Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2023, 06:38

General

  • Target

    driver847.exe

  • Size

    1.0MB

  • MD5

    1015190834ed2ef9582e54232a336d57

  • SHA1

    aa8dbb795c4665eed4b2e41b356fe9d6292ef294

  • SHA256

    1e244d9a5e260ced196b3e6d4c85b281d3fc7db5fc16c8bb9ddfec770985c50b

  • SHA512

    2b1a9964cba79fe88ad368641fe476b214902ed003bfd4499c82e1e122f0b5fb1035798a400d38e8ecb270fd1e0bfc64308ee82028d462916e206a64d84bf1f5

  • SSDEEP

    24576:Uyi9eeYnEdsDtq5A4iQFld5ZUlDZdDweH+cTKHSa:jS1AHQh5KlDZqevTK

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\driver847.exe
    "C:\Users\Admin\AppData\Local\Temp\driver847.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5691725.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5691725.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6101680.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6101680.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5532774.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5532774.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8974138.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8974138.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2284
          • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4476
            • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              6⤵
              • Executes dropped EXE
              PID:4488
            • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1192
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:1216
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4484
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4712
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:N"
                    8⤵
                      PID:3600
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "oneetx.exe" /P "Admin:R" /E
                      8⤵
                        PID:4504
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:5016
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\c3912af058" /P "Admin:N"
                          8⤵
                            PID:4916
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\c3912af058" /P "Admin:R" /E
                            8⤵
                              PID:4156
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:5060
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6613072.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6613072.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2012
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:448
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1140

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oneetx.exe.log

                Filesize

                425B

                MD5

                4eaca4566b22b01cd3bc115b9b0b2196

                SHA1

                e743e0792c19f71740416e7b3c061d9f1336bf94

                SHA256

                34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                SHA512

                bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6613072.exe

                Filesize

                286KB

                MD5

                eeb75ecb22ab0265836823ca9ed10fcf

                SHA1

                8ecfc9edd96fbf259846807002683720cd5e7221

                SHA256

                b9fcfb328e2b16dcc039a87ceee9080a6810b8530ed9d17bac681202bccc12e4

                SHA512

                c6ea5a4b72ba51868549d4b92ea0dd69ff58b916eecd6f1e81e9c8c60088e46dc7b03f0f3c3502de786b63e30d9bc82d7dfd18931c3c8381e5c65f4af8e4eef9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6613072.exe

                Filesize

                286KB

                MD5

                eeb75ecb22ab0265836823ca9ed10fcf

                SHA1

                8ecfc9edd96fbf259846807002683720cd5e7221

                SHA256

                b9fcfb328e2b16dcc039a87ceee9080a6810b8530ed9d17bac681202bccc12e4

                SHA512

                c6ea5a4b72ba51868549d4b92ea0dd69ff58b916eecd6f1e81e9c8c60088e46dc7b03f0f3c3502de786b63e30d9bc82d7dfd18931c3c8381e5c65f4af8e4eef9

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5691725.exe

                Filesize

                750KB

                MD5

                a4dd0d61d98e711a7ac981d2a27617fa

                SHA1

                3333066257217735ba7d2261dc245c033dfd1216

                SHA256

                755a3a9058227ab0a80ccaf1e52fdf024c4d6645ef63df90aa507cdfb0f9abca

                SHA512

                193b734b21b23644954cb0f7368b0be19d8d05facc5c0e625c22a645585a6f07f22cf7cc1426cf522d51206a0681f3360df98f82007101a558ae2067acec3988

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5691725.exe

                Filesize

                750KB

                MD5

                a4dd0d61d98e711a7ac981d2a27617fa

                SHA1

                3333066257217735ba7d2261dc245c033dfd1216

                SHA256

                755a3a9058227ab0a80ccaf1e52fdf024c4d6645ef63df90aa507cdfb0f9abca

                SHA512

                193b734b21b23644954cb0f7368b0be19d8d05facc5c0e625c22a645585a6f07f22cf7cc1426cf522d51206a0681f3360df98f82007101a558ae2067acec3988

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h6374936.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6101680.exe

                Filesize

                306KB

                MD5

                b93f0f023fd2ad16a73f93703c241353

                SHA1

                6af5dd803900d184c68f4013fcd285783242dc21

                SHA256

                caa4065a05bf3c5a54a8f4c7647261888d9f764f42922cd3cb781ed9dee518bf

                SHA512

                50807c325c78e78c9a0b8ba1bc1687add483b066a19c5ca128d287641eb3085448c6abdaf5dbfd407038c59376134c891f958c539b379ddd7bdbf8245a1a41fd

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6101680.exe

                Filesize

                306KB

                MD5

                b93f0f023fd2ad16a73f93703c241353

                SHA1

                6af5dd803900d184c68f4013fcd285783242dc21

                SHA256

                caa4065a05bf3c5a54a8f4c7647261888d9f764f42922cd3cb781ed9dee518bf

                SHA512

                50807c325c78e78c9a0b8ba1bc1687add483b066a19c5ca128d287641eb3085448c6abdaf5dbfd407038c59376134c891f958c539b379ddd7bdbf8245a1a41fd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5532774.exe

