Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2023, 01:00

General

  • Target

    946669666cc16fe3efcdd943580b2cb17d08c978548a159f3fea4cb6f4753fcc.exe

  • Size

    873KB

  • MD5

    0a41714e22e71c225c553e006af08d69

  • SHA1

    3f2c0d80f9c12e460ab4ac288d75ea8d1679f4c9

  • SHA256

    946669666cc16fe3efcdd943580b2cb17d08c978548a159f3fea4cb6f4753fcc

  • SHA512

    1d565f8e12b4223904e456cad739fb6c51e4447065d630ea107d9d2f74963b5f76cc15554443a41ce5f5bdc92888bb4f52b05789e2cc110823cfcdde964974aa

  • SSDEEP

    24576:Oy2RxXW8AYZCVU4eVomPVGXxx8GQsQPfL:d2nHAY4V1w3PVOQG/Q

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

amadey

Version

3.68

C2

193.233.20.25/buH5N004d/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\946669666cc16fe3efcdd943580b2cb17d08c978548a159f3fea4cb6f4753fcc.exe
    "C:\Users\Admin\AppData\Local\Temp\946669666cc16fe3efcdd943580b2cb17d08c978548a159f3fea4cb6f4753fcc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptsD3577lU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptsD3577lU.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptzf1050yg.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptzf1050yg.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\beqG25LJ93.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\beqG25LJ93.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1760
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1080
            5⤵
            • Program crash
            PID:4580
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ctEO33Bn78.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ctEO33Bn78.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk29jH00vG24.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk29jH00vG24.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1396
          4⤵
          • Program crash
          PID:1552
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDR04jH19.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDR04jH19.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
        "C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "Admin:N"&&CACLS "ghaaer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\46aee2aca4" /P "Admin:N"&&CACLS "..\46aee2aca4" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1700
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4960
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "ghaaer.exe" /P "Admin:N"
              5⤵
                PID:4568
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "ghaaer.exe" /P "Admin:R" /E
                5⤵
                  PID:4872
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3376
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\46aee2aca4" /P "Admin:N"
                    5⤵
                      PID:4836
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\46aee2aca4" /P "Admin:R" /E
                      5⤵
                        PID:1920
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1760
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1760 -ip 1760
                1⤵
                  PID:752
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4900 -ip 4900
                  1⤵
                    PID:3700
                  • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
                    C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3804

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\46aee2aca4\ghaaer.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDR04jH19.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jxDR04jH19.exe

                    Filesize

                    235KB

                    MD5

                    5be5a732113282a7824ceb2a359b6468

                    SHA1

                    0d7b6225bfd5a5fea2d9895e1470e86a0dc2ddd7

                    SHA256

                    00b159ce6ab2aa22a678a455d978814597d59942345ad9491ab5dd6ff3066bee

                    SHA512

                    a36556727e948b7e0e8e6ab5d8bb80fbeffeff020bf38a6f61cd7b498052cbc4972282e5a66a0998e42363468cf89a3a9b9bd17bc56e4160e7462f9086fa656c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptsD3577lU.exe

                    Filesize

                    687KB

                    MD5

                    6c0a3d8ec9ee531356fef5ac758b4321

                    SHA1

                    aa1ac31ca0e1b884f24b41d69ec315cd9d54d416

                    SHA256

                    9cdf04f2c486ec5aee37c325ea19f942f7f614625fe24ee1b5a596eaad198974

                    SHA512

                    a10afe062b67e26f33f7aaf757a6b7fb3ff8e9aed9d7c4e0d9cd386779de6ad85803fd0cde23ea0f71be947f5cb72432978a7911f9902ee1b810bd0500ace8ff

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptsD3577lU.exe

                    Filesize

                    687KB

                    MD5

                    6c0a3d8ec9ee531356fef5ac758b4321

                    SHA1

                    aa1ac31ca0e1b884f24b41d69ec315cd9d54d416

                    SHA256

                    9cdf04f2c486ec5aee37c325ea19f942f7f614625fe24ee1b5a596eaad198974

                    SHA512

                    a10afe062b67e26f33f7aaf757a6b7fb3ff8e9aed9d7c4e0d9cd386779de6ad85803fd0cde23ea0f71be947f5cb72432978a7911f9902ee1b810bd0500ace8ff

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk29jH00vG24.exe

                    Filesize

                    317KB

                    MD5

                    951fa5356ac288731a279778680760cb

                    SHA1

                    ec2e18c615f5818742d946582d64e32bb88dbfbb

                    SHA256

                    f5f7055115e81907accaf5c574e871f2c009da8163df4d5930af1563f4f5b175

                    SHA512

                    b8385866f94ab644ad455571866080250acb23cb1d19208ec58cf316524e0b6c419620622c0fe0591b1ff0e3ee5a8e50a39ed0bc4a792ba4b9b903b0ed83d1c4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hk29jH00vG24.exe

                    Filesize

                    317KB

                    MD5

                    951fa5356ac288731a279778680760cb

                    SHA1

                    ec2e18c615f5818742d946582d64e32bb88dbfbb

                    SHA256

                    f5f7055115e81907accaf5c574e871f2c009da8163df4d5930af1563f4f5b175

                    SHA512

                    b8385866f94ab644ad455571866080250acb23cb1d19208ec58cf316524e0b6c419620622c0fe0591b1ff0e3ee5a8e50a39ed0bc4a792ba4b9b903b0ed83d1c4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptzf1050yg.exe

                    Filesize

                    344KB

                    MD5

                    c4a236610ba592545d8ba8f64cd8a8fc

                    SHA1

                    15c338991526abd075876e98a3486a16781ceb41

                    SHA256

                    098be4f14a0b0719fa63b1b2005599c31e8f2b1c2d6e1ff970c749b27ac97019

                    SHA512

                    07de2c5e3cf34b6d81d0f455b2aa60edf7e376a1ba9df273d7c32854346039ef9748e61bff3ed7906edd8ec1a6238b915f9fcace437c9b7ed2f239d4a2f40852

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ptzf1050yg.exe

                    Filesize

                    344KB

                    MD5

                    c4a236610ba592545d8ba8f64cd8a8fc

                    SHA1

                    15c338991526abd075876e98a3486a16781ceb41

                    SHA256

                    098be4f14a0b0719fa63b1b2005599c31e8f2b1c2d6e1ff970c749b27ac97019

                    SHA512

                    07de2c5e3cf34b6d81d0f455b2aa60edf7e376a1ba9df273d7c32854346039ef9748e61bff3ed7906edd8ec1a6238b915f9fcace437c9b7ed2f239d4a2f40852

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\beqG25LJ93.exe

                    Filesize

                    259KB

                    MD5

                    6bc8513cf7109e5ac11a3ce08bd4aa75

                    SHA1

                    c3ac687b5f1622ede490ea7503900c5fa192fd25

                    SHA256

                    5c740441af175fbb77d481aebd50b3598b387dabaf576e5607c0e5866f62c729

                    SHA512

                    b6e62cdbb3bb1dfd09ddab7f2befdd8225c61e143adcd20a9f23e38992057e3cc89e08370a36f5f1a2c9162f3498d7d6dfe025e1c783efb75380760ecfa6ae0a

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\beqG25LJ93.exe

                    Filesize

                    259KB

                    MD5

                    6bc8513cf7109e5ac11a3ce08bd4aa75

                    SHA1

                    c3ac687b5f1622ede490ea7503900c5fa192fd25

                    SHA256

                    5c740441af175fbb77d481aebd50b3598b387dabaf576e5607c0e5866f62c729

                    SHA512

                    b6e62cdbb3bb1dfd09ddab7f2befdd8225c61e143adcd20a9f23e38992057e3cc89e08370a36f5f1a2c9162f3498d7d6dfe025e1c783efb75380760ecfa6ae0a

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ctEO33Bn78.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ctEO33Bn78.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                    Filesize

                    89KB

                    MD5

                    29b9780bb2992d018ae312ed4180a663

                    SHA1

                    592a993f9518c1ceab3186a8b5007826fa204b60

                    SHA256

                    b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                    SHA512

                    988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                    Filesize

                    89KB

                    MD5

                    29b9780bb2992d018ae312ed4180a663

                    SHA1

                    592a993f9518c1ceab3186a8b5007826fa204b60

                    SHA256

                    b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                    SHA512

                    988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                    Filesize

                    89KB

                    MD5

                    29b9780bb2992d018ae312ed4180a663

                    SHA1

                    592a993f9518c1ceab3186a8b5007826fa204b60

                    SHA256

                    b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a

                    SHA512

                    988a85a0270759d2936e9ffcdf0b0543ad29a6be6342472e796b9ee2406730b8f892f9416fe385e58ecffc39862cc74604bc32a7920133209286ca20c0ac346d

                  • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                    Filesize

                    162B

                    MD5

                    1b7c22a214949975556626d7217e9a39

                    SHA1

                    d01c97e2944166ed23e47e4a62ff471ab8fa031f

                    SHA256

                    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                    SHA512

                    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                  • memory/1760-169-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-190-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-167-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-173-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-175-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-177-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-179-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-181-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-183-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-185-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-187-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-188-0x0000000000400000-0x0000000000584000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1760-189-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-171-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-191-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-193-0x0000000000400000-0x0000000000584000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1760-155-0x0000000004C50000-0x00000000051F4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1760-165-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-163-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-161-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-160-0x00000000024F0000-0x0000000002502000-memory.dmp

                    Filesize

                    72KB

                  • memory/1760-159-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-157-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-158-0x0000000004C40000-0x0000000004C50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1760-156-0x0000000000660000-0x000000000068D000-memory.dmp

                    Filesize

                    180KB

                  • memory/2932-197-0x00000000008D0000-0x00000000008DA000-memory.dmp

                    Filesize

                    40KB

                  • memory/4900-208-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-222-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-224-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-226-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-228-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-230-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-232-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-234-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-236-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-293-0x0000000000670000-0x00000000006BB000-memory.dmp

                    Filesize

                    300KB

                  • memory/4900-294-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4900-296-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4900-1112-0x0000000005300000-0x0000000005918000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4900-1113-0x0000000005980000-0x0000000005A8A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4900-1114-0x0000000005AC0000-0x0000000005AD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4900-1115-0x0000000005AE0000-0x0000000005B1C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4900-1116-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4900-1118-0x0000000005DE0000-0x0000000005E72000-memory.dmp

                    Filesize

                    584KB

                  • memory/4900-1119-0x0000000005E80000-0x0000000005EE6000-memory.dmp

                    Filesize

                    408KB

                  • memory/4900-1120-0x00000000067E0000-0x00000000069A2000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4900-1121-0x00000000069B0000-0x0000000006EDC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4900-1122-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4900-1123-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4900-1124-0x0000000007170000-0x00000000071E6000-memory.dmp

                    Filesize

                    472KB

                  • memory/4900-1125-0x00000000071F0000-0x0000000007240000-memory.dmp

                    Filesize

                    320KB

                  • memory/4900-220-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-218-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-216-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-214-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-212-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-210-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-206-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-203-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-204-0x0000000002440000-0x000000000247E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4900-1126-0x00000000023E0000-0x00000000023F0000-memory.dmp

                    Filesize

                    64KB