Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2022, 22:08

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.14262.exe

  • Size

    7.5MB

  • MD5

    3ce5473ec9e1e9dea07277cf8cb41ac5

  • SHA1

    f7c8abc2e8cee7c6bd9fb9302e8e9da3b0276c66

  • SHA256

    a652d114cf9604fc80c93c16e12323d2377793dc4a8b71a136c35f77c600c840

  • SHA512

    48f20c5c23484e5e3eff9c34dc4730ec838661b2e77db2c154c472edf795cb6900b72472a6ed200e9197433a72921a219ceaa776f4a89337a2ab066365c3a7b2

  • SSDEEP

    196608:0636P6Fa1wwRtGhgm6Nk90In4oso6Lg6xaxQa0J5MhlewJ:C3qsl

Malware Config

Extracted

Family

redline

Botnet

sep16as3

C2

185.215.113.122:15386

Attributes
  • auth_value

    40bb2fe8692bc4f8451694273411f3ae

Extracted

Family

redline

Botnet

Lyla3.18.9

C2

185.215.113.216:21921

Attributes
  • auth_value

    af42ec3c2992d951ef41b056b1137d3b

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Detectes Phoenix Miner Payload 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14262.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14262.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14262.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.14262.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\explorer\explorer.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Users\Admin\AppData\Roaming\explorer\explorer.exe
          C:\Users\Admin\AppData\Roaming\explorer\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Users\Admin\AppData\Roaming\explorer\svchost.exe
            -pool us-etc.2miners.com:1010 -wal 0xB7b2553E9b6DC10186ddD09AB9fbE71C68da0851.ferms -epsw x -mode 1 -log 0 -mport 0 -etha 0 -ftime 55 -retrydelay 1 -coin etc
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:1060
      • C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe
        "C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:988
        • C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe
          "C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4560
      • C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe
        "C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe
          "C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2272
      • C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe
        "C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe
          "C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:2068
      • C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe
        "C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" 9S4gBYT.s~v /s
          4⤵
          • Loads dropped DLL
          PID:4300
      • C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe
        https://iplogger.org/1DLDa7
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" 9S4gBYT.s~v /s
          4⤵
          • Loads dropped DLL
          PID:4396

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\40LAJ02DH0739CD.exe.log

    Filesize

    42B

    MD5

    84cfdb4b995b1dbf543b26b86c863adc

    SHA1

    d2f47764908bf30036cf8248b9ff5541e2711fa2

    SHA256

    d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

    SHA512

    485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\96H7AECHD4HFCD5.exe.log

    Filesize

    42B

    MD5

    84cfdb4b995b1dbf543b26b86c863adc

    SHA1

    d2f47764908bf30036cf8248b9ff5541e2711fa2

    SHA256

    d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

    SHA512

    485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CALHDI54AJCMDB6.exe.log

    Filesize

    42B

    MD5

    84cfdb4b995b1dbf543b26b86c863adc

    SHA1

    d2f47764908bf30036cf8248b9ff5541e2711fa2

    SHA256

    d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

    SHA512

    485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

  • C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe

    Filesize

    3.3MB

    MD5

    c74d1a6f1e10e99562e549e58c586902

    SHA1

    a7828c01f48ce26a5e48d460ca4cf710fb9c2151

    SHA256

    8db366241729906167bb34a88c2c8c1e7e7f4d3335832887f92b0d65ee394b26

    SHA512

    d0b88ab130edb1894de59406c1cba0255a1590c64f26ea3db03b3c4b75af9dafae7686523363b8ee43656a8f8358e2e33d540299b8628aa7cf2a8b7741aceded

  • C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe

    Filesize

    3.3MB

    MD5

    c74d1a6f1e10e99562e549e58c586902

    SHA1

    a7828c01f48ce26a5e48d460ca4cf710fb9c2151

    SHA256

    8db366241729906167bb34a88c2c8c1e7e7f4d3335832887f92b0d65ee394b26

    SHA512

    d0b88ab130edb1894de59406c1cba0255a1590c64f26ea3db03b3c4b75af9dafae7686523363b8ee43656a8f8358e2e33d540299b8628aa7cf2a8b7741aceded

