Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21/05/2023, 17:09

General

  • Target

    e8dc9bb8a687a0a322b422159bd3a1441a463204b802c0a8586624219fd53a94.exe

  • Size

    1022KB

  • MD5

    30a8554c041a232b985b9b5ac0fca14a

  • SHA1

    fc18a4375574f21c479c7c6114b0b26041c0fa5f

  • SHA256

    e8dc9bb8a687a0a322b422159bd3a1441a463204b802c0a8586624219fd53a94

  • SHA512

    ce593396e8a4f63964f9ba76c92044d5f4ffa0b68c86a5d9427743ca968d99b96eb4ed94badc6b8b296738234fb82c897d9cdfafe6a08dce5fbc977e50805524

  • SSDEEP

    24576:OyJIZqTgVaHG2Qq5/06fHk9oeHqzXEVUZsASPNn:dJIMTRHG2Qq5/0CHI/HqLEVOsA

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.37:4138

Attributes
  • auth_value

    9d14534b25ac495ab25b59800acf3bb2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8dc9bb8a687a0a322b422159bd3a1441a463204b802c0a8586624219fd53a94.exe
    "C:\Users\Admin\AppData\Local\Temp\e8dc9bb8a687a0a322b422159bd3a1441a463204b802c0a8586624219fd53a94.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6637595.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6637595.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4783677.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4783677.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1372
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5800451.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5800451.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2924240.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2924240.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3892
          • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4832
            • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4804
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:5096
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5108
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:3384
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:N"
                    8⤵
                      PID:3356
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "oneetx.exe" /P "Admin:R" /E
                      8⤵
                        PID:4176
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4252
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\c3912af058" /P "Admin:N"
                          8⤵
                            PID:3144
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\c3912af058" /P "Admin:R" /E
                            8⤵
                              PID:3256
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:2964
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0807031.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0807031.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3788
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3516
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3608

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oneetx.exe.log

                Filesize

                425B

                MD5

                605f809fab8c19729d39d075f7ffdb53

                SHA1

                c546f877c9bd53563174a90312a8337fdfc5fdd9

                SHA256

                6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

                SHA512

                82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0807031.exe

                Filesize

                285KB

                MD5

                3e63e7592fc81361f303ff002971be8c

                SHA1

                4c012b4d987dcc162941891b222dffbd06e690f5

                SHA256

                ab56964a625d980496bd6805ecc8cf059a75598d827055c5794757ccf5773d1d

                SHA512

                5348b934fde73793e3aef693f5191f93b02c4a90a90824784d8c68ebebbddc555b577a4a3019d05fe85d817060d44c30d60929b3073d3da7a9e4ea1d0930cfa3

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0807031.exe

                Filesize

                285KB

                MD5

                3e63e7592fc81361f303ff002971be8c

                SHA1

                4c012b4d987dcc162941891b222dffbd06e690f5

                SHA256

                ab56964a625d980496bd6805ecc8cf059a75598d827055c5794757ccf5773d1d

                SHA512

                5348b934fde73793e3aef693f5191f93b02c4a90a90824784d8c68ebebbddc555b577a4a3019d05fe85d817060d44c30d60929b3073d3da7a9e4ea1d0930cfa3

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6637595.exe

                Filesize

                750KB

                MD5

                79ad18902fe3ab55ebcfd2eb8b055948

                SHA1

                14477643c15ed7120e0704d79c1c4cffd1ae4a2e

                SHA256

                c635abcb15fdfd61624f2543593268400a9f6946ea85cade4093d2ec342e8037

                SHA512

                a683dedf95a119d636d7ea0e45f158d5a7e1246fd6a455cc2d1da0cf394e0f838872376352d7a354d3f8b8a0fb04f559d447899af4df698d05fba7ce4b05706e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6637595.exe

                Filesize

                750KB

                MD5

                79ad18902fe3ab55ebcfd2eb8b055948

                SHA1

                14477643c15ed7120e0704d79c1c4cffd1ae4a2e

                SHA256

                c635abcb15fdfd61624f2543593268400a9f6946ea85cade4093d2ec342e8037

                SHA512

                a683dedf95a119d636d7ea0e45f158d5a7e1246fd6a455cc2d1da0cf394e0f838872376352d7a354d3f8b8a0fb04f559d447899af4df698d05fba7ce4b05706e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7401311.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4783677.exe

                Filesize

                305KB

                MD5

                659a94662b5ffddc649891a1d40cd951

                SHA1

                05d6ec138c67955d16f1eb5a240e604ab3c69e9e

                SHA256

                fa7094b7dcbbc05ce0f158a033b2fdcf26c6fd75d9468c73a95a035ce4edc5de

                SHA512

                85da84aa79f6158f1dc47717a6d0e44f8af52d3592b0309b6e0a0f181d78dd4778bf6623969105771433b6584dac41d84f02dce3438039dc6c6e297893e9dba6

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4783677.exe

                Filesize

                305KB

                MD5

                659a94662b5ffddc649891a1d40cd951

                SHA1

                05d6ec138c67955d16f1eb5a240e604ab3c69e9e

                SHA256

                fa7094b7dcbbc05ce0f158a033b2fdcf26c6fd75d9468c73a95a035ce4edc5de

                SHA512

                85da84aa79f6158f1dc47717a6d0e44f8af52d3592b0309b6e0a0f181d78dd4778bf6623969105771433b6584dac41d84f02dce3438039dc6c6e297893e9dba6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5800451.exe

                Filesize

                185KB

                MD5

                26b0b6d473e18b76afbc1aa1435c78b4

                SHA1

                01e0610b53c58f4a04f303b2df86184b5b9f2b94

                SHA256

                41845514d8440051380e6425269fbabce42644afdac0a0d6679c87d70d2fe908

                SHA512

                47a56b42d714b3283c225d66c9b21993e62df74cc6e405e6c8b5dd2661ebe782a4da6469e9aaf7c05a3e61f5681bcc1fb787e0677532d799ecf6d2ec93494f7e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a5800451.exe

                Filesize

                185KB

                MD5

                26b0b6d473e18b76afbc1aa1435c78b4

                SHA1

                01e0610b53c58f4a04f303b2df86184b5b9f2b94

                SHA256

                41845514d8440051380e6425269fbabce42644afdac0a0d6679c87d70d2fe908

                SHA512

                47a56b42d714b3283c225d66c9b21993e62df74cc6e405e6c8b5dd2661ebe782a4da6469e9aaf7c05a3e61f5681bcc1fb787e0677532d799ecf6d2ec93494f7e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2924240.exe

                Filesize

                145KB

                MD5

                ae74335f88c891fb88d1650612c2abe9

                SHA1

                401817cc561f994ad35190bf5e8a2868cd482436

                SHA256

                b8ad70b44d1308894b5f7156ecf8944be900d6cadceb7ee5041ca7b121823349

                SHA512

                894438b28e4a103bea66c54aaf261fedd8fd30aeceaadff5d80a81ee940c2a4d52013c5f15d31a412b1b8d3c0cfd0ede75e78f24eb624c0347a69e183b3dd898

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2924240.exe

                Filesize

                145KB

                MD5

                ae74335f88c891fb88d1650612c2abe9

                SHA1

                401817cc561f994ad35190bf5e8a2868cd482436

                SHA256

                b8ad70b44d1308894b5f7156ecf8944be900d6cadceb7ee5041ca7b121823349

                SHA512

                894438b28e4a103bea66c54aaf261fedd8fd30aeceaadff5d80a81ee940c2a4d52013c5f15d31a412b1b8d3c0cfd0ede75e78f24eb624c0347a69e183b3dd898

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                965KB

                MD5

                a80c142ba4de658c77ec5e856c4baca6

                SHA1

                2591c296ef68f23bba88a85f4ca9aa29c3f95c43

                SHA256

                5a18bf58fe5218a601ac65130c067636605b6d4ea7a12c3ce84a9152b1fa8489

                SHA512

                f597658418e74bd961052da625bd8a471555e0e2cc89d3f8cecfe7287e72b9427a5fb1e7a3415fe43325bf12d1c57f93f4c5f70406bc9a8d492e6bec959a437d

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • memory/1440-181-0x00000000002D0000-0x00000000002FA000-memory.dmp

                Filesize

                168KB

              • memory/1440-194-0x0000000005F60000-0x0000000005FB0000-memory.dmp

                Filesize

                320KB

              • memory/1440-193-0x0000000005EE0000-0x0000000005F56000-memory.dmp

                Filesize

                472KB

              • memory/1440-192-0x0000000006DB0000-0x00000000072DC000-memory.dmp

                Filesize

                5.2MB

              • memory/1440-191-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/1440-190-0x00000000066B0000-0x0000000006872000-memory.dmp

                Filesize

                1.8MB

              • memory/1440-189-0x0000000005BA0000-0x0000000005C32000-memory.dmp

                Filesize

                584KB

              • memory/1440-182-0x00000000051D0000-0x00000000057D6000-memory.dmp

                Filesize

                6.0MB

              • memory/1440-183-0x0000000004D30000-0x0000000004E3A000-memory.dmp

                Filesize

                1.0MB

              • memory/1440-184-0x0000000004C60000-0x0000000004C72000-memory.dmp

                Filesize

                72KB

              • memory/1440-185-0x0000000004CD0000-0x0000000004D0E000-memory.dmp

                Filesize

                248KB

              • memory/1440-186-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/1440-187-0x0000000004E40000-0x0000000004E8B000-memory.dmp

                Filesize

                300KB

              • memory/1440-188-0x0000000004FE0000-0x0000000005046000-memory.dmp

                Filesize

                408KB

              • memory/2136-157-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-165-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-171-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-176-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                Filesize

                64KB

              • memory/2136-175-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-173-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-159-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-163-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-142-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                Filesize

                64KB

              • memory/2136-161-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-169-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-143-0x0000000001FD0000-0x0000000001FEE000-memory.dmp

                Filesize

                120KB

              • memory/2136-149-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-155-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-153-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-151-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-167-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-148-0x00000000023A0000-0x00000000023B6000-memory.dmp

                Filesize

                88KB

              • memory/2136-147-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                Filesize

                64KB

              • memory/2136-146-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                Filesize

                64KB

              • memory/2136-145-0x00000000023A0000-0x00000000023BC000-memory.dmp

                Filesize

                112KB

              • memory/2136-144-0x0000000004BB0000-0x00000000050AE000-memory.dmp

                Filesize

                5.0MB

              • memory/3516-1171-0x00000000077F0000-0x0000000007800000-memory.dmp

                Filesize

                64KB

              • memory/3608-1176-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3788-239-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-213-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-227-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-229-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-231-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-233-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-235-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-210-0x0000000002360000-0x00000000023A4000-memory.dmp

                Filesize

                272KB

              • memory/3788-238-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-240-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-223-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-242-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-243-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-245-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-247-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-221-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-219-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-217-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-211-0x0000000004E60000-0x0000000004EA0000-memory.dmp

                Filesize

                256KB

              • memory/3788-212-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-1133-0x0000000005910000-0x000000000595B000-memory.dmp

                Filesize

                300KB

              • memory/3788-1134-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-215-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-225-0x0000000004E60000-0x0000000004E9C000-memory.dmp

                Filesize

                240KB

              • memory/3788-1144-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-1145-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3788-1146-0x0000000002350000-0x0000000002360000-memory.dmp

                Filesize

                64KB

              • memory/3892-596-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3892-236-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3892-208-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3892-204-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3892-201-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/4804-1148-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/4804-1141-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/4832-640-0x0000000007740000-0x0000000007750000-memory.dmp

                Filesize

                64KB

              • memory/4892-200-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

                Filesize

                64KB

              • memory/4892-199-0x0000000000DF0000-0x0000000000EE8000-memory.dmp

                Filesize

                992KB