
                                    PID:4844
                                • C:\Windows\system32\net.exe
                                  net share
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2692
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 share
                                    3⤵
                                      PID:264
                                  • C:\Windows\system32\net.exe
                                    net user
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1056
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 user
                                      3⤵
                                        PID:3240
                                    • C:\Windows\system32\net.exe
                                      net user /domain
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5036
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 user /domain
                                        3⤵
                                          PID:4504
                                      • C:\Windows\system32\net.exe
                                        net use
                                        2⤵
                                          PID:4908
                                        • C:\Windows\system32\net.exe
                                          net group
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2092
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 group
                                            3⤵
                                              PID:4884
                                          • C:\Windows\system32\net.exe
                                            net localgroup
                                            2⤵
                                              PID:4560
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 localgroup
                                                3⤵
                                                  PID:3228
                                              • C:\Windows\system32\NETSTAT.EXE
                                                netstat -r
                                                2⤵
                                                • Gathers network information
                                                PID:4848
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                                                  3⤵
                                                    PID:2896
                                                    • C:\Windows\system32\ROUTE.EXE
                                                      C:\Windows\system32\route.exe print
                                                      4⤵
                                                        PID:4652
                                                  • C:\Windows\system32\NETSTAT.EXE
                                                    netstat -nao
                                                    2⤵
                                                    • Gathers network information
                                                    PID:3608
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /query
                                                    2⤵
                                                      PID:244
                                                    • C:\Windows\system32\ipconfig.exe
                                                      ipconfig /all
                                                      2⤵
                                                      • Gathers network information
                                                      PID:1476
                                                  • C:\Windows\system32\msiexec.exe
                                                    C:\Windows\system32\msiexec.exe /V
                                                    1⤵
                                                      PID:3604
                                                    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                      1⤵
                                                        PID:3324
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4128
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4128 CREDAT:17410 /prefetch:2
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:976
                                                      • C:\Windows\SysWOW64\explorer.exe
                                                        C:\Windows\SysWOW64\explorer.exe
                                                        1⤵
                                                        • Accesses Microsoft Outlook profiles
                                                        • outlook_office_path
                                                        • outlook_win_path
                                                        PID:636
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe
                                                        1⤵
                                                          PID:2608
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:1844
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:3544
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:1560
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:3840
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                            PID:4508
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe
                                                            1⤵
                                                              PID:2052
                                                            • C:\Windows\system32\rundll32.exe
                                                              C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
                                                              1⤵
                                                                PID:3492
                                                              • C:\Users\Admin\AppData\Roaming\vwhdfww
                                                                C:\Users\Admin\AppData\Roaming\vwhdfww
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:4688

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                Filesize

                                                                338B

                                                                MD5

                                                                f6b23e6e40ee93c0b23be23d8e97eee6

                                                                SHA1

                                                                7e2c621e982de2feea923dce40642e3a12951fd0

                                                                SHA256

                                                                fe3ee935e793217eb2f48575920d24c59aaaa852db70445897ce844155fd9494

                                                                SHA512

                                                                94096682733ea16b9800fa492120c29e6c2502cea7f6e7996ea00a345ac3accfde8a613b39734c6ba9890820bb7f63a79e16a049c8232b19fb2ed6be6f75705d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEA37.tmp

                                                                Filesize

                                                                15KB

                                                                MD5

                                                                1a545d0052b581fbb2ab4c52133846bc

                                                                SHA1

                                                                62f3266a9b9925cd6d98658b92adec673cbe3dd3

                                                                SHA256

                                                                557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                                                                SHA512

                                                                bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MBSMWSRL\suggestions[1].en-US

                                                                Filesize

                                                                17KB

                                                                MD5

                                                                5a34cb996293fde2cb7a4ac89587393a

                                                                SHA1

                                                                3c96c993500690d1a77873cd62bc639b3a10653f

                                                                SHA256

                                                                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                SHA512

                                                                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                              • C:\Users\Admin\AppData\Roaming\vwhdfww

                                                                Filesize

                                                                288KB

                                                                MD5

                                                                44cad3753db6dfdf68a61dda7583fb24

                                                                SHA1

                                                                cc6b309afa20c1aa47ad040b5948c3bb223c3d2c

                                                                SHA256

                                                                5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac

                                                                SHA512

                                                                08eaa46f565f42e4c9eee4bca45af4de39ee3e92c3312fd954c60fa4fd0b4bd3f52ccfccbbf5e291f669837701bab24220ebf651aedfec7f95745a6c16004436

                                                              • C:\Users\Admin\AppData\Roaming\vwhdfww

                                                                Filesize

                                                                288KB

                                                                MD5

                                                                44cad3753db6dfdf68a61dda7583fb24

                                                                SHA1

                                                                cc6b309afa20c1aa47ad040b5948c3bb223c3d2c

                                                                SHA256

                                                                5086dde757947a8b62ce0a7b39fe01dbdaceaf90edb1ea5589833a79b82471ac

                                                                SHA512

                                                                08eaa46f565f42e4c9eee4bca45af4de39ee3e92c3312fd954c60fa4fd0b4bd3f52ccfccbbf5e291f669837701bab24220ebf651aedfec7f95745a6c16004436

                                                              • memory/432-5-0x0000000000400000-0x0000000002285000-memory.dmp

                                                                Filesize

                                                                30.5MB

                                                              • memory/432-1-0x00000000024E0000-0x00000000025E0000-memory.dmp

                                                                Filesize

                                                                1024KB

                                                              • memory/432-3-0x0000000000400000-0x0000000002285000-memory.dmp

                                                                Filesize

                                                                30.5MB

                                                              • memory/432-2-0x0000000003FD0000-0x0000000003FD9000-memory.dmp

                                                                Filesize

                                                                36KB

                                                              • memory/636-88-0x0000000000E00000-0x0000000000E6B000-memory.dmp

                                                                Filesize

                                                                428KB

                                                              • memory/636-61-0x0000000000E70000-0x0000000000EE5000-memory.dmp

                                                                Filesize

                                                                468KB

                                                              • memory/636-63-0x0000000000E00000-0x0000000000E6B000-memory.dmp

                                                                Filesize

                                                                428KB

                                                              • memory/636-62-0x0000000000E00000-0x0000000000E6B000-memory.dmp

                                                                Filesize

                                                                428KB

                                                              • memory/1560-118-0x0000000000BC0000-0x0000000000BC5000-memory.dmp

                                                                Filesize

                                                                20KB

                                                              • memory/1560-96-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

                                                                Filesize

                                                                36KB

                                                              • memory/1560-94-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

                                                                Filesize

                                                                36KB

                                                              • memory/1560-95-0x0000000000BC0000-0x0000000000BC5000-memory.dmp

                                                                Filesize

                                                                20KB

                                                              • memory/1844-106-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

                                                                Filesize

                                                                44KB

                                                              • memory/1844-91-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

                                                                Filesize

                                                                44KB

                                                              • memory/1844-90-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

                                                                Filesize

                                                                44KB

                                                              • memory/1844-89-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

                                                                Filesize

                                                                28KB

                                                              • memory/1844-101-0x0000000000BC0000-0x0000000000BC7000-memory.dmp

                                                                Filesize

                                                                28KB

                                                              • memory/2052-116-0x0000000001000000-0x000000000100D000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2052-117-0x0000000001000000-0x000000000100D000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2052-115-0x0000000001010000-0x0000000001017000-memory.dmp

                                                                Filesize

                                                                28KB

                                                              • memory/2608-87-0x0000000000480000-0x000000000048C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/2608-86-0x0000000000490000-0x0000000000497000-memory.dmp

                                                                Filesize

                                                                28KB

                                                              • memory/2608-82-0x0000000000480000-0x000000000048C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/3144-113-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-108-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-40-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-39-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-42-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-43-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-44-0x0000000003400000-0x0000000003410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-51-0x0000000003120000-0x0000000003130000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-37-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-38-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-36-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-33-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-34-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-28-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-29-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-30-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-31-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-27-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-24-0x0000000003400000-0x0000000003410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-25-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-4-0x00000000010F0000-0x0000000001106000-memory.dmp

                                                                Filesize

                                                                88KB

                                                              • memory/3144-8-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-23-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-22-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-21-0x0000000003400000-0x0000000003410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-9-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-10-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-11-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-20-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-144-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-140-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-103-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-104-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-105-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-19-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-143-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-35-0x0000000003400000-0x0000000003410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-107-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-110-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-111-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-114-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-17-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-15-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-14-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-13-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-12-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-119-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-120-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-121-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-122-0x0000000002F00000-0x0000000002F0C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/3144-123-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-141-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-125-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-128-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-124-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-129-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-135-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-133-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-134-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-137-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-139-0x00000000011D0000-0x00000000011E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3144-136-0x0000000002F00000-0x0000000002F10000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3544-109-0x0000000000E20000-0x0000000000E2F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/3544-93-0x0000000000E30000-0x0000000000E39000-memory.dmp

                                                                Filesize

                                                                36KB

                                                              • memory/3544-92-0x0000000000E20000-0x0000000000E2F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/3840-126-0x0000000000E10000-0x0000000000E1C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/3840-97-0x0000000000E20000-0x0000000000E26000-memory.dmp

                                                                Filesize

                                                                24KB

                                                              • memory/3840-98-0x0000000000E10000-0x0000000000E1C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                              • memory/4508-131-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

                                                                Filesize

                                                                24KB

                                                              • memory/4508-102-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

                                                                Filesize

                                                                44KB

                                                              • memory/4508-99-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

                                                                Filesize

                                                                24KB

                                                              • memory/4508-100-0x0000000000BB0000-0x0000000000BBB000-memory.dmp

                                                                Filesize

                                                                44KB