Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 00:29

General

  • Target

    setup_installer.exe

  • Size

    1.5MB

  • MD5

    c0e6ffa5d96ec511f8fc16576f576d7f

  • SHA1

    cf96fcb912c1d7cea6e9840aefcfe2d0f5ad1846

  • SHA256

    f93e49425c33932d4adda4e5ff0818a0970280a22883824d806e4cf4f511a82f

  • SHA512

    f43d0c695f8be14a6f4758fc7a91e88564e2ce1ac58f964cd4b4528e8bd8541ce6e9e3172b8ee17de3305ac6132e9a67fa6f74532933fc48e13cae62d1bdff23

  • SSDEEP

    49152:xcBvCpZgu2X0EwJ84vLRaBtIl9mTM8VswpNm0jz:xDZ2XjCvLUBsK7ZpUs

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ASPack v2.12-2.42 16 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 23 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 368
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2836
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c karotima_2.exe
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe
      karotima_2.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2688
  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.exe
    karotima_1.exe
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    PID:2572
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c karotima_1.exe
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.exe

    Filesize

    36KB

    MD5

    c4be84982ffc6a15cae10b1dc6052d32

    SHA1

    db52b6997815d109603ee6cf3d7a737804b51b65

    SHA256

    2f6a98fb1370b1ad3cb8553fbdb947999fa4d754a89c332594f9515733639792

    SHA512

    3bb5d8d6abdf8e1a7872d3f67b899c48586293179f05ce72d749c351915a435e3325fcb7280cb3c14c588d600d08b5074c0b0b13ee2db103bcbdc174d60ce4ed

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.txt

    Filesize

    84KB

    MD5

    b49d7c90d58684c624c30e6184e940a1

    SHA1

    d07cce29c599f23a95e83d4810c6751610731a1f

    SHA256

    585f4199ab72dc5f3b398e4983f53a44fbcca454ef0e2ec98dd9b40ca67e78d6

    SHA512

    d5dd7874d1395c4c8b4d9118c7fb38d6cfb08f53ef033ad3aba5bc00d920a369bed713119a28cc7d0605cf44c864809e377947ddd2f1f4821250013011255d59

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe

    Filesize

    68KB

    MD5

    673817504c0e713b7a129b10f989234b

    SHA1

    5ac4a174164f96c37f2874ecca75265a2c724e17

    SHA256

    16a76d3647550d7df559690fb4f7d78fdeb186e381c73f6d498b2ea677c9f954

    SHA512

    521c6fb74383b135fac8354b8015f5211fa36190264f02aac21ca64950ca56dc87784b3f7106c680005dd5cabb6cebd13050020bb707c5e34767da0f3973a6a2

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.txt

    Filesize

    62KB

    MD5

    22f56bc6881b3cd4dc601225f88f1718

    SHA1

    bf7a0f56600ad88db4c86aebda1279ac47c24de7

    SHA256

    7e4ea67d51cc9724d08e45e950edc3d234d9ebe4a857bb2fcdf8535979420b09

    SHA512

    935ade0f4c854b02cd00f2a8fbf8905d232cb3e39d4cb4b97dbcd0e7c53b5bc60024ae525801ea381fd779c012f9daee8ff05186099fc9417ce5a344bf33986b

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\libcurl.dll

    Filesize

    202KB

    MD5

    c3163857ded67fbb32e331b6a9e5f9fd

    SHA1

    69a5d372f6ed95e3ad636fa8a50632d484b0ddff

    SHA256

    e4e71b6f14eab7bc2828da4663014f30774d47e3df38935489fc2e58b8a03034

    SHA512

    b36bd85eb71e0dac81ff31c27c2ce69595c4180da62e6c97de1b0439e56e0e81cb749afdb29fbdef8b9d5238a5ab44087175a510177a1167c9ece9a53999ec94

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\libcurlpp.dll

    Filesize

    54KB

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\libstdc++-6.dll

    Filesize

    161KB

    MD5

    5698d18e3d3ed2393d1c00cda62fc207

    SHA1

    b6bd2150ff70dcb6532adcef345c2e28c40344b1

    SHA256

    26442877110c1cd9fdef7e0e51caa3d3b151961546ebe118b07edbea1a19fd34

    SHA512

    15ed55e212646aa0d734760f0fe324095e1bfc81d68da1ec7d7ce25978f200aa2716b1d5a4b2e1555624a618382aab7d49ed35660a0b076bf37208fb0961096b

