Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 03:50

General

  • Target

    ad49dd256adedfa2be9188ec3f68cb75.exe

  • Size

    1.6MB

  • MD5

    ad49dd256adedfa2be9188ec3f68cb75

  • SHA1

    fe2b02b3d63339ca976759c0e450f82c288b8f3b

  • SHA256

    78dd9812c391c45f55ae45735371b6ac7d9f84aba107da824895be3b1d3250e1

  • SHA512

    d20c1b37e4ae6fe1cf0451037192299939beabfa9eebf1d103481370a7c730d843d2ec3eae0483e6dfa27bd088d6d1f9539b033ea0f82d7379723ea245d622fc

  • SSDEEP

    49152:BTouQ/MlgHcg1OeuDBLWoaOlJgbJrypAgLWnl:xouQ/olWglwrDJl

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad49dd256adedfa2be9188ec3f68cb75.exe
    "C:\Users\Admin\AppData\Local\Temp\ad49dd256adedfa2be9188ec3f68cb75.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
          • Drops startup file
          • Accesses Microsoft Outlook profiles
          • Adds Run key to start application
          • Drops file in System32 directory
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
            5⤵
            • Creates scheduled task(s)
            PID:3780
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
            5⤵
            • Creates scheduled task(s)
            PID:3520
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1420
            5⤵
            • Program crash
            PID:1924
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Drops file in System32 directory
      • Checks processor information in registry
      • outlook_office_path
      • outlook_win_path
      PID:1896
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1408
        3⤵
        • Program crash
        PID:552
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:5000
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:1236
      • C:\Users\Admin\AppData\Local\Temp\DDA9.exe
        C:\Users\Admin\AppData\Local\Temp\DDA9.exe
        1⤵
        • Executes dropped EXE
        PID:3528
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
        1⤵
          PID:3648
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4316 -ip 4316
          1⤵
            PID:3784
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1896 -ip 1896
            1⤵
              PID:2492

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

              Filesize

              101KB

              MD5

              89d41e1cf478a3d3c2c701a27a5692b2

              SHA1

              691e20583ef80cb9a2fd3258560e7f02481d12fd

              SHA256

              dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

              SHA512

              5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

            • C:\Users\Admin\AppData\Local\Temp\DDA9.exe

              Filesize

              250KB

              MD5

              a548c0f704bcad593ac1edcc3c58be97

              SHA1

              29816f6961f665651ee793b63fe739b8916fc6e1

              SHA256

              fb4384deac2f3b3f877a47f3f1408de33a46d5d0e71c829c038c02caf9322855

              SHA512

              8bf0cc7fd1720f512551ebcec7a4919626cbb527f549b60e52598d504649fdad943016b0061a78491464eeb953b217e951ffcb40241bd2ec044cdf19083bb40f

            • C:\Users\Admin\AppData\Local\Temp\DDA9.exe

              Filesize

              180KB

              MD5

              bc8633125b95da56b3f2848e46c5c42b

              SHA1

              58a656b05e8f81fb8c372a44e00c2241fcebd1eb

              SHA256

              f225ef7ea878e9cdefb14c437b082a043ce6e5485d97f07db631b5ad34b8c6ab

              SHA512

              ba5c999ba3f6d33ce6430c5b2a78bbcb681103f2a0a5ee4aa89a74e67f89c163301f1bdf543569552d00ef1ddb54b4f944a3a277ab0d283256fed93e8ac298f0

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe

              Filesize

              1.2MB

              MD5

              85e49c2db208394b773e5531de91654c

              SHA1

              2ae85d894740e88548b55bdf43dea7aefbe32d97

              SHA256

              efaeb0ddb53a8fa8a3d3a9a09dd4c797a373e4bf8fa9bbbfb0b7ebf211fdb7de

              SHA512

              fd0a3874d69cbdd7832f8e9bc353a66f1971654dd93488801e12132ea6baeedd90ce2dfc3e3ca222570c9beccf7517b22fcb4035a141fd091d5c59840262ce97

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4XL763tv.exe

              Filesize

              267KB

              MD5

              01c41a0bf033d236ab47c68e7a679a00

              SHA1

              f235be01f47ea744dcf0093ff9949a389b0b9233

              SHA256

              ca44fed61162a2b105a8008278a62aaf8beeb9f5f7af0aae1e302e4e53d9c589

              SHA512

              cd29beab1ded21da5c7bbf3dd64c4a1ae4961131a1b6c053b6de3655507a5342f5b218e19c2ba3d39d1e0526a0e520fbde651d6dc9d2465da1d829f092ae4516

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe

              Filesize

              935KB

              MD5

              a9f0755518f7b32840de5ee0a96e20e4

              SHA1

              df640c0b6c99529a67befc9fae50141e4c176ebb

              SHA256

              adc0697873fb5f526c9edd475f7b4bfd3556346f7e1cfe2b30dcdf751edff5b4

              SHA512

              8f854804552bd1178aa4820f8be7d1175f83469f20d56526dcad3a81527b10834dee8ab44ecca46d9084a59af79887af9d19c7c7acdf8dbac01df65e74798d78

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo6PH81.exe

              Filesize

              780KB

              MD5

              fe02f9d594029578a040194e36aac42e

              SHA1

              35d4bb471dd296eb63f16a3d33a525d1d80e3751

              SHA256

              c979ce3f2ac49e7aac72b9560ade1e7bce2a251ca950e7810c784c0efd473af3

              SHA512

              1d7911a1e89f756bf5309d6ae71d0cd7e74377954cfca37184c1bdc76a4fafe6af2adb5a032540d1383865cea616a4a46190c524953f2db10394e0459a3e921c

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

              Filesize

              681KB

              MD5

              da245efc1d3dacf6bcbd6194586381df

              SHA1

              606441fdf3f90180ac775818fda79e94b3098bd1

              SHA256

              c705df974c57573c1c06e0bce751743c69d4bc9b85943db79d271141851898e3

              SHA512

              4f9898b7bd26fd436d3476d85f65b2fa3c7abfc3dbb504ff8e7423f6c36105019f73f702f9e190018b215d6bf052b74547de755f37498201d837741ad7d7e08b

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ma25Tt3.exe

              Filesize

              600KB

              MD5

              236d44a23132d5328c61a574564f7f65

              SHA1

              f668bf15f8fc17c4fe320c619e930b25a959fccd

              SHA256

              991fed0de42f9ccf0c683b112033f066f5564ed5de3c5f859d139c6a4353119e

              SHA512

              c4e81b407923d547b464366f4059b3ccb9ee464fb93d7dc6b2edbd6c283f4715f80e1974919131b4856e6fe46a56def9941fbdc784fa7698a0294d695eeaac42

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Eo80hP.exe

              Filesize

              37KB

              MD5

              7b4b527e87299f96a5094c09a47a5766

              SHA1

              b992a44e6d2b55353c9d1bc546b31223a63864f3

              SHA256

              1d6cb99c74f653f94dccfce32a3a9386e2cc883e79136bd62cc7238d49808c6a

              SHA512

              e9865754261e665356dcaabfdc6444b2de5440f35eb853cc5a1ae021447c0da555484533e311ada19a423f7677bff65d0fefcd4e2c064b676f3b52364846d9b4

            • C:\Users\Admin\AppData\Local\Temp\grandUIA48zYJBIdVIy9P\information.txt

              Filesize

              3KB

              MD5

              0a7361b46f35f035231874bb7619c826

              SHA1

              47c12e8922a2e5ba278818edcc892d287a847955

              SHA256

              439d4b0adb74ae5d912082852261ac5763bd6bd584d4ca24302181a03abac234

              SHA512

              56d5ed2127b49396de2c18840d87b5e8e913f2450ca11e3a05997072c9714bda9c7554155d9a055f4aedabba8125a9aad33868f545fa59847a0f5bba2ae08d5c

            • C:\Users\Admin\AppData\Local\Temp\grandUIA48zYJBIdVIy9P\passwords.txt

              Filesize

              5KB

              MD5

              d831c7aa1df1fb064c8a59d31c66b5a9

              SHA1

              16df05aa21e553beef97b3ffc9acb530b50b986b

              SHA256

              f95edc1a06df174c1208684c4d46cb0c6cc423cd15637f8b8dd573a575936982

              SHA512

              9b72a035fc8e2043f49b85ec16a2117f8ac9afd3a2fdd82c6c2c10c582408cfa4f9f373e509a39a9d0a9d6d46c2905018aff0ddcdb845439260660e7c980f93f

            • C:\Users\Admin\AppData\Local\Temp\grandUIAzR0sLKr2_Yvcf\information.txt

              Filesize

              3KB

              MD5

              0973af25e7b27ed2100b105970582fb5

              SHA1

              788b96942cffab9eadaf03cd14cd5f7addd55cc5

              SHA256

              167ed9858dfed42cbd5802de9657d6cc91f8d4e7ec9855fba1b04da05c2c0aa1

              SHA512

              8cd4f4dfce32d47725aefd9f4abc24ef9b47044d8e2a33e44c9a329c4f09cd694dc266e94176514ea27865313ddf2edbe3771da6277a63804805d518f5e8cdc5

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\02zdBXl47cvzHistory

              Filesize

              148KB

              MD5

              90a1d4b55edf36fa8b4cc6974ed7d4c4

              SHA1

              aba1b8d0e05421e7df5982899f626211c3c4b5c1

              SHA256

              7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

              SHA512

              ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\D87fZN3R3jFeWeb Data

              Filesize

              92KB

              MD5

              5bca7f96843d97e2c39afbb8b5f9865b

              SHA1

              e64666a5d705a768e2351621577a386400111251

              SHA256

              e25c46923271e687a972edfcf511d7685c24ce2e509a5b10d0ba4cd6f2bfeab2

              SHA512

              40771d495b407c0ede8ad3e5d8e77cf588a607426f0597f0c10a81ec7b2614f28a66a1c5ff36bf8bf6905bdc6b537d8cc5a749725adfc57f72ec3c9ee17f76d3

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\D87fZN3R3jFeplaces.sqlite

              Filesize

              1.9MB

              MD5

              28ea7ccbbd6f2fb69ec2d7b72e5b94e8

              SHA1

              447681349b11e7cdc05b3c9e35c50f05c2903cb7

              SHA256

              277b8f849113bdc59557b6ae611e3a4c947e1e15d520fb2512162329febc080e

              SHA512

              a2c859a2ee84293c43f33eab3442d33a9c3a9cc5dcb2da639602b4462db6758c764f77c8e7d56b7c1a73c1e086c3fb1dd9f8c83a34e3a4521a213e5c1384fea9

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\Ei8DrAmaYu9KLogin Data

              Filesize

              46KB

              MD5

              02d2c46697e3714e49f46b680b9a6b83

              SHA1

              84f98b56d49f01e9b6b76a4e21accf64fd319140

              SHA256

              522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

              SHA512

              60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\JX0OQi4nZtiqWeb Data

              Filesize

              116KB

              MD5

              f70aa3fa04f0536280f872ad17973c3d

              SHA1

              50a7b889329a92de1b272d0ecf5fce87395d3123

              SHA256

              8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

              SHA512

              30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

            • C:\Users\Admin\AppData\Local\Temp\posterBox48zYJBIdVIy9P\UPG2LoPXwc7OHistory

              Filesize

              124KB

              MD5

              9618e15b04a4ddb39ed6c496575f6f95

              SHA1

              1c28f8750e5555776b3c80b187c5d15a443a7412

              SHA256

              a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

              SHA512

              f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

            • C:\Users\Admin\AppData\Local\Temp\rise131M9Asphalt.tmp

              Filesize

              13B

              MD5

              2913355ab61d3d2d99326daaee172b01

              SHA1

              133f5f491b893326e14cc599a0bd698b9ec6bb1e

              SHA256

              80617539b916161352bf154643233dbbd122ec13dc901b8afe1065168249701c

              SHA512

              9b489e56d8d4b2c7e83625f671d6ec8c181c0130c60404e56e00f3fdcb498c5377dcf6c925c1cb3d029205cc91866f6f3126244cb57b357fc8511a7716c9b56a

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

              Filesize

              1KB

              MD5

              5b751e0edd45029b7729e214ebbd11d1

              SHA1

              9844de49be7703a86bf838fc3b6e218ad2eddd25

              SHA256

              74bbbc49b27467749cfe53a8013bceb557fb3586685cda31e8fd9d463703b473

              SHA512

              fe593337b944ab4cc1da1af846e33b84fb970632c5fd6a92eec23c4fbfe1097d4ccdbe15ee23a1a8ce74a5daffd89c1961daf23419e3d305d70a34bc45e8c324

            • C:\Windows\SysWOW64\GroupPolicy\gpt.ini

              Filesize

              11B

              MD5

              ec3584f3db838942ec3669db02dc908e

              SHA1

              8dceb96874d5c6425ebb81bfee587244c89416da

              SHA256

              77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

              SHA512

              35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

            • C:\Windows\System32\GroupPolicy\GPT.INI

              Filesize

              127B

              MD5

              7cc972a3480ca0a4792dc3379a763572

              SHA1

              f72eb4124d24f06678052706c542340422307317

              SHA256

              02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

              SHA512

              ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

            • C:\Windows\System32\GroupPolicy\Machine\Registry.pol

              Filesize

              1KB

              MD5

              cdfd60e717a44c2349b553e011958b85

              SHA1

              431136102a6fb52a00e416964d4c27089155f73b

              SHA256

              0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

              SHA512

              dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

            • memory/3096-91-0x0000000002100000-0x0000000002116000-memory.dmp

              Filesize

              88KB

            • memory/4316-112-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-49-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-104-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-100-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-96-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-95-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-208-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-48-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-133-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-110-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-38-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-37-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-36-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-22-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-20-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-14-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4316-18-0x0000000000400000-0x0000000000598000-memory.dmp

              Filesize

              1.6MB

            • memory/4964-19-0x0000000000400000-0x000000000040B000-memory.dmp

              Filesize

              44KB

            • memory/4964-93-0x0000000000400000-0x000000000040B000-memory.dmp

              Filesize

              44KB