Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2023, 08:21

General

  • Target

    ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e.exe

  • Size

    926KB

  • MD5

    26a597cc6fbc44fac145c2595e26dd98

  • SHA1

    3efb5e3da8de4cef6f15280c094e917eda503932

  • SHA256

    ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e

  • SHA512

    8dd9be085e1337b6e4490be56b863b5ba3ba094b20a300b05c256d26cffd608e3e57109703dd50774ca41a20693429069416ed2d41cc97f0b8d95c1558751698

  • SSDEEP

    24576:jyJiCVkkfzRJwO1gmDtnjXeV+NBpgk/ZTxYj9B22:2JiCV9fzTw8g4nS0NBpR/ZTxu

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

217.196.96.56:4138

Attributes
  • auth_value

    fcb02fce9bc10c56a9841d56974bd7b8

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e.exe
    "C:\Users\Admin\AppData\Local\Temp\ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3537399.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3537399.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1680304.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1680304.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2656899.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2656899.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n0984774.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n0984774.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1596
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1084
              6⤵
              • Program crash
              PID:4416
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o7010854.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o7010854.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3928
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7700391.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7700391.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0006557.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0006557.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2148
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:2052
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9651835.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9651835.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3388
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1596 -ip 1596
    1⤵
      PID:2524
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4780
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4016

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9651835.exe

      Filesize

      168KB

      MD5

      5c14ccc886f67fb18f4c9d251de0ced7

      SHA1

      c7a0ad1822b39daa383b259f4942ac18a87fbbd1

      SHA256

      4e887c5d3e2cc3093c1872ac73ba385809a273346062e0287a1e37e8ab72a99c

      SHA512

      4fe4e9fba433fa0d0a3b9712a9adb0983bd64b2056abeddaeee1d64de0cd9cfe949fc0a4f6595519f3afbae0613dbbe240d8c56c46b8ad70b437b8c107b56599

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9651835.exe

      Filesize

      168KB

      MD5

      5c14ccc886f67fb18f4c9d251de0ced7

      SHA1

      c7a0ad1822b39daa383b259f4942ac18a87fbbd1

      SHA256

      4e887c5d3e2cc3093c1872ac73ba385809a273346062e0287a1e37e8ab72a99c

      SHA512

      4fe4e9fba433fa0d0a3b9712a9adb0983bd64b2056abeddaeee1d64de0cd9cfe949fc0a4f6595519f3afbae0613dbbe240d8c56c46b8ad70b437b8c107b56599

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3537399.exe

      Filesize

      771KB

      MD5

      854c898d571eb103789748ccea69ada3

      SHA1

      59d6698bc67455af7d60e96c159058df8cbfd013

      SHA256

      bdcee2210a268df5649b907f11a54ecdd6156839bf4c4733b652d748d9d23c2b

      SHA512

      9121cd7d771d70810524beed2a3005641ad1aab0ec58b0b58ad5a11deb1575063e32cd8fa0907ab511a7f539aefae2ac13348c6c6748660709561231ddab4f0b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3537399.exe

      Filesize

      771KB

      MD5

      854c898d571eb103789748ccea69ada3

      SHA1

      59d6698bc67455af7d60e96c159058df8cbfd013

      SHA256

      bdcee2210a268df5649b907f11a54ecdd6156839bf4c4733b652d748d9d23c2b

      SHA512

      9121cd7d771d70810524beed2a3005641ad1aab0ec58b0b58ad5a11deb1575063e32cd8fa0907ab511a7f539aefae2ac13348c6c6748660709561231ddab4f0b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0006557.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s0006557.exe

      Filesize

      229KB

      MD5

      ef790811553761334226a3f360567949

      SHA1

      68c42e6ac3514611c74b939061a2d4bcd1d33b85

      SHA256

      ed2c7f120fceb1dca121564726db79cdab50867b3fefce2a95b460d8a4633291

      SHA512

      c5452934949464581865a8ce0327e56e1f69875b4bfd39e0d68b6d0170cba785f8fbd4cbd30d5692adfdde9899770d1eb7c3b114fba778a7dea86c00d12877ec

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1680304.exe

      Filesize

      588KB

      MD5

      52daeafe250da43bbd807774b9eba93d

      SHA1

      1dc1c7038a444a0b28e39bfa949b271dfeeadfe4

      SHA256

      ad66666997ac8555586183ba3bb5adb3ec824c3cbb7d0f338d52d9ec0c6acdd5

      SHA512

      07e46960dba26245ec7affe594fde1278f8eb185d2c513e6b516850b1113958ef642d2809b2e7e2447d0c206273cbbded1b8e262681eba8a7d2167f12f5b4566

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1680304.exe

      Filesize

      588KB

      MD5

      52daeafe250da43bbd807774b9eba93d

      SHA1

      1dc1c7038a444a0b28e39bfa949b271dfeeadfe4

      SHA256

      ad66666997ac8555586183ba3bb5adb3ec824c3cbb7d0f338d52d9ec0c6acdd5

      SHA512

      07e46960dba26245ec7affe594fde1278f8eb185d2c513e6b516850b1113958ef642d2809b2e7e2447d0c206273cbbded1b8e262681eba8a7d2167f12f5b4566

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7700391.exe

      Filesize

      176KB

      MD5

      9d9d08faa93b95146bdf4ede9cac2398

      SHA1

      bb9d80345bfe3b3f287c3921d7cd77119bf77101

      SHA256

      873f70babac6753be8a83377c2602d4443b92d9b340352313560aa1ffa835b42

      SHA512

      d7c6c5a619883d1a31ee5ebf94e0abd311dca263ded79afff61b729d9ad3fed5c75c8eb5d6a11ad5e0369df2d88f0863759b45b9159eb5d4ca35a9c8a6f7e522

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p7700391.exe

      Filesize

      176KB

      MD5

      9d9d08faa93b95146bdf4ede9cac2398

      SHA1

      bb9d80345bfe3b3f287c3921d7cd77119bf77101

      SHA256

      873f70babac6753be8a83377c2602d4443b92d9b340352313560aa1ffa835b42

      SHA512

      d7c6c5a619883d1a31ee5ebf94e0abd311dca263ded79afff61b729d9ad3fed5c75c8eb5d6a11ad5e0369df2d88f0863759b45b9159eb5d4ca35a9c8a6f7e522

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2656899.exe

      Filesize

      385KB

      MD5

      f1433e0d2b5ffdbebe673cbe5acfa218

      SHA1

      256c41a72c716ae48b8072cc888d0fb1d2d107c2

      SHA256

      814084910d65d629e6a49f38a2c4b54efc7c61b9bb9c8d81b52f3528725c07f2

      SHA512

      6f0d2f6663c12f232f7f9ef4f6e11cfb2f88dc78a241f179e7dcdde2eb8b1c66f7c54965b6ce67c681eedaf61904ea0951dd1fc1ee68b13048d55e69773ddbd8

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2656899.exe

      Filesize

      385KB

      MD5

      f1433e0d2b5ffdbebe673cbe5acfa218

      SHA1

      256c41a72c716ae48b8072cc888d0fb1d2d107c2

      SHA256

      814084910d65d629e6a49f38a2c4b54efc7c61b9bb9c8d81b52f3528725c07f2

      SHA512

      6f0d2f6663c12f232f7f9ef4f6e11cfb2f88dc78a241f179e7dcdde2eb8b1c66f7c54965b6ce67c681eedaf61904ea0951dd1fc1ee68b13048d55e69773ddbd8

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n0984774.exe

      Filesize

      283KB

      MD5

      4aba258e36f651dd6f3e84b603b31c91

      SHA1

      c6fb2a461640fc48acfd7182820a07be70d6db5a

      SHA256

      21416207110b6b1d26f73698c9684b63877cfcb6af9bf24f5375b7f398907a31

      SHA512

      4521f158918a9f64fa478337229d4769c2c1b107ee509facb5d59649711396eb3910cc8eea58c865eb4ef20720f57a4c48efccb3bb5012d2f49b378c0102a067

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n0984774.exe

      Filesize

      283KB

      MD5

      4aba258e36f651dd6f3e84b603b31c91

      SHA1

      c6fb2a461640fc48acfd7182820a07be70d6db5a

      SHA256

      21416207110b6b1d26f73698c9684b63877cfcb6af9bf24f5375b7f398907a31

      SHA512

      4521f158918a9f64fa478337229d4769c2c1b107ee509facb5d59649711396eb3910cc8eea58c865eb4ef20720f57a4c48efccb3bb5012d2f49b378c0102a067

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o7010854.exe

      Filesize

      168KB

      MD5

      2d579d8ab42cf839d29e2408eacffb41

      SHA1

      26e5e7d72aa34d2148041dd93057a1a51b86d067

      SHA256

      9609227d2ca4dfb3a6140bce02a578cc07f040c9d893612fd122c982e2b3ae99

      SHA512

      e38a3018362aed20778f3cf38351bbb64212098791f6016f7e6749a80c16b4392fcaddcd33ead4066156f35a5e2dd1fd70a3784880a8460db89e5c989a10cb0e

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o7010854.exe

      Filesize

      168KB

      MD5

      2d579d8ab42cf839d29e2408eacffb41

      SHA1

      26e5e7d72aa34d2148041dd93057a1a51b86d067

      SHA256

      9609227d2ca4dfb3a6140bce02a578cc07f040c9d893612fd122c982e2b3ae99

      SHA512

      e38a3018362aed20778f3cf38351bbb64212098791f6016f7e6749a80c16b4392fcaddcd33ead4066156f35a5e2dd1fd70a3784880a8460db89e5c989a10cb0e

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o7010854.exe

      Filesize

      168KB

      MD5

      2d579d8ab42cf839d29e2408eacffb41

      SHA1

      26e5e7d72aa34d2148041dd93057a1a51b86d067

      SHA256

      9609227d2ca4dfb3a6140bce02a578cc07f040c9d893612fd122c982e2b3ae99

      SHA512

      e38a3018362aed20778f3cf38351bbb64212098791f6016f7e6749a80c16b4392fcaddcd33ead4066156f35a5e2dd1fd70a3784880a8460db89e5c989a10cb0e

    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

      Filesize

      89KB

      MD5

      73df88d68a4f5e066784d462788cf695

      SHA1

      e4bfed336848d0b622fa464d40cf4bd9222aab3f

      SHA256

      f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

      SHA512

      64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

      Filesize

      89KB

      MD5

      73df88d68a4f5e066784d462788cf695

      SHA1

      e4bfed336848d0b622fa464d40cf4bd9222aab3f

      SHA256

      f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

      SHA512

      64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

      Filesize

      89KB

      MD5

      73df88d68a4f5e066784d462788cf695

      SHA1

      e4bfed336848d0b622fa464d40cf4bd9222aab3f

      SHA256

      f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

      SHA512

      64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

    • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

      Filesize

      162B

      MD5

      1b7c22a214949975556626d7217e9a39

      SHA1

      d01c97e2944166ed23e47e4a62ff471ab8fa031f

      SHA256

      340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

      SHA512

      ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

    • memory/1596-169-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-189-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-195-0x0000000004F50000-0x0000000004F60000-memory.dmp

      Filesize

      64KB

    • memory/1596-196-0x0000000004F50000-0x0000000004F60000-memory.dmp

      Filesize

      64KB

    • memory/1596-197-0x0000000004F50000-0x0000000004F60000-memory.dmp

      Filesize

      64KB

    • memory/1596-199-0x0000000000400000-0x00000000006C7000-memory.dmp

      Filesize

      2.8MB

    • memory/1596-181-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-179-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-193-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-162-0x0000000004F60000-0x0000000005504000-memory.dmp

      Filesize

      5.6MB

    • memory/1596-194-0x0000000000400000-0x00000000006C7000-memory.dmp

      Filesize

      2.8MB

    • memory/1596-185-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-187-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-173-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-191-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-163-0x00000000006D0000-0x00000000006FD000-memory.dmp

      Filesize

      180KB

    • memory/1596-171-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-165-0x0000000004F50000-0x0000000004F60000-memory.dmp

      Filesize

      64KB

    • memory/1596-164-0x0000000004F50000-0x0000000004F60000-memory.dmp

      Filesize

      64KB

    • memory/1596-166-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-167-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-177-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-175-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/1596-183-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/3388-267-0x0000000004D60000-0x0000000004D70000-memory.dmp

      Filesize

      64KB

    • memory/3928-204-0x000000000B010000-0x000000000B628000-memory.dmp

      Filesize

      6.1MB

    • memory/3928-211-0x000000000B730000-0x000000000B796000-memory.dmp

      Filesize

      408KB

    • memory/3928-203-0x0000000000D30000-0x0000000000D5E000-memory.dmp

      Filesize

      184KB

    • memory/3928-205-0x000000000AB70000-0x000000000AC7A000-memory.dmp

      Filesize

      1.0MB

    • memory/3928-214-0x000000000BC40000-0x000000000BC90000-memory.dmp

      Filesize

      320KB

    • memory/3928-213-0x000000000C990000-0x000000000CEBC000-memory.dmp

      Filesize

      5.2MB

    • memory/3928-212-0x000000000C290000-0x000000000C452000-memory.dmp

      Filesize

      1.8MB

    • memory/3928-206-0x000000000AAA0000-0x000000000AAB2000-memory.dmp

      Filesize

      72KB

    • memory/3928-210-0x000000000AF30000-0x000000000AFC2000-memory.dmp

      Filesize

      584KB

    • memory/3928-209-0x000000000AE10000-0x000000000AE86000-memory.dmp

      Filesize

      472KB

    • memory/3928-207-0x0000000002F00000-0x0000000002F10000-memory.dmp

      Filesize

      64KB

    • memory/3928-208-0x000000000AB00000-0x000000000AB3C000-memory.dmp

      Filesize

      240KB

    • memory/4568-249-0x00000000022F0000-0x0000000002300000-memory.dmp

      Filesize

      64KB

    • memory/4568-247-0x00000000022F0000-0x0000000002300000-memory.dmp

      Filesize

      64KB

    • memory/4568-248-0x00000000022F0000-0x0000000002300000-memory.dmp

      Filesize

      64KB