Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 00:06

General

  • Target

    9296e761af1c81681bec18fac3aa28a1.exe

  • Size

    1.0MB

  • MD5

    9296e761af1c81681bec18fac3aa28a1

  • SHA1

    4922a6aaeaf06487987bc9c61f549e65ac1f7c3f

  • SHA256

    0674bd5e0f40dfbfa7186f3d36da8f5cd9b86ca04625b3db609879bb7734c237

  • SHA512

    e27b065d4921454668f4be39b99caa32b9dc3e689d209551362cf4330b10070595e56385f80bff2658318669799421ac9a42488440aa6da5ca7fb5618be8f66a

  • SSDEEP

    24576:9yUNj1aELymFZS82gDOXnSFKbreNPRWR2FWX0OFTt6Lp7H:YUREqZS826ASFKbrytFO0OFTM

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Extracted

Family

redline

Botnet

Heaven

C2

103.161.170.185:33621

Attributes
  • auth_value

    0dbeabaddb415a98dbde3a27af173ac5

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9296e761af1c81681bec18fac3aa28a1.exe
    "C:\Users\Admin\AppData\Local\Temp\9296e761af1c81681bec18fac3aa28a1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za091298.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za091298.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za609436.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za609436.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\86921683.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\86921683.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1508
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1084
            5⤵
            • Program crash
            PID:4240
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w02jY65.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w02jY65.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5064
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1320
            5⤵
            • Program crash
            PID:2816
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwsyb11.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwsyb11.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3808
          • C:\Users\Admin\AppData\Local\Temp\1000036001\Heaven.exe
            "C:\Users\Admin\AppData\Local\Temp\1000036001\Heaven.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5056
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:2448
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys048763.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys048763.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1180
        3⤵
        • Program crash
        PID:4128
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 1508
    1⤵
      PID:1884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5064 -ip 5064
      1⤵
        PID:3488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3860 -ip 3860
        1⤵
          PID:1656
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:1704
        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
          1⤵
          • Executes dropped EXE
          PID:3524

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1000036001\Heaven.exe

          Filesize

          168KB

          MD5

          f4d7b11b0ec08ccde605cc48e5ea47d6

          SHA1

          ebb3a1f2348f18fe1d11fcb7ac062629fbda87a1

          SHA256

          0e45e21d3dfe4d9ae96040530c11c82495ade46d7409cecf7a1374e47a23dd30

          SHA512

          6f67a202416193829e41e0f798dd5d7539d6ba0dca047d49ea5997866ded94a6b36a813b06eaf1496ac4ea50bbcce97bd411dbafef601ff1f593808e49f9debb

        • C:\Users\Admin\AppData\Local\Temp\1000036001\Heaven.exe

          Filesize

          168KB

          MD5

          f4d7b11b0ec08ccde605cc48e5ea47d6

          SHA1

          ebb3a1f2348f18fe1d11fcb7ac062629fbda87a1

          SHA256

          0e45e21d3dfe4d9ae96040530c11c82495ade46d7409cecf7a1374e47a23dd30

          SHA512

          6f67a202416193829e41e0f798dd5d7539d6ba0dca047d49ea5997866ded94a6b36a813b06eaf1496ac4ea50bbcce97bd411dbafef601ff1f593808e49f9debb

        • C:\Users\Admin\AppData\Local\Temp\1000036001\Heaven.exe

          Filesize

          168KB

          MD5

          f4d7b11b0ec08ccde605cc48e5ea47d6

          SHA1

          ebb3a1f2348f18fe1d11fcb7ac062629fbda87a1

          SHA256

          0e45e21d3dfe4d9ae96040530c11c82495ade46d7409cecf7a1374e47a23dd30

          SHA512

          6f67a202416193829e41e0f798dd5d7539d6ba0dca047d49ea5997866ded94a6b36a813b06eaf1496ac4ea50bbcce97bd411dbafef601ff1f593808e49f9debb

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys048763.exe

          Filesize

          459KB

          MD5

          d2120727cbca9256119b4e554c9cccdb

          SHA1

          e76442226bc683d8c58b1ea437f56e5d984c9dd1

          SHA256

          b8836c9f0b733a83ff9212b1f06a74d420a5d907bf0e39d36dce9746dab33f54

          SHA512

          d8a569ac8b8237970f9bd8e46abc5dced7b4e03b6214c7a2d001c2bcebc6dcdad6c04e1763b5b413ca54de4162f49771ef556c093b8df2ff46d89c5c4d3a51f8

