Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/04/2023, 18:19

General

  • Target

    8444c841c403fe3bf5a5a58294892c8cf3aa901b09a3076534374b9a572b76d3.exe

  • Size

    1.2MB

  • MD5

    569ee9b37d892d710996448e69bc07c9

  • SHA1

    1acebd750391d8b2648e4cb1d1f7664985b38a03

  • SHA256

    8444c841c403fe3bf5a5a58294892c8cf3aa901b09a3076534374b9a572b76d3

  • SHA512

    affdc3b4c1ff75695163fa66a146c0088440061bd9710a8c87c04f9aa83f135070639226ba28743dae5afb9ef58b6f64d77f678658dca4ed3a8f3b8d47a9b04f

  • SSDEEP

    24576:Aj3DX6L44JAoqyf2Bh1F/tSs8mL2U7wucjiw017bw1xq9poyMmem:Aj76L+oqyf2Bl/ksdr754iw017bmw

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8444c841c403fe3bf5a5a58294892c8cf3aa901b09a3076534374b9a572b76d3.exe
    "C:\Users\Admin\AppData\Local\Temp\8444c841c403fe3bf5a5a58294892c8cf3aa901b09a3076534374b9a572b76d3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\336668151.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\336668151.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3544
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4692
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4772
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:N"
                6⤵
                  PID:4756
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:R" /E
                  6⤵
                    PID:3536
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4760
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\cb7ae701b3" /P "Admin:N"
                      6⤵
                        PID:1524
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\cb7ae701b3" /P "Admin:R" /E
                        6⤵
                          PID:4012
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4772
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\445449629.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\445449629.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1800
              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:4756
              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:1132

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\445449629.exe

                Filesize

                459KB

                MD5

                cff584a54ecd03df5bce0db174a05d17

                SHA1

                26032da7c3842ed7e3477368ee679d9c6de34b45

                SHA256

                c157e1ffa088039f4668cd1abbd34e612729215b789fbfb4261ea946840f3f81

                SHA512

                cb89c642c242a6eafe7fc266c0822a0569c10c2764b2760d6628690a7490f84a596ef0eb32e457c7dc0ba53ac3badc7704a5aa23eaf0b24582f257f5e8bc1f29

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\445449629.exe

                Filesize

                459KB

                MD5

                cff584a54ecd03df5bce0db174a05d17

                SHA1

                26032da7c3842ed7e3477368ee679d9c6de34b45

                SHA256

                c157e1ffa088039f4668cd1abbd34e612729215b789fbfb4261ea946840f3f81

                SHA512

                cb89c642c242a6eafe7fc266c0822a0569c10c2764b2760d6628690a7490f84a596ef0eb32e457c7dc0ba53ac3badc7704a5aa23eaf0b24582f257f5e8bc1f29

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exe

                Filesize

                763KB

                MD5

                0e3a87f5fbde6985aa586bb53da140d8

                SHA1

                f87d70a6bf68b017be78540cbceb35d9cf3267e8

                SHA256

                d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423

                SHA512

                52ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qv264349.exe

                Filesize

                763KB

                MD5

                0e3a87f5fbde6985aa586bb53da140d8

                SHA1

                f87d70a6bf68b017be78540cbceb35d9cf3267e8

                SHA256

                d13043c44eca8a7eb2415dc218d87a5d9b561783ff92d215dfb248b38d20b423

                SHA512

                52ec3ad56b9e3edb497ad4f2fd916162fbf35020b9c8931f31dff6e374ea505d42144a4ddb8e77214d2a562f3d15ea58bf091ca612826975cbcac72db1ae251c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\336668151.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\336668151.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exe

                Filesize

                592KB

                MD5

                dbf7b7943e0bbfbfe2ff3081429310c2

                SHA1

                4633b71d0234283b80e9cd8cf3ae8a638866b8d0

                SHA256

                93394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d

                SHA512

                884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gv434705.exe

                Filesize

                592KB

                MD5

                dbf7b7943e0bbfbfe2ff3081429310c2

                SHA1

                4633b71d0234283b80e9cd8cf3ae8a638866b8d0

                SHA256

                93394041a467699908ec68b26301930ab36f0bf0164bde2a1b195f6c9b919d2d

                SHA512

                884eb3bd5c1cca47c47406ff2834129ee971b2480659450bb775b39cdf3a7ade843e2a359ab5b76bd7bd04877698c1fa58df484daa80a6433e0757d3ac4f803e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exe

                Filesize

                376KB

                MD5

                808c6015ca73ae5171c3cb969a156c6b

                SHA1

                3ab3439a5c48623a248166eed4f20e73437b2e36

                SHA256

                bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc

                SHA512

                a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137239924.exe

                Filesize

                376KB

                MD5

                808c6015ca73ae5171c3cb969a156c6b

                SHA1

                3ab3439a5c48623a248166eed4f20e73437b2e36

                SHA256

                bb8e0f54593b23da5b272eb1734b6eec66f09d07b2699162f8e77b73094346fc

                SHA512

                a1821b2168460260a28aeb0b881be02e264f4abbf8ef3800f3ac442da72667bfb3406b6941ceea92e86a50e764f0e882c3d767766ed88ac71c34809002ca6483

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exe

                Filesize

                459KB

                MD5

                28c9569fdfa17a87ada4d354430339f8

                SHA1

                d14414d275ead078c603ff60c08ce452475d3c5a

                SHA256

                3640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1

                SHA512

                354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217307972.exe

                Filesize

                459KB

                MD5

                28c9569fdfa17a87ada4d354430339f8

                SHA1

                d14414d275ead078c603ff60c08ce452475d3c5a

                SHA256

                3640ff98e63f79701d453338015bb2053e359016fb7e0d82b681b751adae04b1

                SHA512

                354bf9c17a39487f5d3125eb7aff5735f9fe7eb5a926d78f21ce5d0f7ee532da15b0b231151b772a2b6f79707e3eb21f77968a98ce59c31179ea62dac82d1610

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                Filesize

                204KB

                MD5

                1304f384653e08ae497008ff13498608

                SHA1

                d9a76ed63d74d4217c5027757cb9a7a0d0093080

                SHA256

                2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                SHA512

                4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                cfe2ef912f30ac9bc36d8686888ca0d3

                SHA1

                ddbbb63670b2f5bd903dadcff54ff8270825499b

                SHA256

                675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                SHA512

                5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                cfe2ef912f30ac9bc36d8686888ca0d3

                SHA1

                ddbbb63670b2f5bd903dadcff54ff8270825499b

                SHA256

                675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                SHA512

                5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                cfe2ef912f30ac9bc36d8686888ca0d3

                SHA1

                ddbbb63670b2f5bd903dadcff54ff8270825499b

                SHA256

                675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                SHA512

                5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

              • memory/1300-998-0x0000000008A30000-0x0000000008AA6000-memory.dmp

                Filesize

                472KB

              • memory/1300-228-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-1002-0x00000000024C0000-0x0000000002510000-memory.dmp

                Filesize

                320KB

              • memory/1300-1001-0x0000000009320000-0x000000000933E000-memory.dmp

                Filesize

                120KB

              • memory/1300-1000-0x0000000008CE0000-0x000000000920C000-memory.dmp

                Filesize

                5.2MB

              • memory/1300-999-0x0000000008B10000-0x0000000008CD2000-memory.dmp

                Filesize

                1.8MB

              • memory/1300-997-0x0000000008980000-0x0000000008A12000-memory.dmp

                Filesize

                584KB

              • memory/1300-995-0x00000000082C0000-0x0000000008326000-memory.dmp

                Filesize

                408KB

              • memory/1300-994-0x00000000026B0000-0x00000000026C0000-memory.dmp

                Filesize

                64KB

              • memory/1300-993-0x0000000008030000-0x000000000807B000-memory.dmp

                Filesize

                300KB

              • memory/1300-992-0x0000000007FB0000-0x0000000007FEE000-memory.dmp

                Filesize

                248KB

              • memory/1300-991-0x0000000007E90000-0x0000000007F9A000-memory.dmp

                Filesize

                1.0MB

              • memory/1300-990-0x0000000007E60000-0x0000000007E72000-memory.dmp

                Filesize

                72KB

              • memory/1300-989-0x0000000007810000-0x0000000007E16000-memory.dmp

                Filesize

                6.0MB

              • memory/1300-191-0x0000000002670000-0x00000000026AC000-memory.dmp

                Filesize

                240KB

              • memory/1300-192-0x0000000002970000-0x00000000029AA000-memory.dmp

                Filesize

                232KB

              • memory/1300-193-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-194-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-196-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-198-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-200-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-202-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-204-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-206-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-208-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-210-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-212-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-214-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-216-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-218-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-221-0x00000000026B0000-0x00000000026C0000-memory.dmp

                Filesize

                64KB

              • memory/1300-223-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-226-0x0000000002970000-0x00000000029A5000-memory.dmp

                Filesize

                212KB

              • memory/1300-219-0x0000000000BC0000-0x0000000000C06000-memory.dmp

                Filesize

                280KB

              • memory/1300-224-0x00000000026B0000-0x00000000026C0000-memory.dmp

                Filesize

                64KB

              • memory/1300-222-0x00000000026B0000-0x00000000026C0000-memory.dmp

                Filesize

                64KB

              • memory/1800-1816-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/1800-1815-0x0000000007F20000-0x0000000007F6B000-memory.dmp

                Filesize

                300KB

              • memory/1800-1206-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/1800-1204-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/1800-1202-0x0000000005000000-0x0000000005010000-memory.dmp

                Filesize

                64KB

              • memory/2156-181-0x0000000000400000-0x00000000008E0000-memory.dmp

                Filesize

                4.9MB

              • memory/2156-131-0x0000000004850000-0x0000000004956000-memory.dmp

                Filesize

                1.0MB

              • memory/5048-180-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-151-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/5048-164-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-178-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-176-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-174-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-172-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-162-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-160-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-158-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-156-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-154-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-153-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-170-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-182-0x0000000000400000-0x0000000000803000-memory.dmp

                Filesize

                4.0MB

              • memory/5048-183-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/5048-184-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/5048-186-0x0000000000400000-0x0000000000803000-memory.dmp

                Filesize

                4.0MB

              • memory/5048-168-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/5048-152-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/5048-150-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/5048-149-0x00000000027C0000-0x00000000027D8000-memory.dmp

                Filesize

                96KB

              • memory/5048-148-0x0000000004F10000-0x000000000540E000-memory.dmp

                Filesize

                5.0MB

              • memory/5048-147-0x0000000000CC0000-0x0000000000CDA000-memory.dmp

                Filesize

                104KB

              • memory/5048-166-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB