Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 00:07

General

  • Target

    a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe

  • Size

    367KB

  • MD5

    47003e6a14a32ce0c0a7a83d1cf5cfe8

  • SHA1

    5bca37d70d3cc7da571d6b37f6d345162f55e9a0

  • SHA256

    a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7

  • SHA512

    a2c47ce4cee1d867ba61debe8c8a06c2610a38bcbbeaf195268ae83a81ff3e18043ad724fd2bfb78f8a26a661d478a9674acfaa7c305ebcf730c04aa354e659b

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZ9wA36TVgoD/4qtv+j:/n8yN0Mr8Z9BqTVgoD4K2j

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 52 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
    "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1732
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
        "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
            "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                7⤵
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2384
                • C:\Users\Public\Microsoft Build\Isass.exe
                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2408
                  • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                    "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                    9⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2376
                    • C:\Users\Public\Microsoft Build\Isass.exe
                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                      10⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2436
                      • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                        "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                        11⤵
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2412
                        • C:\Users\Public\Microsoft Build\Isass.exe
                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                          12⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2132
                          • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                            "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                            13⤵
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2244
                            • C:\Users\Public\Microsoft Build\Isass.exe
                              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                              14⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:864
                              • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                15⤵
                                • Loads dropped DLL
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1240
                                • C:\Users\Public\Microsoft Build\Isass.exe
                                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2608
                                  • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                    17⤵
                                    • Loads dropped DLL
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2116
                                    • C:\Users\Public\Microsoft Build\Isass.exe
                                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1516
                                      • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                        19⤵
                                        • Loads dropped DLL
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2144
                                        • C:\Users\Public\Microsoft Build\Isass.exe
                                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1564
                                          • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                            21⤵
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1792
                                            • C:\Users\Public\Microsoft Build\Isass.exe
                                              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2128
                                              • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                                23⤵
                                                • Loads dropped DLL
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2272
                                                • C:\Users\Public\Microsoft Build\Isass.exe
                                                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2560
                                                  • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                                    25⤵
                                                    • Loads dropped DLL
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2024
                                                    • C:\Users\Public\Microsoft Build\Isass.exe
                                                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2912
                                                      • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                                        27⤵
                                                        • Loads dropped DLL
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2704
                                                        • C:\Users\Public\Microsoft Build\Isass.exe
                                                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1616
                                                          • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a861cf11db05c018ac8074c1aaba4a165c8f262fd9e968eda282da0ede9726b7.exe

    Filesize

    143KB

    MD5

    38f108cddb6619fba80f8382d5227ece

    SHA1

    12fd277bf756f22cfae3043900e4aff8b9f05ed9

    SHA256

    8296fe257b8c34398e3f291764454ec3cd9cbe06d60989b632ef4ba6c73ae5dc

    SHA512

    3db732c23f10122c78cffc6b6a5b11836ade1a23f5c6f9a192f2be2fa99c5bd7afb7a9e29c5d518a888cdd2091f9ac41b244214be226152830e96f5ec2cca424

  • \Users\Public\Microsoft Build\Isass.exe

    Filesize

    216KB

    MD5

    a92fd1818bc42eb1711028effd4bd1bd

    SHA1

    f5ffb2e8578588b5445d98d31936c644c10d9388

    SHA256

    2dfe42e4a995abebe4d67009205c3b2274afe39fc796bf22e23832edc0564847

    SHA512

    80d8fc9b1369d644bd362bd8f4d5ebdad041d083ef994797429cd5ffb9a3a19005600f1869eb884d49cb81a191f5233efa6fd79562463372bbb095c52f21fa59

  • memory/864-53-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1240-57-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1240-58-0x0000000004C10000-0x0000000005EB9000-memory.dmp

    Filesize

    18.7MB

  • memory/1240-55-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1516-69-0x0000000004FE0000-0x0000000006289000-memory.dmp

    Filesize

    18.7MB

  • memory/1516-67-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1564-73-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1564-77-0x0000000004F50000-0x00000000061F9000-memory.dmp

    Filesize

    18.7MB

  • memory/1564-75-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/1616-108-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-115-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-166-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-136-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-128-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-127-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-120-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-119-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-46-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/1732-95-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-143-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-144-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-152-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-153-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-179-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-165-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-137-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1732-20-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1792-78-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1936-110-0x00000000044F0000-0x0000000005799000-memory.dmp

    Filesize

    18.7MB

  • memory/1936-15-0x00000000044F0000-0x0000000005799000-memory.dmp

    Filesize

    18.7MB

  • memory/1936-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1936-13-0x00000000044F0000-0x0000000005799000-memory.dmp

    Filesize

    18.7MB

  • memory/1936-8-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1948-112-0x0000000000960000-0x0000000000988000-memory.dmp

    Filesize

    160KB

  • memory/1948-113-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2024-91-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2024-94-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2116-65-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2128-82-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2128-80-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2128-81-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2128-83-0x0000000005550000-0x00000000067F9000-memory.dmp

    Filesize

    18.7MB

  • memory/2132-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2144-72-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2144-114-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2244-51-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2272-87-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2272-85-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2272-88-0x0000000004B70000-0x0000000005E19000-memory.dmp

    Filesize

    18.7MB

  • memory/2376-39-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2384-35-0x0000000004BD0000-0x0000000005E79000-memory.dmp

    Filesize

    18.7MB

  • memory/2384-32-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-31-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2408-38-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2408-40-0x0000000005080000-0x0000000006329000-memory.dmp

    Filesize

    18.7MB

  • memory/2412-42-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2412-45-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2412-52-0x0000000004BB0000-0x0000000005E59000-memory.dmp

    Filesize

    18.7MB

  • memory/2412-48-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2436-41-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2496-26-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2560-90-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2580-109-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2580-21-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2608-61-0x0000000005490000-0x0000000006739000-memory.dmp

    Filesize

    18.7MB

  • memory/2608-60-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2608-59-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2624-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2632-27-0x0000000005190000-0x0000000006439000-memory.dmp

    Filesize

    18.7MB

  • memory/2632-101-0x0000000005190000-0x0000000006439000-memory.dmp

    Filesize

    18.7MB

  • memory/2632-22-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2704-100-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2704-98-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2704-116-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2912-96-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2936-16-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB