Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/03/2023, 02:12

General

  • Target

    8234f55745a5f5bafd006fbf96156138890d87492d29f8a76a49931aa667ec73.exe

  • Size

    1.2MB

  • MD5

    167e5b9143136a8d01782c5de939d3b9

  • SHA1

    1f19e64c89bcb698647fb4480cbe6543f249a106

  • SHA256

    8234f55745a5f5bafd006fbf96156138890d87492d29f8a76a49931aa667ec73

  • SHA512

    ecef7cfa5e56a609e57b926dd342c2d49e4bc70919658f8378301d31f43b086aa6420e1103bd0f2fc796e9f39c9dc279d769b90cd26e29598712af493a97d8e7

  • SSDEEP

    24576:yyQ0cnLedfvxclTAhdTCRf7FkeD3JVZFoqt9yg9:ZQxLWfvmlkiVFkeD3NLyg

Malware Config

Extracted

Family

redline

Botnet

rumfa

C2

193.233.20.24:4123

Attributes
  • auth_value

    749d02a6b4ef1fa2ad908e44ec2296dc

Extracted

Family

redline

Botnet

dunkan

C2

193.233.20.24:4123

Attributes
  • auth_value

    505c396c57c6287fc3fdc5f3aeab0819

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 17 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8234f55745a5f5bafd006fbf96156138890d87492d29f8a76a49931aa667ec73.exe
    "C:\Users\Admin\AppData\Local\Temp\8234f55745a5f5bafd006fbf96156138890d87492d29f8a76a49931aa667ec73.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plXR98tC60.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plXR98tC60.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plEy25rt12.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plEy25rt12.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plvc99hG98.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plvc99hG98.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIv10CZ71.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIv10CZ71.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4600
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buBe61SM06.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buBe61SM06.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4408
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSw71OO75.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSw71OO75.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4668
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 2024
                7⤵
                • Program crash
                PID:4544
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\diAs89zI11.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\diAs89zI11.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1164
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1100
              6⤵
              • Program crash
              PID:4052
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esNM00Ue06.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esNM00Ue06.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4768
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 1300
            5⤵
            • Program crash
            PID:4100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuZk5238WE84.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuZk5238WE84.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grKi88iD69.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grKi88iD69.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5012
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4668 -ip 4668
    1⤵
      PID:3724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1164 -ip 1164
      1⤵
        PID:1720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4768 -ip 4768
        1⤵
          PID:3588
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start wuauserv
          1⤵
          • Launches sc.exe
          PID:1776

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grKi88iD69.exe

          Filesize

          175KB

          MD5

          27abe90dfa3542ff84eed6b44a684e92

          SHA1

          e0dbc6905d66cb83f00a5d2233c976d3d8673695

          SHA256

          e4216225676fb52f7d550ea2a848ac6763f2627f4eafd8ba220cfe12e58d8ce7

          SHA512

          b717944aca0126bcd0172b4f520d0c3ac5251fbb790be80bebbe114824732081e36fa29a035dfebf5d9b75974e0908d2ea3afdc46c0e6c1d9b7b47a80f508fc5

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grKi88iD69.exe

          Filesize

          175KB

          MD5

          27abe90dfa3542ff84eed6b44a684e92

          SHA1

          e0dbc6905d66cb83f00a5d2233c976d3d8673695

          SHA256

          e4216225676fb52f7d550ea2a848ac6763f2627f4eafd8ba220cfe12e58d8ce7

          SHA512

          b717944aca0126bcd0172b4f520d0c3ac5251fbb790be80bebbe114824732081e36fa29a035dfebf5d9b75974e0908d2ea3afdc46c0e6c1d9b7b47a80f508fc5

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plXR98tC60.exe

          Filesize

          1.0MB

          MD5

          cb769ffcc769e0ea49fbe0f0badf7c5a

          SHA1

          993024019036ceca72d3cb17ff4d6d2a2488a083

          SHA256

          123e84aeafc008d6ba126147dc32a0b0aa562e0de91ad63f403ede67fc8c468e

          SHA512

          d712e1484fa1cbbb7747030132d0894905767e66f5e110297441406ae78c06ea2c15c67131ac113bbfe83cff5f7d1eca60864ea1397ba842dd623b889a1c1639

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plXR98tC60.exe

          Filesize

          1.0MB

          MD5

          cb769ffcc769e0ea49fbe0f0badf7c5a

          SHA1

          993024019036ceca72d3cb17ff4d6d2a2488a083

          SHA256

          123e84aeafc008d6ba126147dc32a0b0aa562e0de91ad63f403ede67fc8c468e

          SHA512

          d712e1484fa1cbbb7747030132d0894905767e66f5e110297441406ae78c06ea2c15c67131ac113bbfe83cff5f7d1eca60864ea1397ba842dd623b889a1c1639

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuZk5238WE84.exe

          Filesize

          15KB

          MD5

          8d2e0a5bec14439475596047871a7110

          SHA1

          dca2eeb5a385409db4faa8e8bca5545123bbdead

          SHA256

          bcf44192a233a45603db0d8dbfd7c08234f6dde50cf9923a24c8e86b6fe01dfa

          SHA512

          5bcde2b2cb37dc157987dcfc8bfc144d483fdf0d995587fb774222fff6bbd8cd5b6cfe37494f09d450cded5ab670c3f5bf698cc5d685656a402d6b3ccaef63f3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuZk5238WE84.exe

          Filesize

          15KB

          MD5

          8d2e0a5bec14439475596047871a7110

          SHA1

          dca2eeb5a385409db4faa8e8bca5545123bbdead

          SHA256

          bcf44192a233a45603db0d8dbfd7c08234f6dde50cf9923a24c8e86b6fe01dfa

          SHA512

          5bcde2b2cb37dc157987dcfc8bfc144d483fdf0d995587fb774222fff6bbd8cd5b6cfe37494f09d450cded5ab670c3f5bf698cc5d685656a402d6b3ccaef63f3

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plEy25rt12.exe

          Filesize

          972KB

          MD5

          3516b5d1751c40d80e2b5b04c36be694

          SHA1

          45c29093a86362e8bc45da6b04eee467fb73d8d4

          SHA256

          9c5ab46308b2f2347d6cee1fad260cdeaa76027fba614f038dad2884c6ece713

          SHA512

          33257f3faecd1e55b55290afc0fa1c78d86acc51c1595d8caf8df98a1dae2a5bd69eacea912b9d05b6a67cf6a7719001e3282b3017a81e2abe6d583d0428bcb9

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plEy25rt12.exe

          Filesize

          972KB

          MD5

          3516b5d1751c40d80e2b5b04c36be694

          SHA1

          45c29093a86362e8bc45da6b04eee467fb73d8d4

          SHA256

          9c5ab46308b2f2347d6cee1fad260cdeaa76027fba614f038dad2884c6ece713

          SHA512

          33257f3faecd1e55b55290afc0fa1c78d86acc51c1595d8caf8df98a1dae2a5bd69eacea912b9d05b6a67cf6a7719001e3282b3017a81e2abe6d583d0428bcb9

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esNM00Ue06.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esNM00Ue06.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plvc99hG98.exe

          Filesize

          691KB

          MD5

          68a0d7889af6665f5f4270f4d38b1567

          SHA1

          366d394f16075c9799b9cfdc828bc33d8f03b086

          SHA256

          1aa5887111d4dcd865d654dcb4aac388b0b6d8bfec3a203a4b26e3a110891297

          SHA512

          cd1c0e738105412f37fafd0cba43ed3473101002c11ce6eb8538cabcbd33450d17d4fd25636211c0e632dfe0be9cc96d87ae2af245f1cb2582866a75d733eb06

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plvc99hG98.exe

          Filesize

          691KB

          MD5

          68a0d7889af6665f5f4270f4d38b1567

          SHA1

          366d394f16075c9799b9cfdc828bc33d8f03b086

          SHA256

          1aa5887111d4dcd865d654dcb4aac388b0b6d8bfec3a203a4b26e3a110891297

          SHA512

          cd1c0e738105412f37fafd0cba43ed3473101002c11ce6eb8538cabcbd33450d17d4fd25636211c0e632dfe0be9cc96d87ae2af245f1cb2582866a75d733eb06

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\diAs89zI11.exe

          Filesize

          320KB

          MD5

          887d5f3f25f82ef4ec073a39f3050594

          SHA1

          0f0d0e2f3b7d8b61dffab0d347d81740dfe956d8

          SHA256

          f253180eaa3ade6c077fe6af72f5146029ff4d27a93debfe7f66507aa8739c65

          SHA512

          bf6ab835d6f35063d6d499b18a60581b97c894e9a524da4b60008765a9853b29f0594c6fdca718b64cd5799a7b0fea1c115d21662bf90ff4dd67083d289cc81d

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\diAs89zI11.exe

          Filesize

          320KB

          MD5

          887d5f3f25f82ef4ec073a39f3050594

          SHA1

          0f0d0e2f3b7d8b61dffab0d347d81740dfe956d8

          SHA256

          f253180eaa3ade6c077fe6af72f5146029ff4d27a93debfe7f66507aa8739c65

          SHA512

          bf6ab835d6f35063d6d499b18a60581b97c894e9a524da4b60008765a9853b29f0594c6fdca718b64cd5799a7b0fea1c115d21662bf90ff4dd67083d289cc81d

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIv10CZ71.exe

          Filesize

          403KB

          MD5

          109e75ca760e77aa9f1bc5c0d8d61bc3

          SHA1

          ac6459bbe08526b5623dc9ee74d6e42ecd609614

          SHA256

          be52e064262718bb42042ea9c76813130bed6b68a4111e600b26fd3de68a4c36

          SHA512

          673b65539d4910a92dad41d970a438a355c10898dbf554f6beb39001ddbfac14c8ee7a139fb2c5418c362e52538bbed05107dbf9066d5c46634d51fe5153135a

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plIv10CZ71.exe

          Filesize

          403KB

          MD5

          109e75ca760e77aa9f1bc5c0d8d61bc3

          SHA1

          ac6459bbe08526b5623dc9ee74d6e42ecd609614

          SHA256

          be52e064262718bb42042ea9c76813130bed6b68a4111e600b26fd3de68a4c36

          SHA512

          673b65539d4910a92dad41d970a438a355c10898dbf554f6beb39001ddbfac14c8ee7a139fb2c5418c362e52538bbed05107dbf9066d5c46634d51fe5153135a

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buBe61SM06.exe

          Filesize

          15KB

          MD5

          66e3a52144bbd3a9c85a14de47decfbe

          SHA1

          213bb80474e9a7be5a28a17f8955c95819a02c0d

          SHA256

          30e7d233e965799daf9da96c8069acbfd98cb2845329a2247bb90d32e0010c1a

          SHA512

          2ea1b1bd4124dc7eb884ef4868c223c189dca886d5fbe9b14ae89802718743c97cab8f98258f4aaf3b8f5acf40b09c45c4963a736167bbfda8aaa5c69411cfe3

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buBe61SM06.exe

          Filesize

          15KB

          MD5

          66e3a52144bbd3a9c85a14de47decfbe

          SHA1

          213bb80474e9a7be5a28a17f8955c95819a02c0d

          SHA256

          30e7d233e965799daf9da96c8069acbfd98cb2845329a2247bb90d32e0010c1a

          SHA512

          2ea1b1bd4124dc7eb884ef4868c223c189dca886d5fbe9b14ae89802718743c97cab8f98258f4aaf3b8f5acf40b09c45c4963a736167bbfda8aaa5c69411cfe3

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buBe61SM06.exe

          Filesize

          15KB

          MD5

          66e3a52144bbd3a9c85a14de47decfbe

          SHA1

          213bb80474e9a7be5a28a17f8955c95819a02c0d

          SHA256

          30e7d233e965799daf9da96c8069acbfd98cb2845329a2247bb90d32e0010c1a

          SHA512

          2ea1b1bd4124dc7eb884ef4868c223c189dca886d5fbe9b14ae89802718743c97cab8f98258f4aaf3b8f5acf40b09c45c4963a736167bbfda8aaa5c69411cfe3

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSw71OO75.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSw71OO75.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caSw71OO75.exe

          Filesize

          378KB

          MD5

          0699a3dd8a0bfbef309a3c474b22b56d

          SHA1

          8f8218184e8f28b14b8a3d5f828e28b9d8cd40a8

          SHA256

          0fe939fc94b4462887001499c9acd988653938b21d30b6eadfa023629edad178

          SHA512

          6dff28c979b7efeb3b8fccb98102b1adeaa5e31aebf01713c76f8055c7ac520bc8b37857f442e1d0de5d4b77295325b485cf8d53d72fd4d22091211de4ef26cd

        • memory/1164-1142-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/1164-1141-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/1164-1140-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/1164-1137-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/1164-1136-0x0000000004EF0000-0x0000000004F00000-memory.dmp

          Filesize

          64KB

        • memory/1164-1135-0x0000000002D30000-0x0000000002D5D000-memory.dmp

          Filesize

          180KB

        • memory/4408-168-0x00000000003F0000-0x00000000003FA000-memory.dmp

          Filesize

          40KB

        • memory/4668-222-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-1091-0x0000000008400000-0x0000000008492000-memory.dmp

          Filesize

          584KB

        • memory/4668-196-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-198-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-200-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-202-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-204-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-206-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-208-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-210-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-212-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-214-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-216-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-218-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-220-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-192-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-224-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-226-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-228-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-230-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-232-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-234-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-236-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-238-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-240-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-242-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-1085-0x0000000007A50000-0x0000000008068000-memory.dmp

          Filesize

          6.1MB

        • memory/4668-1086-0x0000000008070000-0x000000000817A000-memory.dmp

          Filesize

          1.0MB

        • memory/4668-1087-0x0000000007400000-0x0000000007412000-memory.dmp

          Filesize

          72KB

        • memory/4668-1088-0x0000000007420000-0x000000000745C000-memory.dmp

          Filesize

          240KB

        • memory/4668-1089-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-194-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-1092-0x00000000084A0000-0x0000000008506000-memory.dmp

          Filesize

          408KB

        • memory/4668-1093-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1094-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1095-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1096-0x000000000A070000-0x000000000A232000-memory.dmp

          Filesize

          1.8MB

        • memory/4668-1097-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1098-0x000000000A240000-0x000000000A76C000-memory.dmp

          Filesize

          5.2MB

        • memory/4668-190-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-188-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-186-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-184-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-182-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-180-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-179-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

          Filesize

          248KB

        • memory/4668-178-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-1099-0x000000000AA60000-0x000000000AAD6000-memory.dmp

          Filesize

          472KB

        • memory/4668-1100-0x000000000AAF0000-0x000000000AB40000-memory.dmp

          Filesize

          320KB

        • memory/4668-174-0x00000000074A0000-0x0000000007A44000-memory.dmp

          Filesize

          5.6MB

        • memory/4668-175-0x0000000002D30000-0x0000000002D7B000-memory.dmp

          Filesize

          300KB

        • memory/4668-177-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4668-176-0x0000000007490000-0x00000000074A0000-memory.dmp

          Filesize

          64KB

        • memory/4768-2059-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-2060-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-2061-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-2057-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-1395-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-1398-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4768-1394-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/5012-2071-0x0000000000250000-0x0000000000282000-memory.dmp

          Filesize

          200KB

        • memory/5012-2072-0x0000000004B70000-0x0000000004B80000-memory.dmp

          Filesize

          64KB