  • C:\Users\Admin\AppData\Local\Temp\40LAJ02DH0739CD.exe

    Filesize

    3.3MB

    MD5

    c74d1a6f1e10e99562e549e58c586902

    SHA1

    a7828c01f48ce26a5e48d460ca4cf710fb9c2151

    SHA256

    8db366241729906167bb34a88c2c8c1e7e7f4d3335832887f92b0d65ee394b26

    SHA512

    d0b88ab130edb1894de59406c1cba0255a1590c64f26ea3db03b3c4b75af9dafae7686523363b8ee43656a8f8358e2e33d540299b8628aa7cf2a8b7741aceded

  • C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe

    Filesize

    1.3MB

    MD5

    cc3b2b385f04bbc1753658d32f454376

    SHA1

    31988270bc486e6986a2566920de576be38cce14

    SHA256

    47e463708171305ca8bc9b655bb9a8d4d8322099724eed4d72a6561c1f652b2b

    SHA512

    837f80492943114910c5e4694eaa569a4286cceff8af32b395ce83de6d76fbc2ebcf77c392cd63d9a9551668b3835fe8ab73b2c7ecdeb26869718891c1ce800d

  • C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe

    Filesize

    1.3MB

    MD5

    cc3b2b385f04bbc1753658d32f454376

    SHA1

    31988270bc486e6986a2566920de576be38cce14

    SHA256

    47e463708171305ca8bc9b655bb9a8d4d8322099724eed4d72a6561c1f652b2b

    SHA512

    837f80492943114910c5e4694eaa569a4286cceff8af32b395ce83de6d76fbc2ebcf77c392cd63d9a9551668b3835fe8ab73b2c7ecdeb26869718891c1ce800d

  • C:\Users\Admin\AppData\Local\Temp\6LJ2HLDFFG66JI1.exe

    Filesize

    1.3MB

    MD5

    cc3b2b385f04bbc1753658d32f454376

    SHA1

    31988270bc486e6986a2566920de576be38cce14

    SHA256

    47e463708171305ca8bc9b655bb9a8d4d8322099724eed4d72a6561c1f652b2b

    SHA512

    837f80492943114910c5e4694eaa569a4286cceff8af32b395ce83de6d76fbc2ebcf77c392cd63d9a9551668b3835fe8ab73b2c7ecdeb26869718891c1ce800d

  • C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe

    Filesize

    3.3MB

    MD5

    96e790703df95140eede4d3b78805e32

    SHA1

    c925c385e9da32c8aebd20e7a2ef91ed34dd8ddc

    SHA256

    21204e5c5c64b57264844c67b9571af129e00734c437cf05f9c17dae4a4324e4

    SHA512

    5c2b27a235b5f1bd98d704ff01379bc617aa91101b904898ea828988f0d84e47fdced8f93ae0957bf258265d381cb0e5257b5522e3743e8132ee7a0f4cfbcc42

  • C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe

    Filesize

    3.3MB

    MD5

    96e790703df95140eede4d3b78805e32

    SHA1

    c925c385e9da32c8aebd20e7a2ef91ed34dd8ddc

    SHA256

    21204e5c5c64b57264844c67b9571af129e00734c437cf05f9c17dae4a4324e4

    SHA512

    5c2b27a235b5f1bd98d704ff01379bc617aa91101b904898ea828988f0d84e47fdced8f93ae0957bf258265d381cb0e5257b5522e3743e8132ee7a0f4cfbcc42