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys048763.exe

          Filesize

          459KB

          MD5

          d2120727cbca9256119b4e554c9cccdb

          SHA1

          e76442226bc683d8c58b1ea437f56e5d984c9dd1

          SHA256

          b8836c9f0b733a83ff9212b1f06a74d420a5d907bf0e39d36dce9746dab33f54

          SHA512

          d8a569ac8b8237970f9bd8e46abc5dced7b4e03b6214c7a2d001c2bcebc6dcdad6c04e1763b5b413ca54de4162f49771ef556c093b8df2ff46d89c5c4d3a51f8

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za091298.exe

          Filesize

          775KB

          MD5

          8317c5f57c2f8464c45818497081da89

          SHA1

          c63a23781a00869c40a900c4159086fcb6adc4c9

          SHA256

          f899290441cee20bc6aa82fc8d022d48e493ada86553b194888b90b08733ed0e

          SHA512

          8acf7f821cbad9ee7ce59b6c822fac6332f79458c0a8da0e5fc70aedc97d245567f54e100411c96ce203f1fd5785ac49354a7ca2f4cfe920eb0579153470cda5

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za091298.exe

          Filesize

          775KB

          MD5

          8317c5f57c2f8464c45818497081da89

          SHA1

          c63a23781a00869c40a900c4159086fcb6adc4c9

          SHA256

          f899290441cee20bc6aa82fc8d022d48e493ada86553b194888b90b08733ed0e

          SHA512

          8acf7f821cbad9ee7ce59b6c822fac6332f79458c0a8da0e5fc70aedc97d245567f54e100411c96ce203f1fd5785ac49354a7ca2f4cfe920eb0579153470cda5

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwsyb11.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xwsyb11.exe

          Filesize

          229KB

          MD5

          3308051ded87b1863a8d92925202c4b3

          SHA1

          7834ddc23e7976b07118fb580ae38234466dbdfb

          SHA256

          13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

          SHA512

          f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za609436.exe

          Filesize

          592KB

          MD5

          f5b4418ab6be9b0617c3ad2046f0f463

          SHA1

          c6e714ee2ad5401778145abab3ac95121f6f3581

          SHA256

          1e9c55a78d88682cc28bcbbe6550cc3c370a220a9928a431717580d8129cfc27

          SHA512

          372ef5867661a4501e8d2b953ddd595c589cc85615d806a48ef0d3a8271895585c690af25f8b7f3041b80ec372d057205a882d857992afc7d2c44fd793c3d53e

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za609436.exe

          Filesize

          592KB

          MD5

          f5b4418ab6be9b0617c3ad2046f0f463

          SHA1

          c6e714ee2ad5401778145abab3ac95121f6f3581

          SHA256

          1e9c55a78d88682cc28bcbbe6550cc3c370a220a9928a431717580d8129cfc27

          SHA512

          372ef5867661a4501e8d2b953ddd595c589cc85615d806a48ef0d3a8271895585c690af25f8b7f3041b80ec372d057205a882d857992afc7d2c44fd793c3d53e

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\86921683.exe

          Filesize

          377KB

          MD5

          86e4369849cef6c1d101c17fff7117fd

          SHA1

          3c17259167ce2544695a66153b2a559efc07b361

          SHA256

          dacb2a1ad8f2cdb5e0c923c6b01baa4e86308f3c2419b2401872e1c86ed53539

          SHA512

          009f6e636bf2b45d6beca0a5ed9d741ea348f8900fd7e67d83e6eeec7e7efe7be990de9abbb9e225cbbef5753a0f7c29280fddae9db6123669121e54423306cc

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\86921683.exe

          Filesize

          377KB

          MD5

          86e4369849cef6c1d101c17fff7117fd

          SHA1

          3c17259167ce2544695a66153b2a559efc07b361

          SHA256

          dacb2a1ad8f2cdb5e0c923c6b01baa4e86308f3c2419b2401872e1c86ed53539

          SHA512

          009f6e636bf2b45d6beca0a5ed9d741ea348f8900fd7e67d83e6eeec7e7efe7be990de9abbb9e225cbbef5753a0f7c29280fddae9db6123669121e54423306cc

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w02jY65.exe

          Filesize

          459KB

          MD5

          fcc7c32871db6373a5c0d4a71175b518

          SHA1

          f35970a6f2a7bf6e8e13734594c3771271fd4f14

          SHA256

          f0a93e15e147c9b26c5fca0c870aa15209c61196a1c88f35f34b10479700a5f0

          SHA512

          14c174657bb42d3e769b1187b4e8bb09bade2c6c68951c32f6de9f8deb8faeb40324dc1190405459ac1e322e886c4c4d808db03212d1f8db8ff8ec63a73ae429

