Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2023, 04:52

General

  • Target

    d8341e747ffc08a1ef94c26461fb47575d07187a2f7fd426eba59488c37fa939.exe

  • Size

    875KB

  • MD5

    c760283a1b7f56f26d601b79cec7ea63

  • SHA1

    cc346c05591a430e58237aaa4fa71a8b99d6a59a

  • SHA256

    d8341e747ffc08a1ef94c26461fb47575d07187a2f7fd426eba59488c37fa939

  • SHA512

    d33f92f26c2083852cb1cb48a4de13dd421f173941b4766ad2f0e7bd840248747cda3d8f7704c8ca505487c562dae6805a9a25ed26f2b2b21a5ec7722d890082

  • SSDEEP

    24576:gyqVzgetPURPLWVDs/SMs9wPFca+TgsVTLKbzBU0oDd:nqVzYPGDs/SMltcVgsVeBUT

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.122:19062

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

mesu

C2

83.97.73.122:19062

Attributes
  • auth_value

    8ede6a157d1d9509a21427d10e999ba2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8341e747ffc08a1ef94c26461fb47575d07187a2f7fd426eba59488c37fa939.exe
    "C:\Users\Admin\AppData\Local\Temp\d8341e747ffc08a1ef94c26461fb47575d07187a2f7fd426eba59488c37fa939.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1112
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      PID:1432
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe

    Filesize

    329KB

    MD5

    981219346db821c915a0d668a7c68b51

    SHA1

    db032cce4fd0c1cecb2fe98c11d43807c08d6850

    SHA256

    876d66e08f2a887513fe7bc8c00215e1a6784fc765c0c3bd44964f0c010af601

    SHA512

    c2015f3f46730da7ac7ad0cc61474dc6f3dc989ef19c92809650f324097d3a9ed388ae289404f1358801c4696b465d5f2b0e6eb6fd3e7d024327fe7e409d76a9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe

    Filesize

    329KB

    MD5

    981219346db821c915a0d668a7c68b51

    SHA1

    db032cce4fd0c1cecb2fe98c11d43807c08d6850

    SHA256

    876d66e08f2a887513fe7bc8c00215e1a6784fc765c0c3bd44964f0c010af601

    SHA512

    c2015f3f46730da7ac7ad0cc61474dc6f3dc989ef19c92809650f324097d3a9ed388ae289404f1358801c4696b465d5f2b0e6eb6fd3e7d024327fe7e409d76a9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe

    Filesize

    603KB

    MD5

    da329bb4dae5f88907ae7cd33895faf6

    SHA1

    e830c1792075ba9a4dbffd5f2cd13fe8a6b7da0d

    SHA256

    76d297e8b41301d2f71399112adf97225f691f41fd830ef76d7ec2bb8e2125b4

    SHA512

    3a3fc5f5c7a9f4bab60abcfb7293013c0099e52c86d01f286e0eab5fc55e01c76a6e8a1e895fc3e3fc5aff0cffe91aa6160d2b476e908b46863278c29609411b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe

    Filesize

    603KB

    MD5

    da329bb4dae5f88907ae7cd33895faf6

    SHA1

    e830c1792075ba9a4dbffd5f2cd13fe8a6b7da0d

    SHA256

    76d297e8b41301d2f71399112adf97225f691f41fd830ef76d7ec2bb8e2125b4

    SHA512

    3a3fc5f5c7a9f4bab60abcfb7293013c0099e52c86d01f286e0eab5fc55e01c76a6e8a1e895fc3e3fc5aff0cffe91aa6160d2b476e908b46863278c29609411b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe

    Filesize

    387KB

    MD5

    e4ae30b22d8a1dc71d155d32bf64e0bf

    SHA1

    5d552916f0f8e00772af975b33727ba4589e44d2

    SHA256

    88b9cc7efc7793500ad78aac39b6b5e39bc1a2859f77d11789e938cfd9e9fa55

    SHA512

    79bce5b7a8093149efc25e4f0d98b0d627c5056a2605fb50ef7a4bff565c4d5c53b0be4aeaa3ef9fb1098208c9bf242ade6f8f630434a3a72c68b104303bd9f9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe

    Filesize

    387KB

    MD5

    e4ae30b22d8a1dc71d155d32bf64e0bf

    SHA1

    5d552916f0f8e00772af975b33727ba4589e44d2

    SHA256

    88b9cc7efc7793500ad78aac39b6b5e39bc1a2859f77d11789e938cfd9e9fa55

    SHA512

    79bce5b7a8093149efc25e4f0d98b0d627c5056a2605fb50ef7a4bff565c4d5c53b0be4aeaa3ef9fb1098208c9bf242ade6f8f630434a3a72c68b104303bd9f9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe

    Filesize

    277KB

    MD5

    95cbf5158ae62f7b6b0ffae6f9f5abc6

    SHA1

    23b0d70ba0c3daf3ca80e56c519640110c23005f

    SHA256

    609c30c818ef0adcb15770aa9a00283589c7c3b5a0f541b9dc7aace032c559d8

    SHA512

    a922ece0579107b86bf90f4125d5f59e7b3ac9abe65845457daefb9c34582df34002b1055903727fee58760d792b9c8c2cb2974540c4c1cb80fc33eddd8553ae

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe

    Filesize

    277KB

    MD5

    95cbf5158ae62f7b6b0ffae6f9f5abc6

    SHA1

    23b0d70ba0c3daf3ca80e56c519640110c23005f

    SHA256

    609c30c818ef0adcb15770aa9a00283589c7c3b5a0f541b9dc7aace032c559d8

    SHA512

    a922ece0579107b86bf90f4125d5f59e7b3ac9abe65845457daefb9c34582df34002b1055903727fee58760d792b9c8c2cb2974540c4c1cb80fc33eddd8553ae

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe

    Filesize

    146KB

    MD5

    220aa09408bd5bd48e1c64f7456fe650

    SHA1

    97a9d6e037c298743d5d58916ee3013b17e71c57

    SHA256

    26470ad039c0add64756596e3c90320a634ace582250b26cdbd56da61d533f36

    SHA512

    8361d61c20ff1fe5d869a58b316b8f0dca98d07a89bef7140713a4c36af986bbe20d053c6b8cd31788435a2732d81bc8f2d23556363966c4d2d1838a2f94f643

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe

    Filesize

    146KB

    MD5

    220aa09408bd5bd48e1c64f7456fe650

    SHA1

    97a9d6e037c298743d5d58916ee3013b17e71c57

    SHA256

    26470ad039c0add64756596e3c90320a634ace582250b26cdbd56da61d533f36

    SHA512

    8361d61c20ff1fe5d869a58b316b8f0dca98d07a89bef7140713a4c36af986bbe20d053c6b8cd31788435a2732d81bc8f2d23556363966c4d2d1838a2f94f643

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe

    Filesize

    194KB

    MD5

    e4224fc9e186f12072622af5c659e0e8

    SHA1

    b7c6a27b2e45dd773cb9d70456827479034fb231

    SHA256

    c48fd4ef9147b43d8189a707e9ff4a33bf1876169a04febe8d6d59bf806567ca

    SHA512

    067780aef1cc9c2c6d4c728b2765a622789a62bd46e133c0f59cc9f1639ddba6f78d9599dfb5243a61d006a71f54f9a643c0fd63dfae39909a3e53691056046d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe

    Filesize

    194KB

    MD5

    e4224fc9e186f12072622af5c659e0e8

    SHA1

    b7c6a27b2e45dd773cb9d70456827479034fb231

    SHA256

    c48fd4ef9147b43d8189a707e9ff4a33bf1876169a04febe8d6d59bf806567ca

    SHA512

    067780aef1cc9c2c6d4c728b2765a622789a62bd46e133c0f59cc9f1639ddba6f78d9599dfb5243a61d006a71f54f9a643c0fd63dfae39909a3e53691056046d

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe

    Filesize

    329KB

    MD5

    981219346db821c915a0d668a7c68b51

    SHA1

    db032cce4fd0c1cecb2fe98c11d43807c08d6850

    SHA256

    876d66e08f2a887513fe7bc8c00215e1a6784fc765c0c3bd44964f0c010af601

    SHA512

    c2015f3f46730da7ac7ad0cc61474dc6f3dc989ef19c92809650f324097d3a9ed388ae289404f1358801c4696b465d5f2b0e6eb6fd3e7d024327fe7e409d76a9

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\i8534310.exe

    Filesize

    329KB

    MD5

    981219346db821c915a0d668a7c68b51

    SHA1

    db032cce4fd0c1cecb2fe98c11d43807c08d6850

    SHA256

    876d66e08f2a887513fe7bc8c00215e1a6784fc765c0c3bd44964f0c010af601

    SHA512

    c2015f3f46730da7ac7ad0cc61474dc6f3dc989ef19c92809650f324097d3a9ed388ae289404f1358801c4696b465d5f2b0e6eb6fd3e7d024327fe7e409d76a9

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe

    Filesize

    603KB

    MD5

    da329bb4dae5f88907ae7cd33895faf6

    SHA1

    e830c1792075ba9a4dbffd5f2cd13fe8a6b7da0d

    SHA256

    76d297e8b41301d2f71399112adf97225f691f41fd830ef76d7ec2bb8e2125b4

    SHA512

    3a3fc5f5c7a9f4bab60abcfb7293013c0099e52c86d01f286e0eab5fc55e01c76a6e8a1e895fc3e3fc5aff0cffe91aa6160d2b476e908b46863278c29609411b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x5938098.exe

    Filesize

    603KB

    MD5

    da329bb4dae5f88907ae7cd33895faf6

    SHA1

    e830c1792075ba9a4dbffd5f2cd13fe8a6b7da0d

    SHA256

    76d297e8b41301d2f71399112adf97225f691f41fd830ef76d7ec2bb8e2125b4

    SHA512

    3a3fc5f5c7a9f4bab60abcfb7293013c0099e52c86d01f286e0eab5fc55e01c76a6e8a1e895fc3e3fc5aff0cffe91aa6160d2b476e908b46863278c29609411b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe

    Filesize

    387KB

    MD5

    e4ae30b22d8a1dc71d155d32bf64e0bf

    SHA1

    5d552916f0f8e00772af975b33727ba4589e44d2

    SHA256

    88b9cc7efc7793500ad78aac39b6b5e39bc1a2859f77d11789e938cfd9e9fa55

    SHA512

    79bce5b7a8093149efc25e4f0d98b0d627c5056a2605fb50ef7a4bff565c4d5c53b0be4aeaa3ef9fb1098208c9bf242ade6f8f630434a3a72c68b104303bd9f9

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\h6205739.exe

    Filesize

    387KB

    MD5

    e4ae30b22d8a1dc71d155d32bf64e0bf

    SHA1

    5d552916f0f8e00772af975b33727ba4589e44d2

    SHA256

    88b9cc7efc7793500ad78aac39b6b5e39bc1a2859f77d11789e938cfd9e9fa55

    SHA512

    79bce5b7a8093149efc25e4f0d98b0d627c5056a2605fb50ef7a4bff565c4d5c53b0be4aeaa3ef9fb1098208c9bf242ade6f8f630434a3a72c68b104303bd9f9

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe

    Filesize

    277KB

    MD5

    95cbf5158ae62f7b6b0ffae6f9f5abc6

    SHA1

    23b0d70ba0c3daf3ca80e56c519640110c23005f

    SHA256

    609c30c818ef0adcb15770aa9a00283589c7c3b5a0f541b9dc7aace032c559d8

    SHA512

    a922ece0579107b86bf90f4125d5f59e7b3ac9abe65845457daefb9c34582df34002b1055903727fee58760d792b9c8c2cb2974540c4c1cb80fc33eddd8553ae

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x1289985.exe

    Filesize

    277KB

    MD5

    95cbf5158ae62f7b6b0ffae6f9f5abc6

    SHA1

    23b0d70ba0c3daf3ca80e56c519640110c23005f

    SHA256

    609c30c818ef0adcb15770aa9a00283589c7c3b5a0f541b9dc7aace032c559d8

    SHA512

    a922ece0579107b86bf90f4125d5f59e7b3ac9abe65845457daefb9c34582df34002b1055903727fee58760d792b9c8c2cb2974540c4c1cb80fc33eddd8553ae

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe

    Filesize

    146KB

    MD5

    220aa09408bd5bd48e1c64f7456fe650

    SHA1

    97a9d6e037c298743d5d58916ee3013b17e71c57

    SHA256

    26470ad039c0add64756596e3c90320a634ace582250b26cdbd56da61d533f36

    SHA512

    8361d61c20ff1fe5d869a58b316b8f0dca98d07a89bef7140713a4c36af986bbe20d053c6b8cd31788435a2732d81bc8f2d23556363966c4d2d1838a2f94f643

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\f0147641.exe

    Filesize

    146KB

    MD5

    220aa09408bd5bd48e1c64f7456fe650

    SHA1

    97a9d6e037c298743d5d58916ee3013b17e71c57

    SHA256

    26470ad039c0add64756596e3c90320a634ace582250b26cdbd56da61d533f36

    SHA512

    8361d61c20ff1fe5d869a58b316b8f0dca98d07a89bef7140713a4c36af986bbe20d053c6b8cd31788435a2732d81bc8f2d23556363966c4d2d1838a2f94f643

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe

    Filesize

    194KB

    MD5

    e4224fc9e186f12072622af5c659e0e8

    SHA1

    b7c6a27b2e45dd773cb9d70456827479034fb231

    SHA256

    c48fd4ef9147b43d8189a707e9ff4a33bf1876169a04febe8d6d59bf806567ca

    SHA512

    067780aef1cc9c2c6d4c728b2765a622789a62bd46e133c0f59cc9f1639ddba6f78d9599dfb5243a61d006a71f54f9a643c0fd63dfae39909a3e53691056046d

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\g6688128.exe

    Filesize

    194KB

    MD5

    e4224fc9e186f12072622af5c659e0e8

    SHA1

    b7c6a27b2e45dd773cb9d70456827479034fb231

    SHA256

    c48fd4ef9147b43d8189a707e9ff4a33bf1876169a04febe8d6d59bf806567ca

    SHA512

    067780aef1cc9c2c6d4c728b2765a622789a62bd46e133c0f59cc9f1639ddba6f78d9599dfb5243a61d006a71f54f9a643c0fd63dfae39909a3e53691056046d

  • \Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • \Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    96KB

    MD5

    7825cad99621dd288da81d8d8ae13cf5

    SHA1

    f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

    SHA256

    529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

    SHA512

    2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

  • memory/784-94-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/784-100-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/784-93-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/784-101-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/784-98-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1112-84-0x00000000013A0000-0x00000000013CA000-memory.dmp

    Filesize

    168KB

  • memory/1112-85-0x0000000005100000-0x0000000005140000-memory.dmp

    Filesize

    256KB

  • memory/1516-109-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1516-116-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1516-110-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1516-123-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1516-118-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1600-138-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1600-137-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1600-144-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1600-145-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1600-146-0x00000000005C0000-0x0000000000600000-memory.dmp

    Filesize

    256KB