Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    109s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/03/2023, 19:20

General

  • Target

    a3c982576f0f2abd6961e6491241770f8c5172ccc34f3b503ef6ec44fc5d1240.exe

  • Size

    990KB

  • MD5

    6ea83d43207d1ebcd8c535004b5eb346

  • SHA1

    4f6d633951d3bed583cd0b5c9509e53dc5b83dfc

  • SHA256

    a3c982576f0f2abd6961e6491241770f8c5172ccc34f3b503ef6ec44fc5d1240

  • SHA512

    997e3e39fab3871d5714c23f270e7e7e09d80d9ffaff6976f659aa03196121def6dfca4e6b6ec813ea8ade5ab68d21ab7bc244bd0b4743e8d8f4f0657644f143

  • SSDEEP

    12288:tMr2y90IrEkkFDbQpliPZlrovFWdM4VV7UHKriOlQFvPm63aNJe0Q71vF67m4tRx:PyZYB8FgM4H7eTF3m63Lc7mmkpx2bj

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lino

C2

176.113.115.145:4125

Attributes
  • auth_value

    ac19251c9237676a0dd7d46d3f536e96

Extracted

Family

amadey

Version

3.69

C2

193.233.20.36/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3c982576f0f2abd6961e6491241770f8c5172ccc34f3b503ef6ec44fc5d1240.exe
    "C:\Users\Admin\AppData\Local\Temp\a3c982576f0f2abd6961e6491241770f8c5172ccc34f3b503ef6ec44fc5d1240.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5136.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5136.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9232.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9232.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9462.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9462.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4069.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4069.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2472
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9660ZM.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9660ZM.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4456
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47vm61.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47vm61.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xiolD54.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xiolD54.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1004
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49sM37.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49sM37.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3440
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5028
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:4968
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:5004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:5020
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c5d2db5804" /P "Admin:N"
                    5⤵
                      PID:4948
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c5d2db5804" /P "Admin:R" /E
                      5⤵
                        PID:4980
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3344
              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:4288
              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:3316

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49sM37.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y49sM37.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5136.exe

                Filesize

                806KB

                MD5

                a6f679464c5fb2f767ff46ca1c1c1490

                SHA1

                921a91d5d810f2709fe26f179fd2409a7156f55d

                SHA256

                30ef4c11dc375f0ddad22013eb96d583dafdffc3aaec97bda6ff6c1cd1d4b70e

                SHA512

                4bdd51172632bebc5f36258b547ccc53240f92edc3ca1162b41b4b1f7f39dcd06a3d49be7f28849fd00c28eea95b0598c1c7b12d73907c362749bbc65c87e339

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5136.exe

                Filesize

                806KB

                MD5

                a6f679464c5fb2f767ff46ca1c1c1490

                SHA1

                921a91d5d810f2709fe26f179fd2409a7156f55d

                SHA256

                30ef4c11dc375f0ddad22013eb96d583dafdffc3aaec97bda6ff6c1cd1d4b70e

                SHA512

                4bdd51172632bebc5f36258b547ccc53240f92edc3ca1162b41b4b1f7f39dcd06a3d49be7f28849fd00c28eea95b0598c1c7b12d73907c362749bbc65c87e339

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xiolD54.exe

                Filesize

                175KB

                MD5

                f61daa8e8cc475f529849874911c5a2d

                SHA1

                41569b2e0ea6add44d5abd9da4378d4397186ae3

                SHA256

                3984255901866f3aea55a4f77c30978accf9e851e3966f61561d4301233fa407

                SHA512

                a7fcfc237880f3a51c3d0f248e4f973fd23d7f8f24df94d8ea16fde1ab155cddbb5524a0fc287859cc7b96bc7e838480fb2c286e90cdd399a7d6925c21bb9a88

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xiolD54.exe

                Filesize

                175KB

                MD5

                f61daa8e8cc475f529849874911c5a2d

                SHA1

                41569b2e0ea6add44d5abd9da4378d4397186ae3

                SHA256

                3984255901866f3aea55a4f77c30978accf9e851e3966f61561d4301233fa407

                SHA512

                a7fcfc237880f3a51c3d0f248e4f973fd23d7f8f24df94d8ea16fde1ab155cddbb5524a0fc287859cc7b96bc7e838480fb2c286e90cdd399a7d6925c21bb9a88

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9232.exe

                Filesize

                664KB

                MD5

                18c3b46b5cf7274593f7fadc43bf8dc2

                SHA1

                dfcde69644b852cf7eaa06522d35bde549638f57

                SHA256

                d6b01375ebbe4a0f99660af98afe849a63732ac386cd4d01f2b9371c3176e494

                SHA512

                0144a6dc7c72dd3c5ac3b2bdb1f888d50ddbfcd67abee7612f5422c4c0caa8ff23a9dd450be31e20929cceb1c5a24f44f110e35b9e279235218f7a37c77b0a95

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9232.exe

                Filesize

                664KB

                MD5

                18c3b46b5cf7274593f7fadc43bf8dc2

                SHA1

                dfcde69644b852cf7eaa06522d35bde549638f57

                SHA256

                d6b01375ebbe4a0f99660af98afe849a63732ac386cd4d01f2b9371c3176e494

                SHA512

                0144a6dc7c72dd3c5ac3b2bdb1f888d50ddbfcd67abee7612f5422c4c0caa8ff23a9dd450be31e20929cceb1c5a24f44f110e35b9e279235218f7a37c77b0a95

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47vm61.exe

                Filesize

                335KB

                MD5

                8c8f37fcf3d51110ce67a9ec79f366d5

                SHA1

                af6e657498f39bdafbcddf84056923930791c7c9

                SHA256

                494108ab690e840868fdf030933676c01890bd07f35359ac3186011f4021375f

                SHA512

                03f005ff963de7f94f4540b75b3382e56dd81985eeb77971c5db0e89f786eec20c11515f4ec89ba0d3d59585e1a7b326b7448666209313c141b3c7a9c6cedd68

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w47vm61.exe

                Filesize

                335KB

                MD5

                8c8f37fcf3d51110ce67a9ec79f366d5

                SHA1

                af6e657498f39bdafbcddf84056923930791c7c9

                SHA256

                494108ab690e840868fdf030933676c01890bd07f35359ac3186011f4021375f

                SHA512

                03f005ff963de7f94f4540b75b3382e56dd81985eeb77971c5db0e89f786eec20c11515f4ec89ba0d3d59585e1a7b326b7448666209313c141b3c7a9c6cedd68

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9462.exe

                Filesize

                329KB

                MD5

                2ee532ab272d5a0b0925b2471ada5f2d

                SHA1

                4390782a6fddf2e84d2aea74b8b871dad17c7b74

                SHA256

                5f6811aaf9bc9fdb0fee01664808b117bd215f5d41686bcffa3709e00e58bea9

                SHA512

                ed9c790c3ca74d09725e360c44ebb5c4f83299c25acaf7bf26f007de4f24382dce894f3c14495c94ef029d8145abfd4e6f7b455c7b34cd81868ab0baa8c18a4b

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9462.exe

                Filesize

                329KB

                MD5

                2ee532ab272d5a0b0925b2471ada5f2d

                SHA1

                4390782a6fddf2e84d2aea74b8b871dad17c7b74

                SHA256

                5f6811aaf9bc9fdb0fee01664808b117bd215f5d41686bcffa3709e00e58bea9

                SHA512

                ed9c790c3ca74d09725e360c44ebb5c4f83299c25acaf7bf26f007de4f24382dce894f3c14495c94ef029d8145abfd4e6f7b455c7b34cd81868ab0baa8c18a4b

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4069.exe

                Filesize

                12KB

                MD5

                f85901fcc83414178c8a881836b4b2c5

                SHA1

                f0fb83bc0001f02bb667eadcd304d94256c185dd

                SHA256

                aa711fb69f762623c2f61665c13a2e430d89bc81e418385b89da18e34073121c

                SHA512

                650a42f98f4439662df4bc0a4d04eab932e16914087d7af64c00bd40529178086cadf47469f8522d8250e432495f1856948ed739c46999e5fe05dd217d28e489

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4069.exe

                Filesize

                12KB

                MD5

                f85901fcc83414178c8a881836b4b2c5

                SHA1

                f0fb83bc0001f02bb667eadcd304d94256c185dd

                SHA256

                aa711fb69f762623c2f61665c13a2e430d89bc81e418385b89da18e34073121c

                SHA512

                650a42f98f4439662df4bc0a4d04eab932e16914087d7af64c00bd40529178086cadf47469f8522d8250e432495f1856948ed739c46999e5fe05dd217d28e489

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9660ZM.exe

                Filesize

                276KB

                MD5

                c0d3728673ffc559356c4d6fb0ce91b8

                SHA1

                e6b33aeda15350fbf4f77c614c28e6043ee74df3

                SHA256

                64893991b750ed6b02099d569f2f185e8a343cdfe60fceea9dff76a070644e0c

                SHA512

                36ae145e9bdd45ae72bf56bcf9c3af0b11e7d50693a5924bb4cd76efca58a0f866052ee2046ebc13a60e8c62a8eec99a71d31ec93e4cccf596dd68e0eb5623c8

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9660ZM.exe

                Filesize

                276KB

                MD5

                c0d3728673ffc559356c4d6fb0ce91b8

                SHA1

                e6b33aeda15350fbf4f77c614c28e6043ee74df3

                SHA256

                64893991b750ed6b02099d569f2f185e8a343cdfe60fceea9dff76a070644e0c

                SHA512

                36ae145e9bdd45ae72bf56bcf9c3af0b11e7d50693a5924bb4cd76efca58a0f866052ee2046ebc13a60e8c62a8eec99a71d31ec93e4cccf596dd68e0eb5623c8

              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

                Filesize

                237KB

                MD5

                4bec01c316fa2bfcc32a34fc13db2803

                SHA1

                bed52547d9df5e78324e59bb2c7ea0cce2a7726f

                SHA256

                58ab37abf60cc9edd0acab7fd3130ebb2c796448713c00b2882334356455fbba

                SHA512

                ba4f4e021c07d76eac7910ea4085ae9fdaeed96be31756e8faf5f259205f62deffb56671d67ac7f949595760ab3100c569a19236351a74ec1cc6f19d6cb719f1

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                6a4c2f2b6e1bbce94b4d00e91e690d0d

                SHA1

                f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

                SHA256

                8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

                SHA512

                8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                6a4c2f2b6e1bbce94b4d00e91e690d0d

                SHA1

                f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

                SHA256

                8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

                SHA512

                8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                Filesize

                89KB

                MD5

                6a4c2f2b6e1bbce94b4d00e91e690d0d

                SHA1

                f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

                SHA256

                8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

                SHA512

                8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

              • memory/1004-1130-0x00000000050D0000-0x00000000050E0000-memory.dmp

                Filesize

                64KB

              • memory/1004-1129-0x0000000000830000-0x0000000000862000-memory.dmp

                Filesize

                200KB

              • memory/1004-1131-0x0000000005270000-0x00000000052BB000-memory.dmp

                Filesize

                300KB

              • memory/2472-144-0x0000000000BF0000-0x0000000000BFA000-memory.dmp

                Filesize

                40KB

              • memory/3064-1116-0x0000000008A60000-0x0000000008C22000-memory.dmp

                Filesize

                1.8MB

              • memory/3064-428-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1123-0x00000000096B0000-0x0000000009700000-memory.dmp

                Filesize

                320KB

              • memory/3064-1122-0x0000000009620000-0x0000000009696000-memory.dmp

                Filesize

                472KB

              • memory/3064-1121-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1120-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1119-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1118-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1117-0x0000000008C30000-0x000000000915C000-memory.dmp

                Filesize

                5.2MB

              • memory/3064-1115-0x0000000008350000-0x00000000083B6000-memory.dmp

                Filesize

                408KB

              • memory/3064-1114-0x00000000082B0000-0x0000000008342000-memory.dmp

                Filesize

                584KB

              • memory/3064-196-0x00000000049C0000-0x0000000004A06000-memory.dmp

                Filesize

                280KB

              • memory/3064-195-0x0000000002DA0000-0x0000000002DEB000-memory.dmp

                Filesize

                300KB

              • memory/3064-197-0x0000000007600000-0x0000000007644000-memory.dmp

                Filesize

                272KB

              • memory/3064-198-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-199-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-201-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-203-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-205-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-207-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-209-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-211-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-213-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-215-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-217-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-219-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-221-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-223-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-225-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-227-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-229-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-231-0x0000000007600000-0x000000000763F000-memory.dmp

                Filesize

                252KB

              • memory/3064-426-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1112-0x0000000008120000-0x000000000816B000-memory.dmp

                Filesize

                300KB

              • memory/3064-430-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/3064-1107-0x00000000077E0000-0x0000000007DE6000-memory.dmp

                Filesize

                6.0MB

              • memory/3064-1108-0x0000000007E70000-0x0000000007F7A000-memory.dmp

                Filesize

                1.0MB

              • memory/3064-1109-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

                Filesize

                72KB

              • memory/3064-1110-0x0000000007FD0000-0x000000000800E000-memory.dmp

                Filesize

                248KB

              • memory/3064-1111-0x0000000004A00000-0x0000000004A10000-memory.dmp

                Filesize

                64KB

              • memory/4456-170-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-152-0x0000000004920000-0x0000000004938000-memory.dmp

                Filesize

                96KB

              • memory/4456-178-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-174-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-190-0x0000000000400000-0x0000000002B73000-memory.dmp

                Filesize

                39.4MB

              • memory/4456-189-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-186-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-188-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-185-0x0000000000400000-0x0000000002B73000-memory.dmp

                Filesize

                39.4MB

              • memory/4456-184-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-182-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-166-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-176-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-180-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-172-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-164-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-162-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-160-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-158-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-157-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-156-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-155-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-154-0x0000000007400000-0x0000000007410000-memory.dmp

                Filesize

                64KB

              • memory/4456-153-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/4456-168-0x0000000004920000-0x0000000004932000-memory.dmp

                Filesize

                72KB

              • memory/4456-151-0x0000000007410000-0x000000000790E000-memory.dmp

                Filesize

                5.0MB

              • memory/4456-150-0x00000000046C0000-0x00000000046DA000-memory.dmp

                Filesize

                104KB