  • C:\Users\Admin\AppData\Local\Temp\96H7AECHD4HFCD5.exe

    Filesize

    3.3MB

    MD5

    96e790703df95140eede4d3b78805e32

    SHA1

    c925c385e9da32c8aebd20e7a2ef91ed34dd8ddc

    SHA256

    21204e5c5c64b57264844c67b9571af129e00734c437cf05f9c17dae4a4324e4

    SHA512

    5c2b27a235b5f1bd98d704ff01379bc617aa91101b904898ea828988f0d84e47fdced8f93ae0957bf258265d381cb0e5257b5522e3743e8132ee7a0f4cfbcc42

  • C:\Users\Admin\AppData\Local\Temp\9S4gBYT.s~v

    Filesize

    1.3MB

    MD5

    172a16ffe5a42fc9676f8a1032ab72b5

    SHA1

    de38942b318eaedcb9f1d74fef253a9becd38030

    SHA256

    6532bf677d403f46c0ca1d6a529d3d5d67fe54449b164934519a3bd55ee25da3

    SHA512

    c81ee25c9dcf292c00384720dfd70d01b39f59486b0eaa47640faa28237a5eea5a5557a4ce8417371bba602946a178b29bc996465aa23325133eb27634738904

  • C:\Users\Admin\AppData\Local\Temp\9S4gBYT.s~v

    Filesize

    1.3MB

    MD5

    172a16ffe5a42fc9676f8a1032ab72b5

    SHA1

    de38942b318eaedcb9f1d74fef253a9becd38030

    SHA256

    6532bf677d403f46c0ca1d6a529d3d5d67fe54449b164934519a3bd55ee25da3

    SHA512

    c81ee25c9dcf292c00384720dfd70d01b39f59486b0eaa47640faa28237a5eea5a5557a4ce8417371bba602946a178b29bc996465aa23325133eb27634738904

  • C:\Users\Admin\AppData\Local\Temp\9S4gBYT.s~v

    Filesize

    1.3MB

    MD5

    172a16ffe5a42fc9676f8a1032ab72b5

    SHA1

    de38942b318eaedcb9f1d74fef253a9becd38030

    SHA256

    6532bf677d403f46c0ca1d6a529d3d5d67fe54449b164934519a3bd55ee25da3

    SHA512

    c81ee25c9dcf292c00384720dfd70d01b39f59486b0eaa47640faa28237a5eea5a5557a4ce8417371bba602946a178b29bc996465aa23325133eb27634738904

  • C:\Users\Admin\AppData\Local\Temp\9S4gBYT.s~v

    Filesize

    1.3MB

    MD5

    172a16ffe5a42fc9676f8a1032ab72b5

    SHA1

    de38942b318eaedcb9f1d74fef253a9becd38030

    SHA256

    6532bf677d403f46c0ca1d6a529d3d5d67fe54449b164934519a3bd55ee25da3

    SHA512

    c81ee25c9dcf292c00384720dfd70d01b39f59486b0eaa47640faa28237a5eea5a5557a4ce8417371bba602946a178b29bc996465aa23325133eb27634738904

  • C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe

    Filesize

    3.4MB

    MD5

    bbb86312dc1cf2d5fc3d6312125c4acb

    SHA1

    0501c369c8e175b02ea428da6b0d856cd4fe77bf

    SHA256

    ad0cbf12518a7a8f2b581f404b2f43d653a995c42f982ff0811f713a619177c2

    SHA512

    c6d97bd21a76c1255071396c74f0e28074e686b6839d561d35dad69a5aa2ce2017577ee927d46edd0512dc4735f367c858bbeb05ed54103a79e58b6985609ecc

  • C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe

    Filesize

    3.4MB

    MD5

    bbb86312dc1cf2d5fc3d6312125c4acb

    SHA1

    0501c369c8e175b02ea428da6b0d856cd4fe77bf

    SHA256

    ad0cbf12518a7a8f2b581f404b2f43d653a995c42f982ff0811f713a619177c2

    SHA512

    c6d97bd21a76c1255071396c74f0e28074e686b6839d561d35dad69a5aa2ce2017577ee927d46edd0512dc4735f367c858bbeb05ed54103a79e58b6985609ecc

  • C:\Users\Admin\AppData\Local\Temp\CALHDI54AJCMDB6.exe

    Filesize

    3.4MB

    MD5

    bbb86312dc1cf2d5fc3d6312125c4acb

    SHA1

    0501c369c8e175b02ea428da6b0d856cd4fe77bf

    SHA256

    ad0cbf12518a7a8f2b581f404b2f43d653a995c42f982ff0811f713a619177c2

    SHA512

    c6d97bd21a76c1255071396c74f0e28074e686b6839d561d35dad69a5aa2ce2017577ee927d46edd0512dc4735f367c858bbeb05ed54103a79e58b6985609ecc

  • C:\Users\Admin\AppData\Roaming\explorer\explorer.exe

    Filesize

    17KB

    MD5

    d9e2fc3a247db17e03d220092e4756ff

    SHA1

    c409057b469fcefe230ee170a5b2bc33d3bb28ec

    SHA256

    ee36cfc26f2b4205cf7de07cd257af6d1d992919e58047ec7a4fdd6cf70140dd

    SHA512

    b973884a248e162dd7f83d981d6c7774eb21bce3983012474799b9b96f18846d60a2995cc82d4f7c362d4495626d36f6f39ff76d22c806b755c7cb2c7bfcb4af

  • C:\Users\Admin\AppData\Roaming\explorer\explorer.exe

    Filesize

    17KB

    MD5

    d9e2fc3a247db17e03d220092e4756ff

    SHA1

    c409057b469fcefe230ee170a5b2bc33d3bb28ec

    SHA256

    ee36cfc26f2b4205cf7de07cd257af6d1d992919e58047ec7a4fdd6cf70140dd

    SHA512

    b973884a248e162dd7f83d981d6c7774eb21bce3983012474799b9b96f18846d60a2995cc82d4f7c362d4495626d36f6f39ff76d22c806b755c7cb2c7bfcb4af

  • C:\Users\Admin\AppData\Roaming\explorer\svchost.exe

    Filesize

    9.7MB

    MD5

    afe1d7271ec50bf3332edf6ba5f8ba01

    SHA1

    b07633f2274ffc7d8f02fdca4da94aec88534b0c

    SHA256

    d645e1c6408572a8e4e7e20e099a8301a6b811131a00bc8b28ca97a4ec951222

    SHA512

    9e1248618a54956f0b9d455e33eb63fbeeb5c3b16ee168d5f5c002eac9863568f844ed0b47ec1eb9bb452e6e63e7784eebb76693e90e5789c94f0193a9e0737a

  • C:\Users\Admin\AppData\Roaming\explorer\svchost.exe

    Filesize

    9.7MB

    MD5

    afe1d7271ec50bf3332edf6ba5f8ba01

    SHA1

    b07633f2274ffc7d8f02fdca4da94aec88534b0c

    SHA256

    d645e1c6408572a8e4e7e20e099a8301a6b811131a00bc8b28ca97a4ec951222

    SHA512

    9e1248618a54956f0b9d455e33eb63fbeeb5c3b16ee168d5f5c002eac9863568f844ed0b47ec1eb9bb452e6e63e7784eebb76693e90e5789c94f0193a9e0737a