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w02jY65.exe

          Filesize

          459KB

          MD5

          fcc7c32871db6373a5c0d4a71175b518

          SHA1

          f35970a6f2a7bf6e8e13734594c3771271fd4f14

          SHA256

          f0a93e15e147c9b26c5fca0c870aa15209c61196a1c88f35f34b10479700a5f0

          SHA512

          14c174657bb42d3e769b1187b4e8bb09bade2c6c68951c32f6de9f8deb8faeb40324dc1190405459ac1e322e886c4c4d808db03212d1f8db8ff8ec63a73ae429

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

          Filesize

          89KB

          MD5

          73df88d68a4f5e066784d462788cf695

          SHA1

          e4bfed336848d0b622fa464d40cf4bd9222aab3f

          SHA256

          f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

          SHA512

          64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

          Filesize

          162B

          MD5

          1b7c22a214949975556626d7217e9a39

          SHA1

          d01c97e2944166ed23e47e4a62ff471ab8fa031f

          SHA256

          340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

          SHA512

          ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

        • memory/1508-181-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-165-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-188-0x0000000000400000-0x0000000000803000-memory.dmp

          Filesize

          4.0MB

        • memory/1508-189-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-190-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-191-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-193-0x0000000000400000-0x0000000000803000-memory.dmp

          Filesize

          4.0MB

        • memory/1508-185-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-183-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-155-0x0000000004ED0000-0x0000000005474000-memory.dmp

          Filesize

          5.6MB

        • memory/1508-156-0x0000000000840000-0x000000000086D000-memory.dmp

          Filesize

          180KB

        • memory/1508-157-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-158-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-159-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

          Filesize

          64KB

        • memory/1508-160-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-177-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-175-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-187-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-173-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-171-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-161-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-163-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-179-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-169-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/1508-167-0x0000000005480000-0x0000000005492000-memory.dmp

          Filesize

          72KB

        • memory/3860-1209-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

          Filesize

          64KB

        • memory/3860-1207-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

          Filesize

          64KB

        • memory/3860-1211-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

          Filesize

          64KB

        • memory/3860-1855-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

          Filesize

          64KB

        • memory/5056-1789-0x00000000009E0000-0x0000000000A0E000-memory.dmp

          Filesize

          184KB

        • memory/5056-1854-0x0000000005240000-0x0000000005250000-memory.dmp

          Filesize

          64KB

        • memory/5056-1858-0x0000000005240000-0x0000000005250000-memory.dmp

          Filesize

          64KB

        • memory/5064-213-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-229-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-997-0x0000000004E40000-0x0000000004E50000-memory.dmp

          Filesize

          64KB

        • memory/5064-998-0x00000000083B0000-0x0000000008416000-memory.dmp

          Filesize

          408KB

        • memory/5064-999-0x0000000008A70000-0x0000000008B02000-memory.dmp

          Filesize

          584KB

        • memory/5064-1000-0x0000000008C40000-0x0000000008CB6000-memory.dmp

          Filesize

          472KB

        • memory/5064-1001-0x0000000008D20000-0x0000000008EE2000-memory.dmp

          Filesize

          1.8MB

        • memory/5064-1002-0x0000000008EF0000-0x000000000941C000-memory.dmp

          Filesize

          5.2MB

        • memory/5064-1003-0x0000000009530000-0x000000000954E000-memory.dmp

          Filesize

          120KB

        • memory/5064-1004-0x00000000025E0000-0x0000000002630000-memory.dmp

          Filesize

          320KB

        • memory/5064-995-0x0000000007F90000-0x000000000809A000-memory.dmp

          Filesize

          1.0MB

        • memory/5064-994-0x0000000007F70000-0x0000000007F82000-memory.dmp

          Filesize

          72KB

        • memory/5064-993-0x00000000078C0000-0x0000000007ED8000-memory.dmp

          Filesize

          6.1MB

        • memory/5064-258-0x0000000004E40000-0x0000000004E50000-memory.dmp

          Filesize

          64KB

        • memory/5064-256-0x0000000004E40000-0x0000000004E50000-memory.dmp

          Filesize

          64KB

        • memory/5064-255-0x0000000000910000-0x0000000000956000-memory.dmp

          Filesize

          280KB

        • memory/5064-231-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-996-0x00000000080B0000-0x00000000080EC000-memory.dmp

          Filesize

          240KB

        • memory/5064-227-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-225-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-223-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-221-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-219-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-217-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-215-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-211-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-209-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-207-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-205-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-203-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-198-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-201-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB

        • memory/5064-199-0x0000000004DE0000-0x0000000004E15000-memory.dmp

          Filesize

          212KB