Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    103s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/03/2023, 02:10

General

  • Target

    ce4d560f1af01e44191efcad9f89ff136624f5454a9e3a64980a238855b75d99.exe

  • Size

    986KB

  • MD5

    c049f7849ee160726a6dc680849855f0

  • SHA1

    bdf745da29e625e0a81911c90fd1ad6984d04062

  • SHA256

    ce4d560f1af01e44191efcad9f89ff136624f5454a9e3a64980a238855b75d99

  • SHA512

    9af817f0cdf27c131bc93a521b4cb00d2f258430301e82214a04ca41bd4ecb68953edf50a026ec1602d0e41598191883af3a44f3705524c3bbdaac7e427a93d6

  • SSDEEP

    12288:KMrwy90GdKeEBbFyKzj7kdI0VKUBcR3RVNlPhRWMdIKah9kI1bFjwoGGNcWFY:+yrK7BjzjId9i3RV3PzBIKU9HjBVPY

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

amadey

Version

3.68

C2

193.233.20.25/buH5N004d/index.php

Extracted

Family

redline

Botnet

foksa

C2

hueref.eu:4162

Attributes
  • auth_value

    6a9b2601a21672b285de3ed41b5402e4

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce4d560f1af01e44191efcad9f89ff136624f5454a9e3a64980a238855b75d99.exe
    "C:\Users\Admin\AppData\Local\Temp\ce4d560f1af01e44191efcad9f89ff136624f5454a9e3a64980a238855b75d99.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pttT0913af.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pttT0913af.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptus3912Gp.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptus3912Gp.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptXc3777dM.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptXc3777dM.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4932
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\beeP16Bs42.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\beeP16Bs42.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4060
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ctXq25gd23.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ctXq25gd23.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drCW86Az75.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drCW86Az75.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk28Yl12mI87.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk28Yl12mI87.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
          "C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3364
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "Admin:N"&&CACLS "ghaaer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\46aee2aca4" /P "Admin:N"&&CACLS "..\46aee2aca4" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4480
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3392
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "ghaaer.exe" /P "Admin:N"
                6⤵
                  PID:3384
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "ghaaer.exe" /P "Admin:R" /E
                  6⤵
                    PID:4536
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:4892
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\46aee2aca4" /P "Admin:N"
                      6⤵
                        PID:4900
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\46aee2aca4" /P "Admin:R" /E
                        6⤵
                          PID:756
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:5080
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDa71Xm67.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDa71Xm67.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4180
              • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
                C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
                1⤵
                • Executes dropped EXE
                PID:4960

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDa71Xm67.exe

                Filesize

                175KB

                MD5

                75ced8ad0d8cd237ebc9cb7b00852651

                SHA1

                adab63df3e0a40fd9f170ab57da66f01f226141c

                SHA256

                a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

                SHA512

                f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDa71Xm67.exe

                Filesize

                175KB

                MD5

                75ced8ad0d8cd237ebc9cb7b00852651

                SHA1

                adab63df3e0a40fd9f170ab57da66f01f226141c

                SHA256

                a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

                SHA512

                f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pttT0913af.exe

                Filesize

                842KB

                MD5

                128e774c861d3610a5cc433b09ab0b62

                SHA1

                c7c2c861b0e516d3a0aaa709be8a3d61c4273cdf

                SHA256

                4806c70f2b6477d92660e569930858d04b34e73ac9b8c624002ae54e9436c440

                SHA512

                33f8e52e3279dd77cc7953e56cbde956bb1cafc531c0c559b49441b2cd55e999efcafd29d5a2ea40fac353ce8f8ffb9de65cbaebe4acbe3131e9dbec64d7d26f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pttT0913af.exe

                Filesize

                842KB

                MD5

                128e774c861d3610a5cc433b09ab0b62

                SHA1

                c7c2c861b0e516d3a0aaa709be8a3d61c4273cdf

                SHA256

                4806c70f2b6477d92660e569930858d04b34e73ac9b8c624002ae54e9436c440

                SHA512

                33f8e52e3279dd77cc7953e56cbde956bb1cafc531c0c559b49441b2cd55e999efcafd29d5a2ea40fac353ce8f8ffb9de65cbaebe4acbe3131e9dbec64d7d26f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk28Yl12mI87.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk28Yl12mI87.exe

                Filesize

                235KB

                MD5

                5be5a732113282a7824ceb2a359b6468

                SHA1

                0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                SHA256

                00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                SHA512

                a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptus3912Gp.exe

                Filesize

                655KB

                MD5

                97315e58ded1b0ef7c78769c87950326

                SHA1

                7f05aca0eca103bc9abd17157012e6bf32a3e259

                SHA256

                a996e054735d0a81946bc479b3da9166f10a896bf59c17a2f42e6445860e88fb

                SHA512

                cb7772a0010bd387f6b4b24e3a76e5ea054c967376515f8da0c870a1451e8e3b79239b9c3482c5e2e83fa767712db1efebfa6986d26e822a22b1ee8ef3218732

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptus3912Gp.exe

                Filesize

                655KB

                MD5

                97315e58ded1b0ef7c78769c87950326

                SHA1

                7f05aca0eca103bc9abd17157012e6bf32a3e259

                SHA256

                a996e054735d0a81946bc479b3da9166f10a896bf59c17a2f42e6445860e88fb

                SHA512

                cb7772a0010bd387f6b4b24e3a76e5ea054c967376515f8da0c870a1451e8e3b79239b9c3482c5e2e83fa767712db1efebfa6986d26e822a22b1ee8ef3218732

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drCW86Az75.exe

                Filesize

                290KB

                MD5

                1ef58e21a15e90d73d400e2b62b17256

                SHA1

                5ac56358af1c665c89dda115587a5360fecb841a

                SHA256

                1406756fb455734d1a168cecfb2312e43937ed84153f6578d11d8c30729af209

                SHA512

                302fda42de2c9fa1ba22f4be5630b25c33abcacf576b040abf5df26f9acefb68f5eeddcc21bac6086d9e43fd92dfe31969251f2b74de2e441c0cce7cf9cd08f8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drCW86Az75.exe

                Filesize

                290KB

                MD5

                1ef58e21a15e90d73d400e2b62b17256

                SHA1

                5ac56358af1c665c89dda115587a5360fecb841a

                SHA256

                1406756fb455734d1a168cecfb2312e43937ed84153f6578d11d8c30729af209

                SHA512

                302fda42de2c9fa1ba22f4be5630b25c33abcacf576b040abf5df26f9acefb68f5eeddcc21bac6086d9e43fd92dfe31969251f2b74de2e441c0cce7cf9cd08f8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptXc3777dM.exe

                Filesize

                327KB

                MD5

                759e2074c83c8510f7c64edc2128f870

                SHA1

                2c302d779b0891c1118571fc1c7657ce5d65ba5c

                SHA256

                f0337ac0f4c1baca3475d2a27491b86f1ffeab45d1f8b67e21aa38cfeab9179d

                SHA512

                f82a90ad4c57c31750707313d64bf6c0dd027c229815677e3263609852a8717fc719edcfb0ab8db9ee5804000151d9392a6a972eea6c50096fee94201cf0fc3e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ptXc3777dM.exe

                Filesize

                327KB

                MD5

                759e2074c83c8510f7c64edc2128f870

                SHA1

                2c302d779b0891c1118571fc1c7657ce5d65ba5c

                SHA256

                f0337ac0f4c1baca3475d2a27491b86f1ffeab45d1f8b67e21aa38cfeab9179d

                SHA512

                f82a90ad4c57c31750707313d64bf6c0dd027c229815677e3263609852a8717fc719edcfb0ab8db9ee5804000151d9392a6a972eea6c50096fee94201cf0fc3e

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\beeP16Bs42.exe

                Filesize

                232KB

                MD5

                db3ab3357fc347e4ca262d7a8cf6f90f

                SHA1

                517fef5bb4d3246dd817765cdb7747b0580973b4

                SHA256

                e03720c814f0a4c343c5f49e4d8e53f9ee71d7a6412c93b5bdb1ac58e80eddad

                SHA512

                f7d7b8e7850b0f00381619e1f8776d1885e43f489b4786daaeea4a5a8b2d278b10cc0a693b32ff4023bbee1e8a6f8e51e227ce97ac8a0d201f8f43efe772e97f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\beeP16Bs42.exe

                Filesize

                232KB

                MD5

                db3ab3357fc347e4ca262d7a8cf6f90f

                SHA1

                517fef5bb4d3246dd817765cdb7747b0580973b4

                SHA256

                e03720c814f0a4c343c5f49e4d8e53f9ee71d7a6412c93b5bdb1ac58e80eddad

                SHA512

                f7d7b8e7850b0f00381619e1f8776d1885e43f489b4786daaeea4a5a8b2d278b10cc0a693b32ff4023bbee1e8a6f8e51e227ce97ac8a0d201f8f43efe772e97f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ctXq25gd23.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ctXq25gd23.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                29b9780bb2992d018ae312ed4180a663

                SHA1

                592a993f9518c1ceab3186a8b5007826fa204b60

                SHA256

                b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                SHA512

                988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                29b9780bb2992d018ae312ed4180a663

                SHA1

                592a993f9518c1ceab3186a8b5007826fa204b60

                SHA256

                b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                SHA512

                988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

              • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                Filesize

                89KB

                MD5

                29b9780bb2992d018ae312ed4180a663

                SHA1

                592a993f9518c1ceab3186a8b5007826fa204b60

                SHA256

                b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                SHA512

                988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

              • memory/1316-1118-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-273-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1126-0x0000000007920000-0x0000000007E4C000-memory.dmp

                Filesize

                5.2MB

              • memory/1316-1125-0x0000000007710000-0x00000000078D2000-memory.dmp

                Filesize

                1.8MB

              • memory/1316-1124-0x00000000076B0000-0x0000000007700000-memory.dmp

                Filesize

                320KB

              • memory/1316-1123-0x0000000002180000-0x00000000021F6000-memory.dmp

                Filesize

                472KB

              • memory/1316-1122-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1121-0x0000000006250000-0x00000000062E2000-memory.dmp

                Filesize

                584KB

              • memory/1316-1120-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                Filesize

                408KB

              • memory/1316-1119-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1117-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1115-0x0000000005A20000-0x0000000005A6B000-memory.dmp

                Filesize

                300KB

              • memory/1316-1114-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1113-0x0000000004C60000-0x0000000004C9E000-memory.dmp

                Filesize

                248KB

              • memory/1316-198-0x0000000002130000-0x0000000002176000-memory.dmp

                Filesize

                280KB

              • memory/1316-199-0x00000000024C0000-0x0000000002504000-memory.dmp

                Filesize

                272KB

              • memory/1316-200-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-201-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-203-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-205-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-207-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-209-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-211-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-213-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-215-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-217-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-219-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-221-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-223-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-225-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-227-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-229-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-231-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-233-0x00000000024C0000-0x00000000024FE000-memory.dmp

                Filesize

                248KB

              • memory/1316-272-0x00000000006B0000-0x00000000006FB000-memory.dmp

                Filesize

                300KB

              • memory/1316-1112-0x0000000004C40000-0x0000000004C52000-memory.dmp

                Filesize

                72KB

              • memory/1316-277-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-275-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                Filesize

                64KB

              • memory/1316-1110-0x0000000005200000-0x0000000005806000-memory.dmp

                Filesize

                6.0MB

              • memory/1316-1111-0x0000000005810000-0x000000000591A000-memory.dmp

                Filesize

                1.0MB

              • memory/4060-165-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-156-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-171-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-150-0x0000000000580000-0x00000000005AD000-memory.dmp

                Filesize

                180KB

              • memory/4060-173-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-167-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-175-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-188-0x0000000000400000-0x000000000057E000-memory.dmp

                Filesize

                1.5MB

              • memory/4060-186-0x0000000004C20000-0x0000000004C30000-memory.dmp

                Filesize

                64KB

              • memory/4060-185-0x0000000004C20000-0x0000000004C30000-memory.dmp

                Filesize

                64KB

              • memory/4060-184-0x0000000000400000-0x000000000057E000-memory.dmp

                Filesize

                1.5MB

              • memory/4060-183-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-181-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-179-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-169-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-161-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-177-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-159-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-157-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-163-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

                Filesize

                72KB

              • memory/4060-155-0x0000000004C20000-0x0000000004C30000-memory.dmp

                Filesize

                64KB

              • memory/4060-151-0x00000000022F0000-0x000000000230A000-memory.dmp

                Filesize

                104KB

              • memory/4060-152-0x0000000004C30000-0x000000000512E000-memory.dmp

                Filesize

                5.0MB

              • memory/4060-153-0x0000000004AA0000-0x0000000004AB8000-memory.dmp

                Filesize

                96KB

              • memory/4060-154-0x0000000004C20000-0x0000000004C30000-memory.dmp

                Filesize

                64KB

              • memory/4180-1144-0x00000000050E0000-0x00000000050F0000-memory.dmp

                Filesize

                64KB

              • memory/4180-1143-0x0000000004F20000-0x0000000004F6B000-memory.dmp

                Filesize

                300KB

              • memory/4180-1142-0x00000000004E0000-0x0000000000512000-memory.dmp

                Filesize

                200KB

              • memory/4704-192-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

                Filesize

                40KB