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\libwinpthread-1.dll

    Filesize

    69KB

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    240KB

    MD5

    5efd6b5570e23453aaa50b560a6c8292

    SHA1

    683b715a4bb99185f98e09f931f176b783a00acf

    SHA256

    ddf3b16ea11b9603dcac87564c7c5b79ac0866edbdacc03627f16373dc696ac9

    SHA512

    322ced54bd0cb55d80236560895e731ebe40ff7749191209d000dcbf7a27b586eada69aa28f217dfc9adf4ac5395a1b02f1300842714aa45d2b27e50c8577a16

  • C:\Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    198KB

    MD5

    521ff7c038f21583fc2ae1991a9cdee7

    SHA1

    57aa05673d6e239390305ce4351314c32477b327

    SHA256

    4c88d02de019401658b60d5fafe16c359a079070d4a2af99f12e928628176801

    SHA512

    95e0e6c3870d2234f8a301f3076df9118c295c7d0a51ba2209a55a8e42dbedbc3960bd8d4d5f3c79b1708eb769b77268fdce609239c3ff07e95c84bbc38d3699

  • C:\Users\Admin\AppData\Local\Temp\Cab16DD.tmp

    Filesize

    46KB

    MD5

    98db76c8e6b13338e74648b64a13b515

    SHA1

    0daf8f11781d6c8bbd08aabd5ca7c3c9c1b6fdf0

    SHA256

    ca086479987108496fcb8d2c38daf1c9b82e7efdf6b1edf6fe8b35a095e7de77

    SHA512

    e0c29c57351b71e0bace0355def83d7405231c806f5bb5c06a70b65bd13f978068a98b8225bb8a1d67bb9f97ad87af2e4ef5e950eda5779d14b3d71a7d37eb67

  • C:\Users\Admin\AppData\Local\Temp\Tar16EF.tmp

    Filesize

    14KB

    MD5

    1e8b20372795fa0ed10d1389b1d3f98d

    SHA1

    7d1d29d62b6e7825c25788566ec2a454c50b3cd3

    SHA256

    d550cb63fc3fb003d634d58180d65fd8d125e92a3f1fc4957ecb64e36154413a

    SHA512

    3127a3a40e0065f7cfa5810b9dbc822e39fdeedcdc5a2cf809ea9d67d0af97d5944999014e365c15c247e2bfbb946c61d4d187e209ae1f0ee217a41ac9fdfcfa

  • C:\Users\Admin\AppData\Roaming\bdseghg

    Filesize

    328KB

    MD5

    6f7f47269f92b58955a6714ddba7fcd4

    SHA1

    e92a5ec35e1900af4849fe54da71abc939b58ab3

    SHA256

    2c7607aeadea3ed5a9c4f6c0f25b097d5219b2ed16697cd5bd06407906098569

    SHA512

    a04a2919ad8a21d994460c73ccd36e1694c101078126e9add60dced76b87efae2eb7f7c71f997779645fbef78c9aff8475943cc8b81e8c2830c90a695c9d4152

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.exe

    Filesize

    77KB

    MD5

    c55f8ac7a8058a8a0283dad67ba810c7

    SHA1

    22e2f0518492e0980ae32bdbb1a02e9d11846fe4

    SHA256

    2088f62fc338a59e8276a6805ec714650ea6b64fbd953c7d16611e46852e65be

    SHA512

    bbc9460bdd1d4366a0680417a9ee9f97a67eac1fdd8cd8829a7165dfed1f47319bae8d93c15f153203718325b2eecfb1e6b57a4c7396d980b5e2cc8f0dac9e36

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.exe

    Filesize

    38KB

    MD5

    a0f8faf48a33980f209e51ac24719395

    SHA1

    42abb2a5a5d55941f2e71dbbcd11e62e89a0714c

    SHA256

    4e291c56b7bb85b4bc5c480e59486f3fa4a1392fb9c9a2ec34cadb1b32e9dbdd

    SHA512

    8baa51fdd1b8070868371fc1fe698285f779533858955e2ec81a0acef2e9aafdeb89f9010c411e57f52abd08953299af90bc0a47023f024312346189c95ca6ea

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_1.exe

    Filesize

    122KB

    MD5

    2ac84e1643104aeba6d5ebfba9b79ec9

    SHA1

    b57e493e74c79ce6e6ac23138d6e5ef58d60c4c9

    SHA256

    f3f7a1386142729c0eb93a13dc842bad597336b3b37933000f1570800388bdb8

    SHA512

    cb29f595331d21a00c62ae4d2a08e15b5cc04354460fbcda2149133b0cba5ed75bd242501bbf4707bd24d64f5689056d130750c99a52137f8abc61ba3384949b

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe

    Filesize

    96KB

    MD5

    f289b5830d8808c38313aa7bb933f30c

    SHA1

    1c694b7bab7c42890fe39f37d88ec1048933d254

    SHA256

    18beb45b9ca65c8a623588c4ae8756d28c5e927550109a688a3043a218b00a10

    SHA512

    f2072e9303ecedb2db318c0276146c7ae57e6b31cc450a6d77d87cfa5b8925826c731d47906f2473400f446585902500b9faea90bfd406411fc51efe1b43f92d

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe

    Filesize

    72KB

    MD5

    bb9c2c4e75f0d55cd662689eebc87503

    SHA1

    6f28d684f75d7039a5319d6c013930131d578143

    SHA256

    b8dd36459f791626e380c4c8a22436e81685fd075ecc61d87624323cd69ce574

    SHA512

    63320acc5f7cde10c5c4ab8264c6af0db349fcf1124b409612c60b6b9c7ac1b4aa78172ada7f59eff4fc828c7d04baa8bfe948480e71653a157b89156c145f6e

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe

    Filesize

    45KB

    MD5

    b52d32c2525d3c2dde14afa3d94bbbcc

    SHA1

    70bad07391b873d34e101512291dfac74f15566d

    SHA256

    01812e7fc168ffa2417d665d85920e8b85b68a4d90728c817972f33c73dfb2de

    SHA512

    3230e8e8bddfe4d7a6caa90bb6ee902008b95703a2411326e8b432cf7d48cf300b4cc16e31676cb2c16878edc6a0a8c04045db702bff367cb4342fbc5e3206e9

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\karotima_2.exe

    Filesize

    40KB

    MD5

    16edc1fe116ba17b55649143b67ece97

    SHA1

    bc6020f22c6b95512f62d488054befc610c9365a

    SHA256

    27fabe55d17ed71542a92a50862d1c5d1e840e055236d28310a1146adae19556

    SHA512

    f33af7662faab86815cb98bedd5db5228b79615f000a89d29b886d1e5943ce5dce362932e6514b750c202a72c732ea737e098d83f9e859f2c9e032e51c7c7fc1

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\libcurl.dll

    Filesize

    218KB

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\libgcc_s_dw2-1.dll

    Filesize

    113KB

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\libstdc++-6.dll

    Filesize

    33KB

    MD5

    907daabc07dd7679466ffc04a1016546

    SHA1

    e1581a0d05a215c7ef409d4ca7ee7bd124b596b8

    SHA256

    5d04eddd9e446b689cc53da19c902837a4469c826af9d597d4c90f551ac37088

    SHA512

    830de0078080d9585ba292e5e65a81bf2c64e2daf12fd7644449c78b0a5d3216782f032153344b8536dee3fd3889957c2ed1a2181016169f80831532f93aaeb9

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    66KB

    MD5

    0752c09759625afa19bc9dacab286471

    SHA1

    07779301680fc6ec6aabf2d57cf80a954f757c6c

    SHA256

    d53d43a223a161bf460b2b8f5cad45ef2ca8f1fe866b4a2deff0ff693fc762cd

    SHA512

    cbf6e7c922b09080d63d6240d4900f11464c7657a6498e0c1785d0295a06076b61991f80ef416662cca0033a8674ff55e3bc6cd0368e1ec7192931ba636da6a1

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    106KB

    MD5

    1917efa13010aafdcd537629c9963f33

    SHA1

    5ecfd9b14198b0fd90bea16a025282bcecb2749d

    SHA256

    dceb58879e54d21c2c412c20191f584d554f1a4994d07e64274f85813caf6b0d

    SHA512

    82d6526868e1ac6b486071b7ebdc4c7c2150062a37f67f32aa4bc7874afe2d6e2cd47d0ea922c44cb76eba9d0cb9da835dad75135c087b54ad3742c0ddd7956e

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    96KB

    MD5

    fb22def72aecc5eaa171b2b655e76eec

    SHA1

    10cd514e63428fc6242e0cc6538b102f0aa96e4c

    SHA256

    36028ae198c63a787eb964cf5a127ca3258dd5f13133374192d52e543a8c9d69

    SHA512

    3e54dd2c1169f51cbd0d9de53762b7d5eb2d44ddb1b605879a678362919d2caef050a5d85049ba881c061b584fb87f017934ec16d8dfd757fd5e1da7ed5fa7a7

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    47KB

    MD5

    7f3f6e7c08cea0715d5de15a6b2f9b36

    SHA1

    8c823262ae9696d77699b2a1ae00c779b221ac25

    SHA256

    08064bf05d432c3b3eefcd64d91db39f372ea85ea731a6b4022b4d3547078714

    SHA512

    2d6d5b6c517f73922c41b363bee9fcaabd9ebe2ec91b1ce57997df90893427ee0658fcad530a8abd9d001ddd32e5c3b4c4d8e7741db1d9462bf9ad37433f0459

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    189KB

    MD5

    cd70cb6f94a8da052488d984788c0341

    SHA1

    7570fec07c930b0357f4652911011fcbcd806de8

    SHA256

    8d0880d085e29dc26aa4b2d3edd59500c994a94e7b977e94e6276f3398f25d25

    SHA512

    e49e6ea62efd3487670fc4f61cc3d21cdf0fb5a8f3149a2c661b312c03560c18c1ef9c97260fcd0110cf4eda02224535a2d33798706738092b69b41b5192b0e1

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    54KB

    MD5

    158bdae6a6dd61cb970916c9e9ef4049

    SHA1

    4f68a21e59954c082a7f98ec66aa372a4a05a5aa

    SHA256

    d547208f9efb577f75b4d665fc339022c76f8fc025bc44f7dfe5780dfa698712

    SHA512

    73c959d898de91853ef6e40c5bcb128adf5a5c1cffd570d52222f8ccd81e4f9f817b87c0430d4404b60dab117f398ef6077b28e90b871b1eec4e5eab00345547

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    287KB

    MD5

    525ac099d70602763bd7f9f9e8518b07

    SHA1

    e963393e9ec19249adea507cd54c731a16227980

    SHA256

    cc78e389c7a8fed598e312f2e150ffb8a99d9bffdfa4982bd59ae6ce7693efbf

    SHA512

    fc4cd5120656fd80f66e689786cbcce1d9259e0bb7b37f653b5e130463f128f38c024b0e84f8561bad48d7b066dd965a9a94a7bbcb0dbecb2bc3468902293d67

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    207KB

    MD5

    6173b976005581300028d02cb17bd546

    SHA1

    bf17e97d245c7426cf2d88974f537ae98a8b63cb

    SHA256

    0bd59952a52e335fd701ab7b91e8a3c3aec1fec872abb6f01ffd684725137d2e

    SHA512

    2d1d7ce297c01f2f878cbb1187185867098b88a545b3df8020f1cbf2c6b851e5af191cc4b68b4a0824db35a1b5272034d701121523426c5780a8d8397a4fd895

  • \Users\Admin\AppData\Local\Temp\7zS468D3636\setup_install.exe

    Filesize

    156KB

    MD5

    fe642e888f5114e72d5696204b3abd27

    SHA1

    131e544c299960ef5567e07d23e20c19569dc3b8

    SHA256

    33f3d3f64837379d8a4d079b047b770550309753fac84a89b1ad3501374f0c56

    SHA512

    eaad0142ab214df329148ae2581249ec7896ff6498ef760e13724bbf727c2e60bd782eb8425064752a244a79465bdcd2e4373b8f4c1293a1ab2e149d21674ba7

  • \Users\Admin\AppData\Local\Temp\CC4F.tmp

    Filesize

    79KB

    MD5

    159d4ed4362c3126b9e2a22b1da33671

    SHA1

    b656701935a104a11d00fa2d8faf03ef6f5ff1dd

    SHA256

    a7fea4af5b30d69847c11b3a589730d17a600f20fcf6cd5831a9a818e11d5cc7

    SHA512

    86ba602178f9c8009f7d4deeae6d270899c4b9842ccccc9f0c60d68f0d6e68283a3a4586f3da63fd45eca2dd604a0168bc112a8d9c7d41622b077175a639c95e

  • memory/1196-124-0x0000000002A70000-0x0000000002A85000-memory.dmp

    Filesize

    84KB

  • memory/2148-28-0x0000000002F30000-0x000000000304E000-memory.dmp

    Filesize

    1.1MB

  • memory/2148-26-0x0000000002F30000-0x000000000304E000-memory.dmp

    Filesize

    1.1MB

  • memory/2688-119-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2688-118-0x0000000000250000-0x0000000000259000-memory.dmp

    Filesize

    36KB

  • memory/2688-125-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2688-117-0x00000000008D0000-0x00000000009D0000-memory.dmp

    Filesize

    1024KB

  • memory/3028-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-65-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/3028-51-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/3028-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-58-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/3028-40-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/3028-59-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/3028-37-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/3028-60-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/3028-63-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-32-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-64-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-46-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-52-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-67-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-66-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-61-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-53-0x0000000000520000-0x000000000063E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-55-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-49-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/3028-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/3028-132-0x000000006EB40000-0x000000006EB63000-memory.dmp

    Filesize

    140KB

  • memory/3028-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/3028-130-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/3028-129-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/3028-128-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-47-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB