Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 20:19

General

  • Target

    eae8246f5cce7256166b306de2297dfce32aca9777d741aa99fd6feb91a04ee4.exe

  • Size

    1.1MB

  • MD5

    4f08af0d7979be4afc5298e15d8f5d1c

  • SHA1

    dc25167f820af93c637a853e4f2afd6db7357bd5

  • SHA256

    eae8246f5cce7256166b306de2297dfce32aca9777d741aa99fd6feb91a04ee4

  • SHA512

    5d5866ec116e20cc13358918c80d1e3331d0865db5f6e320297bf6e518c83d3d6215eb64b19cf46fcda45d9b1ef356cb839b6dc47f7430896045246d021cfef0

  • SSDEEP

    24576:DyPnsh0CxHc9WI+FGAtsGSoThioBUEyUoKQPwM8ODuFnzNRzhZYTI:W/s+Cx89gGAtqMglrUmP1u1zH4T

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eae8246f5cce7256166b306de2297dfce32aca9777d741aa99fd6feb91a04ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\eae8246f5cce7256166b306de2297dfce32aca9777d741aa99fd6feb91a04ee4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uc434713.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uc434713.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xI384628.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xI384628.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wv694818.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wv694818.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4652
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\177712282.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\177712282.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1512
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\285848463.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\285848463.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4060
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1076
              6⤵
              • Program crash
              PID:1260
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\398287954.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\398287954.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4340
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4888
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3140
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:2264
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  7⤵
                    PID:2092
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:R" /E
                    7⤵
                      PID:4648
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:2968
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\cb7ae701b3" /P "Admin:N"
                        7⤵
                          PID:4896
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:R" /E
                          7⤵
                            PID:3416
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\431388220.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\431388220.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3208
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4060 -ip 4060
                1⤵
                  PID:2476
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1820

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uc434713.exe

                  Filesize

                  992KB

                  MD5

                  a6941e36d531f21cffe9f4c2aeec36d3

                  SHA1

                  e1231f567698639903e5299640e396890347284a

                  SHA256

                  68c5aca8c7dd0c518afd85c2e88fb6b0389ebb835865d19f6427442b7baf5e37

                  SHA512

                  9a28415c40bf71f4d6d1278c9c536e8a8c83a0c5e5805b61cb708741fd92d04cb33e1e1f7e2af5da293cfa45ca9eef80237fffae73e48563813a458f1a043b9a

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uc434713.exe

                  Filesize

                  992KB

                  MD5

                  a6941e36d531f21cffe9f4c2aeec36d3

                  SHA1

                  e1231f567698639903e5299640e396890347284a

                  SHA256

                  68c5aca8c7dd0c518afd85c2e88fb6b0389ebb835865d19f6427442b7baf5e37

                  SHA512

                  9a28415c40bf71f4d6d1278c9c536e8a8c83a0c5e5805b61cb708741fd92d04cb33e1e1f7e2af5da293cfa45ca9eef80237fffae73e48563813a458f1a043b9a

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\431388220.exe

                  Filesize

                  415KB

                  MD5

                  cd299fed88633256977a9d91a8d49516

                  SHA1

                  2f6f249b5a53e3c5a6525e22052f1ac98d708f66

                  SHA256

                  450ace5c7f26c54988deef65026dd78638798bfda1bd6d482af76bf6bd11765c

                  SHA512

                  2b55df0a1c5ed50a063deb30ca80fee84e9612d468b0a7f16c2ea60768b0edd2e6285a05b790ad06e53113e5f2edcb6b585141647ebde62a3b14d60244f7ae83

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\431388220.exe

                  Filesize

                  415KB

                  MD5

                  cd299fed88633256977a9d91a8d49516

                  SHA1

                  2f6f249b5a53e3c5a6525e22052f1ac98d708f66

                  SHA256

                  450ace5c7f26c54988deef65026dd78638798bfda1bd6d482af76bf6bd11765c

                  SHA512

                  2b55df0a1c5ed50a063deb30ca80fee84e9612d468b0a7f16c2ea60768b0edd2e6285a05b790ad06e53113e5f2edcb6b585141647ebde62a3b14d60244f7ae83

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xI384628.exe

                  Filesize

                  609KB

                  MD5

                  c17403b679a15477c88a0e8ff5b722af

                  SHA1

                  970c7781b22d3da7eeddf03b0635230f671935d9

                  SHA256

                  2486fac7723462b08e1f281579142f0180311171538d873d1972950060759edd

                  SHA512

                  94e3161e92db0ea881457c2dd7b1d2df784853e672dd6accdbb68d76b0796594b56b581066786a79415b667ee7f6bcd17185c5d7813363cf39dcbdc78a6813a8

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xI384628.exe

                  Filesize

                  609KB

                  MD5

                  c17403b679a15477c88a0e8ff5b722af

                  SHA1

                  970c7781b22d3da7eeddf03b0635230f671935d9

                  SHA256

                  2486fac7723462b08e1f281579142f0180311171538d873d1972950060759edd

                  SHA512

                  94e3161e92db0ea881457c2dd7b1d2df784853e672dd6accdbb68d76b0796594b56b581066786a79415b667ee7f6bcd17185c5d7813363cf39dcbdc78a6813a8

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\398287954.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\398287954.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wv694818.exe

                  Filesize

                  437KB

                  MD5

                  d5a2d69d6103ff745d69878c7743992a

                  SHA1

                  c1293dc5b09aa69a73c889b7db1af4e637f9b381

                  SHA256

                  5591575d12602b7971345c84de15522373aee90c7ea2491da8b2fd9d249e7c2c

                  SHA512

                  14d676a4fb6f5409300bc9cc1b55315478803be84b568ada7dd714e5863a6fb62e18725955abe9bfc6015b2aff66b5e0beb42416c93ef21d8a1ada1c71fef4c7