                Filesize

                146KB

                MD5

                a7020deba2ce8a1a3182a442ecdf2b74

                SHA1

                95dfaee334e1e848e13ef1bd90fbf3efd71f8416

                SHA256

                96b76f2f9f76f0149088a1988ea04b079469865d17a718568f57b2a0f2e70911

                SHA512

                e575b1b16e33f0a5813cbc0ceaa959414aaa9cd9576ae962f53270fd53aab4d4ac90079579c95c77be16147e6a46dfee1213a13714fc8e74d0d9b61fb74c6da7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5532774.exe

                Filesize

                146KB

                MD5

                a7020deba2ce8a1a3182a442ecdf2b74

                SHA1

                95dfaee334e1e848e13ef1bd90fbf3efd71f8416

                SHA256

                96b76f2f9f76f0149088a1988ea04b079469865d17a718568f57b2a0f2e70911

                SHA512

                e575b1b16e33f0a5813cbc0ceaa959414aaa9cd9576ae962f53270fd53aab4d4ac90079579c95c77be16147e6a46dfee1213a13714fc8e74d0d9b61fb74c6da7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8974138.exe

                Filesize

                186KB

                MD5

                3ea5e789a43575c35ffeac88f3a66b3c

                SHA1

                aeafc7e996ab7c956b8ce9dfa4845c57a8ba2311

                SHA256

                d000e0fbcf4b64d2df3cd03e07f23b8d5e213c84ce5f86fb09d244cf88691e6e

                SHA512

                41ce15f294822e519286e24b23f04cd8548a2de5950719f42c64e2ea1cb82c4deb1947ed7e3084e7ff49de298b3cf1693e1ac689eb8d2c754a1d2ef816650961

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8974138.exe

                Filesize

                186KB

                MD5

                3ea5e789a43575c35ffeac88f3a66b3c

                SHA1

                aeafc7e996ab7c956b8ce9dfa4845c57a8ba2311

                SHA256

                d000e0fbcf4b64d2df3cd03e07f23b8d5e213c84ce5f86fb09d244cf88691e6e

                SHA512

                41ce15f294822e519286e24b23f04cd8548a2de5950719f42c64e2ea1cb82c4deb1947ed7e3084e7ff49de298b3cf1693e1ac689eb8d2c754a1d2ef816650961

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                966KB

                MD5

                3d30499dede20f662a6ec3c1fdef2fc4

                SHA1

                c7d29e8a2d1d07b65864bdee9e7495022cb87cd2

                SHA256

                a90ca450da84fef8537202c55f734f1009075712c49067e0db498a5646779a33

                SHA512

                022b2da7d273ab36819303e49411ff8d2c4a0aecd4229464706621b8a0ad1dd6701c053ada52ff4b0355fd513b29f8afe6d08da02f985bd9308fda7dac9183ae

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1140-1166-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1192-1159-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1192-1153-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/2012-230-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-231-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-1157-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-245-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-241-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-239-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-237-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-1146-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-234-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-235-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-233-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-247-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-250-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-254-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-227-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-225-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-256-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-264-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-223-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-221-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-219-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2012-1156-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/2012-218-0x0000000004990000-0x00000000049CC000-memory.dmp

                Filesize

                240KB

              • memory/2284-209-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/2284-229-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/2284-212-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/2284-268-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/2284-213-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/3344-179-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-189-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-201-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/3344-200-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/3344-199-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-197-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-195-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-193-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-191-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-172-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-187-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-185-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-183-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-181-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-202-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

                Filesize

                64KB

              • memory/3344-177-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-175-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3344-173-0x0000000002500000-0x0000000002516000-memory.dmp

                Filesize

                88KB

              • memory/3840-163-0x00000000063A0000-0x0000000006406000-memory.dmp

                Filesize

                408KB

              • memory/3840-161-0x00000000067D0000-0x0000000006D74000-memory.dmp

                Filesize

                5.6MB

              • memory/3840-154-0x0000000000BA0000-0x0000000000BCA000-memory.dmp

                Filesize

                168KB

              • memory/3840-167-0x0000000006750000-0x00000000067A0000-memory.dmp

                Filesize

                320KB

              • memory/3840-166-0x0000000007150000-0x00000000071C6000-memory.dmp

                Filesize

                472KB

              • memory/3840-165-0x0000000007480000-0x00000000079AC000-memory.dmp

                Filesize

                5.2MB

              • memory/3840-164-0x0000000006D80000-0x0000000006F42000-memory.dmp

                Filesize

                1.8MB

              • memory/3840-155-0x00000000059E0000-0x0000000005FF8000-memory.dmp

                Filesize

                6.1MB

              • memory/3840-162-0x0000000006300000-0x0000000006392000-memory.dmp

                Filesize

                584KB

              • memory/3840-156-0x0000000005500000-0x000000000560A000-memory.dmp

                Filesize

                1.0MB

              • memory/3840-160-0x00000000054D0000-0x00000000054E0000-memory.dmp

                Filesize

                64KB

              • memory/3840-159-0x0000000005490000-0x00000000054CC000-memory.dmp

                Filesize

                240KB

              • memory/3840-158-0x00000000054D0000-0x00000000054E0000-memory.dmp

                Filesize

                64KB

              • memory/3840-157-0x0000000005430000-0x0000000005442000-memory.dmp

                Filesize

                72KB

              • memory/4476-286-0x0000000001100000-0x0000000001110000-memory.dmp

                Filesize

                64KB

              • memory/4988-207-0x0000000000520000-0x0000000000618000-memory.dmp

                Filesize

                992KB

              • memory/4988-208-0x00000000027A0000-0x00000000027B0000-memory.dmp

                Filesize

                64KB