Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 19:18

General

  • Target

    f3aa95e5b06046c87697b0580cb6982c9332006b0e688c970e101dc8c24a46c0.exe

  • Size

    1.1MB

  • MD5

    2930f9373d5fc1d33ea2a76fb6902e18

  • SHA1

    88846ca798d1a575d36e6a571d58a7bf76c6f23f

  • SHA256

    f3aa95e5b06046c87697b0580cb6982c9332006b0e688c970e101dc8c24a46c0

  • SHA512

    61d767d0d31b0572b8dabd2421d6e3f54b86b7bc8ba0e23fb44ce9590c130467674ae6a64bdaf1ae8a95a3eb1478b4b90a8c82ee0ae29401a25ae50241704c10

  • SSDEEP

    24576:XyruQOLDrZ6dj5XZa3cgiMS64Q6G+moZj5VmeLn/:irBMX0jVQMgITt/j5M

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3aa95e5b06046c87697b0580cb6982c9332006b0e688c970e101dc8c24a46c0.exe
    "C:\Users\Admin\AppData\Local\Temp\f3aa95e5b06046c87697b0580cb6982c9332006b0e688c970e101dc8c24a46c0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FY860258.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FY860258.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gj430740.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gj430740.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bG898020.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bG898020.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\116192913.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\116192913.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2528
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216363710.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216363710.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4360
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1080
              6⤵
              • Program crash
              PID:4840
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325384813.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325384813.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3236
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3744
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:940
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4612
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:3620
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  7⤵
                    PID:3660
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:R" /E
                    7⤵
                      PID:1772
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\cb7ae701b3" /P "Admin:N"
                      7⤵
                        PID:2056
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        7⤵
                          PID:4596
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:R" /E
                          7⤵
                            PID:1184
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:1304
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422343796.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422343796.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4936
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4360 -ip 4360
                1⤵
                  PID:2348
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5112
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4208

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FY860258.exe

                  Filesize

                  931KB

                  MD5

                  3a97a98bb2f6ed810fbb03c07958c2e5

                  SHA1

                  58f213c96a1b072daa95cea9164185361d6fd4f0

                  SHA256

                  e7c695472319a73a36b84281d4a1e49531089cccb5ee92a07e4d4731bb929747

                  SHA512

                  b5901caf2e76cef6586d2c2bb6ff4826ca75199432c9dde5444865fe10f26434dbc31773f75f72ed541ce74281939d6d5909319c9e255a5837f515fbbd95a25e

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FY860258.exe

                  Filesize

                  931KB

                  MD5

                  3a97a98bb2f6ed810fbb03c07958c2e5

                  SHA1

                  58f213c96a1b072daa95cea9164185361d6fd4f0

                  SHA256

                  e7c695472319a73a36b84281d4a1e49531089cccb5ee92a07e4d4731bb929747

                  SHA512

                  b5901caf2e76cef6586d2c2bb6ff4826ca75199432c9dde5444865fe10f26434dbc31773f75f72ed541ce74281939d6d5909319c9e255a5837f515fbbd95a25e

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422343796.exe

                  Filesize

                  348KB

                  MD5

                  4e14c0e1cc85c38fc1e438b1305c77a0

                  SHA1

                  e6ee10c78589a53af8aa3a1b747d7d6dcd5e3eb4

                  SHA256

                  cbf4f962c4eafb5eae197b496938eff1e63de50dca8992826a4b774ef966189b

                  SHA512

                  02d092ae1a1ddd1e615e5e307d1d1b6814cdcea6423c13f26229be7c75d4ddbfec608579f1d7d2ef101fcb71dfcbae87af400de0b7da03d0320ff5376895eb81

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\422343796.exe

                  Filesize

                  348KB

                  MD5

                  4e14c0e1cc85c38fc1e438b1305c77a0

                  SHA1

                  e6ee10c78589a53af8aa3a1b747d7d6dcd5e3eb4

                  SHA256

                  cbf4f962c4eafb5eae197b496938eff1e63de50dca8992826a4b774ef966189b

                  SHA512

                  02d092ae1a1ddd1e615e5e307d1d1b6814cdcea6423c13f26229be7c75d4ddbfec608579f1d7d2ef101fcb71dfcbae87af400de0b7da03d0320ff5376895eb81

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gj430740.exe

                  Filesize

                  577KB

                  MD5

                  247d0df752f7848b7ced34466f5194eb

                  SHA1

                  4824e1258297afc042804ef97d9ba5926359c60b

                  SHA256

                  29cb9fbdf34383f94fc26ecbb86a831ffc2a7ae0239fd436f0e5b91b9e1f0d79

                  SHA512

                  173a2b8c999f2b5b75f4d079cdd193dc72803edf584039c19dd33ba1c56ef49cee19c26891bc66d18cbbda8b1cb4585d35047b516669d52fc7fe973d91c4c858

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gj430740.exe

                  Filesize

                  577KB

                  MD5

                  247d0df752f7848b7ced34466f5194eb

                  SHA1

                  4824e1258297afc042804ef97d9ba5926359c60b

                  SHA256

                  29cb9fbdf34383f94fc26ecbb86a831ffc2a7ae0239fd436f0e5b91b9e1f0d79

                  SHA512

                  173a2b8c999f2b5b75f4d079cdd193dc72803edf584039c19dd33ba1c56ef49cee19c26891bc66d18cbbda8b1cb4585d35047b516669d52fc7fe973d91c4c858