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wv694818.exe

                  Filesize

                  437KB

                  MD5

                  d5a2d69d6103ff745d69878c7743992a

                  SHA1

                  c1293dc5b09aa69a73c889b7db1af4e637f9b381

                  SHA256

                  5591575d12602b7971345c84de15522373aee90c7ea2491da8b2fd9d249e7c2c

                  SHA512

                  14d676a4fb6f5409300bc9cc1b55315478803be84b568ada7dd714e5863a6fb62e18725955abe9bfc6015b2aff66b5e0beb42416c93ef21d8a1ada1c71fef4c7

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\177712282.exe

                  Filesize

                  175KB

                  MD5

                  7460493d1044f35180a988a97c52a7cb

                  SHA1

                  72a67ff74e630aaec14ec5c5430cffd23ac570b7

                  SHA256

                  7251c78587161748fe39e4f8dcb7709bd35ddef40a2c15bed9846026f290020c

                  SHA512

                  0b50d3752fadd21c5394e56fa2cafa9fb25ca00a9a8a361d626453ae984aee21a04ce27fbd4e57969db9c800b47e932595ccb14785e622038297276a3315d4b7

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\177712282.exe

                  Filesize

                  175KB

                  MD5

                  7460493d1044f35180a988a97c52a7cb

                  SHA1

                  72a67ff74e630aaec14ec5c5430cffd23ac570b7

                  SHA256

                  7251c78587161748fe39e4f8dcb7709bd35ddef40a2c15bed9846026f290020c

                  SHA512

                  0b50d3752fadd21c5394e56fa2cafa9fb25ca00a9a8a361d626453ae984aee21a04ce27fbd4e57969db9c800b47e932595ccb14785e622038297276a3315d4b7

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\285848463.exe

                  Filesize

                  332KB

                  MD5

                  bef17f3714fc551830959aea8d55f8ca

                  SHA1

                  b50a376eccce97c18a5fbd18b8b53865ea57da0f

                  SHA256

                  ceea885c8fffb209a490103b3521333843e4e40ca69e28508c4e82e0ca7059e3

                  SHA512

                  00f95074be0ac93bc101f41c84a522ae9a9eb9f29e3e0f653719a60c51efe52be70f5f4040b7632b0c2751d8186eb97ffb323d6b92ed7892831d7cd2f7f82693

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\285848463.exe

                  Filesize

                  332KB

                  MD5

                  bef17f3714fc551830959aea8d55f8ca

                  SHA1

                  b50a376eccce97c18a5fbd18b8b53865ea57da0f

                  SHA256

                  ceea885c8fffb209a490103b3521333843e4e40ca69e28508c4e82e0ca7059e3

                  SHA512

                  00f95074be0ac93bc101f41c84a522ae9a9eb9f29e3e0f653719a60c51efe52be70f5f4040b7632b0c2751d8186eb97ffb323d6b92ed7892831d7cd2f7f82693

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  9464e4bef57a1d4020ee35a6de4373fa

                  SHA1

                  8dcf342413398d6cc4134a33a19a2dc0bfe9c688

                  SHA256

                  b383f9182b6b1d9e6768c40eae9076e314cac6cb02e6d3788432d58790b45f45

                  SHA512

                  60b837ef743eecb8e9ff867b2e349d95474410716e529978efc179c77fe761f310b657626f3d1d727bd95454acb61100d12628b879439fc0b6345954fc2ed495

                • memory/1512-176-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-195-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/1512-182-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-174-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-172-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-184-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-186-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-188-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-190-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-192-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-194-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-162-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/1512-180-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-170-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-161-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/1512-167-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-178-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-166-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/1512-165-0x0000000004B90000-0x0000000005134000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1512-168-0x0000000005190000-0x00000000051A3000-memory.dmp

                  Filesize

                  76KB

                • memory/1512-164-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/1512-163-0x0000000004A40000-0x0000000004A50000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-1060-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-1055-0x00000000075C0000-0x00000000075D2000-memory.dmp

                  Filesize

                  72KB

                • memory/3208-1054-0x0000000007BE0000-0x00000000081F8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3208-437-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-434-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-433-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-431-0x0000000000620000-0x0000000000666000-memory.dmp

                  Filesize

                  280KB

                • memory/3208-261-0x0000000002720000-0x0000000002755000-memory.dmp

                  Filesize

                  212KB

                • memory/3208-259-0x0000000002720000-0x0000000002755000-memory.dmp

                  Filesize

                  212KB

                • memory/3208-258-0x0000000002720000-0x0000000002755000-memory.dmp

                  Filesize

                  212KB

                • memory/3208-1056-0x00000000075E0000-0x00000000076EA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3208-1057-0x00000000076F0000-0x000000000772C000-memory.dmp

                  Filesize

                  240KB

                • memory/3208-1058-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-1061-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-1062-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/3208-1063-0x0000000004C80000-0x0000000004C90000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-204-0x00000000005C0000-0x00000000005ED000-memory.dmp

                  Filesize

                  180KB

                • memory/4060-238-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/4060-236-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-235-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-234-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-233-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/4060-232-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-230-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-228-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-226-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-224-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-222-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-220-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-218-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-216-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-214-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-212-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-211-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-208-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-209-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-205-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                  Filesize

                  64KB

                • memory/4060-206-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-202-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB

                • memory/4060-201-0x0000000002420000-0x0000000002432000-memory.dmp

                  Filesize

                  72KB