Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 20:16

General

  • Target

    0566ba1e4a12936c18433c792f3b01b8e84a9871b1677c31e4129c2d79591f77.exe

  • Size

    1.1MB

  • MD5

    6e6138084c65985b842ce77ec303509c

  • SHA1

    6a00724c926b66ee990b33812eb7f5598643715d

  • SHA256

    0566ba1e4a12936c18433c792f3b01b8e84a9871b1677c31e4129c2d79591f77

  • SHA512

    70aac5e8ab238ae53beda21c13d7fd0640f27da6998037aa5c1723dc261b669a5af6a8561ee02b0270a9998ea3d6bd5c1cb6c021ff0ded04f2a185f802782f22

  • SSDEEP

    24576:EyFUhXXm9YeQ7AsLPY+DQryqm/BBf6Ffi8byEuW0H:TihXXm6eCAsLPY+DQOqm/yfnG/W0

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0566ba1e4a12936c18433c792f3b01b8e84a9871b1677c31e4129c2d79591f77.exe
    "C:\Users\Admin\AppData\Local\Temp\0566ba1e4a12936c18433c792f3b01b8e84a9871b1677c31e4129c2d79591f77.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DY606548.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DY606548.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wJ115449.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wJ115449.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fs298477.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fs298477.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1568
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\109591346.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\109591346.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4360
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\219146737.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\219146737.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:628
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 1080
              6⤵
              • Program crash
              PID:4504
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\335030556.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\335030556.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5040
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:2952
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4648
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:2664
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  7⤵
                    PID:1800
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:R" /E
                    7⤵
                      PID:4244
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:2848
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\cb7ae701b3" /P "Admin:N"
                        7⤵
                          PID:2832
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:R" /E
                          7⤵
                            PID:3328
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\476339581.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\476339581.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:716
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 628 -ip 628
                1⤵
                  PID:2012
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2828
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3108

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DY606548.exe

                  Filesize

                  929KB

                  MD5

                  275f2e071262ebeae5b65d06424bbf19

                  SHA1

                  38808b9533bf5b8d705616a5bf62c792b8aace27

                  SHA256

                  4bfb03b5e80f14d271e8dbfe4928cc239246cc2e1575b46be6341d043ebc5038

                  SHA512

                  ce3740bf6096b0a25ddc056cd765b02d2b38b780d5bc769835a6e2da67886d55c88c6434925609aef3604629cd196bab586ce6620478b7f5fe17ad12c59a5f6f

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DY606548.exe

                  Filesize

                  929KB

                  MD5

                  275f2e071262ebeae5b65d06424bbf19

                  SHA1

                  38808b9533bf5b8d705616a5bf62c792b8aace27

                  SHA256

                  4bfb03b5e80f14d271e8dbfe4928cc239246cc2e1575b46be6341d043ebc5038

                  SHA512

                  ce3740bf6096b0a25ddc056cd765b02d2b38b780d5bc769835a6e2da67886d55c88c6434925609aef3604629cd196bab586ce6620478b7f5fe17ad12c59a5f6f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\476339581.exe

                  Filesize

                  340KB

                  MD5

                  613178932889c97acf7fa2a4135de879

                  SHA1

                  68d8aebbedc3d79024d97923ec5ac1fd0e972931

                  SHA256

                  90ddf3b585bbe7818b985ce563839aabe0cf4fb84d35b646a0f6cd07e6b32dcd

                  SHA512

                  c56096ba2409bf2f8d116b614c9e5bbfd164e5cb072bff5de59c24531922eb8fc54f2d16c864c17310d277b862c29f840c525558692a10be118178452e913fd0

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\476339581.exe

                  Filesize

                  340KB

                  MD5

                  613178932889c97acf7fa2a4135de879

                  SHA1

                  68d8aebbedc3d79024d97923ec5ac1fd0e972931

                  SHA256

                  90ddf3b585bbe7818b985ce563839aabe0cf4fb84d35b646a0f6cd07e6b32dcd

                  SHA512

                  c56096ba2409bf2f8d116b614c9e5bbfd164e5cb072bff5de59c24531922eb8fc54f2d16c864c17310d277b862c29f840c525558692a10be118178452e913fd0

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wJ115449.exe

                  Filesize

                  577KB

                  MD5

                  c97e0c7c83ebc58fbe37381b3a651e14

                  SHA1

                  f836353b5e7839406f94ca7f526eb8bae79d755b

                  SHA256

                  3752d9a8d3b5396e10fe35946e893d04a71aa09dbe2a0b697fe37beed5471c2a

                  SHA512

                  7f75ff109fdb9652ab96d21ea58b5a99977b7f97f447d4a7dd645cdc3f315de0ea956ddca7194230e15c7a5e9cfc3942bf9866d880bff4abb65ba3881e7d9b99

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wJ115449.exe

                  Filesize

                  577KB

                  MD5

                  c97e0c7c83ebc58fbe37381b3a651e14

                  SHA1

                  f836353b5e7839406f94ca7f526eb8bae79d755b

                  SHA256

                  3752d9a8d3b5396e10fe35946e893d04a71aa09dbe2a0b697fe37beed5471c2a

                  SHA512

                  7f75ff109fdb9652ab96d21ea58b5a99977b7f97f447d4a7dd645cdc3f315de0ea956ddca7194230e15c7a5e9cfc3942bf9866d880bff4abb65ba3881e7d9b99

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\335030556.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\335030556.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fs298477.exe

                  Filesize

                  405KB

                  MD5

                  bc3be5e33eeef8684314ccdd3044e6e7

                  SHA1

                  d8829d896b51dc7ca1bb27c2f87606ddae51bae7

                  SHA256

                  084f2d4cd20214516a05d7ca2dd8e9180f587fbc52262d1324fceafaf3dbe557

                  SHA512

                  69923f2e55dabfad2c9b7279bb9d856a112d517a1b69574b394c544b8d72913346b2af7c6880a628450d37f0d15c4c0a69d090c48641cec981b62064eddc44c7

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fs298477.exe

                  Filesize

                  405KB

                  MD5

                  bc3be5e33eeef8684314ccdd3044e6e7

                  SHA1

                  d8829d896b51dc7ca1bb27c2f87606ddae51bae7

                  SHA256

                  084f2d4cd20214516a05d7ca2dd8e9180f587fbc52262d1324fceafaf3dbe557

                  SHA512

                  69923f2e55dabfad2c9b7279bb9d856a112d517a1b69574b394c544b8d72913346b2af7c6880a628450d37f0d15c4c0a69d090c48641cec981b62064eddc44c7

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\109591346.exe

                  Filesize

                  176KB

                  MD5

                  2b71f4b18ac8214a2bff547b6ce2f64f

                  SHA1

                  b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

                  SHA256

                  f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

                  SHA512

                  33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\109591346.exe

                  Filesize

                  176KB

                  MD5

                  2b71f4b18ac8214a2bff547b6ce2f64f

                  SHA1

                  b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

                  SHA256

                  f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

                  SHA512

                  33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\219146737.exe

                  Filesize

                  258KB

                  MD5

                  520fd1d86f4ecea1739cf53c8c47da04

                  SHA1

                  5bce4f846db729e78517ad52aca48748e5d7a4ad

                  SHA256

                  fa45a54db735119f054b283d9549178e55eecf0868a84197a9dcb7d5f0469663

                  SHA512

                  9c4640b3a7577f26e028af8a71724f023ac7109badbc5c30524eba0c63ad991122ff88bb5724d76ccac2824d83710e0e3450b97bcb23dc50f9dbc9300a7c62c9

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\219146737.exe

                  Filesize

                  258KB

                  MD5

                  520fd1d86f4ecea1739cf53c8c47da04

                  SHA1

                  5bce4f846db729e78517ad52aca48748e5d7a4ad

                  SHA256

                  fa45a54db735119f054b283d9549178e55eecf0868a84197a9dcb7d5f0469663

                  SHA512

                  9c4640b3a7577f26e028af8a71724f023ac7109badbc5c30524eba0c63ad991122ff88bb5724d76ccac2824d83710e0e3450b97bcb23dc50f9dbc9300a7c62c9

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                  Filesize

                  204KB

                  MD5

                  1304f384653e08ae497008ff13498608

                  SHA1

                  d9a76ed63d74d4217c5027757cb9a7a0d0093080

                  SHA256

                  2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                  SHA512

                  4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                • memory/628-238-0x0000000000400000-0x0000000002B9B000-memory.dmp

                  Filesize

                  39.6MB

                • memory/628-237-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-235-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-236-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-233-0x0000000000400000-0x0000000002B9B000-memory.dmp

                  Filesize

                  39.6MB

                • memory/628-232-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-231-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-230-0x00000000072D0000-0x00000000072E0000-memory.dmp

                  Filesize

                  64KB

                • memory/628-229-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

                  Filesize

                  180KB

                • memory/716-256-0x00000000046D0000-0x0000000004716000-memory.dmp

                  Filesize

                  280KB

                • memory/716-257-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1063-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1061-0x000000000A440000-0x000000000A47C000-memory.dmp

                  Filesize

                  240KB

                • memory/716-1060-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1059-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1058-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1057-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-1054-0x000000000A320000-0x000000000A42A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/716-1053-0x000000000A300000-0x000000000A312000-memory.dmp

                  Filesize

                  72KB

                • memory/716-1052-0x0000000009C80000-0x000000000A298000-memory.dmp

                  Filesize

                  6.1MB

                • memory/716-265-0x0000000004D00000-0x0000000004D35000-memory.dmp

                  Filesize

                  212KB

                • memory/716-263-0x0000000004D00000-0x0000000004D35000-memory.dmp

                  Filesize

                  212KB

                • memory/716-261-0x0000000004D00000-0x0000000004D35000-memory.dmp

                  Filesize

                  212KB

                • memory/716-258-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/716-260-0x0000000004D00000-0x0000000004D35000-memory.dmp

                  Filesize

                  212KB

                • memory/716-259-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-180-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-195-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-164-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-163-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-166-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-168-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-170-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-172-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-174-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-176-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-178-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-165-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-182-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-184-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-162-0x0000000004AA0000-0x0000000005044000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4360-186-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-188-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-192-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-190-0x0000000004960000-0x0000000004973000-memory.dmp

                  Filesize

                  76KB

                • memory/4360-193-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-194-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4360-161-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                  Filesize

                  64KB