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325384813.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\325384813.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bG898020.exe

                  Filesize

                  406KB

                  MD5

                  22389d3b50c8dd2b723dbaa1e5baf218

                  SHA1

                  80af7ed63c02b0b2fdcfaa303ecd85ebdd355ff1

                  SHA256

                  531b024ae5eed110364af49c44549d7476ca5cc034ca61efcdce8bce60f57f6d

                  SHA512

                  4826f8645b5bc6f650a7c600d6365d252bc720af02529495f3df2d6456706d86bec2defc335727798f49f6ef6e087196ee9d7f5d2f348a5822149ce0a73cb20f

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bG898020.exe

                  Filesize

                  406KB

                  MD5

                  22389d3b50c8dd2b723dbaa1e5baf218

                  SHA1

                  80af7ed63c02b0b2fdcfaa303ecd85ebdd355ff1

                  SHA256

                  531b024ae5eed110364af49c44549d7476ca5cc034ca61efcdce8bce60f57f6d

                  SHA512

                  4826f8645b5bc6f650a7c600d6365d252bc720af02529495f3df2d6456706d86bec2defc335727798f49f6ef6e087196ee9d7f5d2f348a5822149ce0a73cb20f

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\116192913.exe

                  Filesize

                  175KB

                  MD5

                  3d10b67208452d7a91d7bd7066067676

                  SHA1

                  e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

                  SHA256

                  5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

                  SHA512

                  b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\116192913.exe

                  Filesize

                  175KB

                  MD5

                  3d10b67208452d7a91d7bd7066067676

                  SHA1

                  e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

                  SHA256

                  5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

                  SHA512

                  b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216363710.exe

                  Filesize

                  264KB

                  MD5

                  1e6c9e34c83c4e39f0ace6ce8eef5c15

                  SHA1

                  31beb660bc9ea971ec707f811613255261cc2c7a

                  SHA256

                  838d6e95269494fb1f749cd4a1bf2f1a6fd941795026fdb5d782dfe46796120d

                  SHA512

                  18c69a07324af6e13a4dd11f409c2f82272c37adb037e0c0d8c5d7d3c3bc06e4590a05c25658682bcdf6d9eaf56c6c701366acb92041dbf031092eebedbd6cfe

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\216363710.exe

                  Filesize

                  264KB

                  MD5

                  1e6c9e34c83c4e39f0ace6ce8eef5c15

                  SHA1

                  31beb660bc9ea971ec707f811613255261cc2c7a

                  SHA256

                  838d6e95269494fb1f749cd4a1bf2f1a6fd941795026fdb5d782dfe46796120d

                  SHA512

                  18c69a07324af6e13a4dd11f409c2f82272c37adb037e0c0d8c5d7d3c3bc06e4590a05c25658682bcdf6d9eaf56c6c701366acb92041dbf031092eebedbd6cfe

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  cfe2ef912f30ac9bc36d8686888ca0d3

                  SHA1

                  ddbbb63670b2f5bd903dadcff54ff8270825499b

                  SHA256

                  675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                  SHA512

                  5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  cfe2ef912f30ac9bc36d8686888ca0d3

                  SHA1

                  ddbbb63670b2f5bd903dadcff54ff8270825499b

                  SHA256

                  675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                  SHA512

                  5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  cfe2ef912f30ac9bc36d8686888ca0d3

                  SHA1

                  ddbbb63670b2f5bd903dadcff54ff8270825499b

                  SHA256

                  675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d

                  SHA512

                  5e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/2528-176-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-162-0x0000000004A40000-0x0000000004FE4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/2528-186-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-184-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-182-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-190-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-180-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-163-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-178-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-188-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-164-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-174-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-172-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-170-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-161-0x0000000004A30000-0x0000000004A40000-memory.dmp

                  Filesize

                  64KB

                • memory/2528-168-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/2528-166-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-226-0x00000000072C0000-0x00000000072D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-232-0x0000000000400000-0x0000000002B9D000-memory.dmp

                  Filesize

                  39.6MB

                • memory/4360-224-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

                  Filesize

                  180KB

                • memory/4360-225-0x00000000072C0000-0x00000000072D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-227-0x00000000072C0000-0x00000000072D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-228-0x0000000000400000-0x0000000002B9D000-memory.dmp

                  Filesize

                  39.6MB

                • memory/4360-230-0x00000000072C0000-0x00000000072D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-231-0x00000000072C0000-0x00000000072D0000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1049-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1054-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1046-0x000000000A2D0000-0x000000000A8E8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4936-1047-0x0000000009CF0000-0x0000000009D02000-memory.dmp

                  Filesize

                  72KB

                • memory/4936-1048-0x0000000009D10000-0x0000000009E1A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4936-360-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1050-0x0000000009E30000-0x0000000009E6C000-memory.dmp

                  Filesize

                  240KB

                • memory/4936-1052-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1053-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-363-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-358-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-1056-0x0000000007270000-0x0000000007280000-memory.dmp

                  Filesize

                  64KB

                • memory/4936-356-0x0000000002CD0000-0x0000000002D16000-memory.dmp

                  Filesize

                  280KB

                • memory/4936-255-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4936-253-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4936-251-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB

                • memory/4936-250-0x0000000007160000-0x0000000007195000-memory.dmp

                  Filesize

                  212KB