  • memory/988-157-0x00000000001F0000-0x0000000000556000-memory.dmp

    Filesize

    3.4MB

  • memory/1060-153-0x00007FF685780000-0x00007FF686CD7000-memory.dmp

    Filesize

    21.3MB

  • memory/1060-149-0x00007FF685780000-0x00007FF686CD7000-memory.dmp

    Filesize

    21.3MB

  • memory/1124-169-0x0000000000370000-0x00000000006CA000-memory.dmp

    Filesize

    3.4MB

  • memory/2068-183-0x0000000000880000-0x000000000088A000-memory.dmp

    Filesize

    40KB

  • memory/2068-191-0x0000000006140000-0x000000000614A000-memory.dmp

    Filesize

    40KB

  • memory/2272-176-0x0000000005660000-0x00000000056C6000-memory.dmp

    Filesize

    408KB

  • memory/2272-188-0x0000000007320000-0x000000000784C000-memory.dmp

    Filesize

    5.2MB

  • memory/2272-175-0x0000000005D20000-0x0000000005DB2000-memory.dmp

    Filesize

    584KB

  • memory/2272-174-0x00000000062D0000-0x0000000006874000-memory.dmp

    Filesize

    5.6MB

  • memory/2272-202-0x0000000006F80000-0x0000000006FD0000-memory.dmp

    Filesize

    320KB

  • memory/2272-181-0x0000000006880000-0x00000000068F6000-memory.dmp

    Filesize

    472KB

  • memory/2272-171-0x0000000000D10000-0x0000000000D2C000-memory.dmp

    Filesize

    112KB

  • memory/2272-186-0x0000000006280000-0x000000000629E000-memory.dmp

    Filesize

    120KB

  • memory/2272-187-0x0000000006C20000-0x0000000006DE2000-memory.dmp

    Filesize

    1.8MB

  • memory/2564-132-0x0000000000080000-0x00000000007FB000-memory.dmp

    Filesize

    7.5MB

  • memory/4300-203-0x0000000003090000-0x00000000031BC000-memory.dmp

    Filesize

    1.2MB

  • memory/4300-207-0x00000000033A0000-0x0000000003467000-memory.dmp

    Filesize

    796KB

  • memory/4300-212-0x00000000032B0000-0x0000000003398000-memory.dmp

    Filesize

    928KB

  • memory/4300-209-0x0000000002E90000-0x0000000002F41000-memory.dmp

    Filesize

    708KB

  • memory/4300-208-0x0000000002E90000-0x0000000002F41000-memory.dmp

    Filesize

    708KB

  • memory/4300-204-0x00000000032B0000-0x0000000003398000-memory.dmp

    Filesize

    928KB

  • memory/4396-206-0x0000000002710000-0x00000000027F8000-memory.dmp

    Filesize

    928KB

  • memory/4396-216-0x0000000002710000-0x00000000027F8000-memory.dmp

    Filesize

    928KB

  • memory/4396-214-0x00000000028D0000-0x0000000002981000-memory.dmp

    Filesize

    708KB

  • memory/4396-201-0x0000000002260000-0x00000000023BA000-memory.dmp

    Filesize

    1.4MB

  • memory/4396-211-0x0000000002800000-0x00000000028C7000-memory.dmp

    Filesize

    796KB

  • memory/4396-205-0x00000000024F0000-0x000000000261C000-memory.dmp

    Filesize

    1.2MB

  • memory/4560-163-0x00000000053A0000-0x00000000054AA000-memory.dmp

    Filesize

    1.0MB

  • memory/4560-164-0x00000000052D0000-0x00000000052E2000-memory.dmp

    Filesize

    72KB

  • memory/4560-165-0x0000000005330000-0x000000000536C000-memory.dmp

    Filesize

    240KB

  • memory/4560-159-0x0000000000D00000-0x0000000000D28000-memory.dmp

    Filesize

    160KB

  • memory/4560-162-0x0000000005840000-0x0000000005E58000-memory.dmp

    Filesize

    6.1MB

  • memory/4940-134-0x0000000001300000-0x0000000001336000-memory.dmp

    Filesize

    216KB

  • memory/4940-138-0x0000000001300000-0x0000000001336000-memory.dmp

    Filesize

    216KB

  • memory/4940-141-0x0000000001300000-0x0000000001336000-memory.dmp

    Filesize

    216KB

  • memory/5056-180-0x00000000008F0000-0x0000000000C38000-memory.dmp

    Filesize

    3.3MB