Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2023, 15:50

General

  • Target

    a558bb1a1c30d8b33f1995865f82499e35f09bdb08e92b46a7340c38540da958.exe

  • Size

    692KB

  • MD5

    afd5fe51fa7f39e1d20776a1f5c82c52

  • SHA1

    fd7440b6ba8de5cbae0bf7af5f89a6dcb788378a

  • SHA256

    a558bb1a1c30d8b33f1995865f82499e35f09bdb08e92b46a7340c38540da958

  • SHA512

    08dd8fd77affa39844d6a2bdf61486ff55ca920974cb251e935e13109519c2b2ebd460487b218cc0f063cc8bab49a747aa02c1d4853f37f8ff7f43093e7693e0

  • SSDEEP

    12288:tMr+y90E4LfWVayUfy+uZ12lBMhRpSQnR4X/cN6ctc63iS4UAMnMoXJ:ny6LeVa0Zth1G/cr5yS43MnRXJ

Malware Config

Extracted

Family

amadey

Version

3.68

C2

193.233.20.26/Do3m4Gor/index.php

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a558bb1a1c30d8b33f1995865f82499e35f09bdb08e92b46a7340c38540da958.exe
    "C:\Users\Admin\AppData\Local\Temp\a558bb1a1c30d8b33f1995865f82499e35f09bdb08e92b46a7340c38540da958.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zkbV6109Tz.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zkbV6109Tz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkfl4305ev.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkfl4305ev.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knzQ75OQ29.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knzQ75OQ29.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1856
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1084
            5⤵
            • Program crash
            PID:1108
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljhh58ef24.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljhh58ef24.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm15WZ23wm33.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm15WZ23wm33.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
          "C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3436
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "Admin:N"&&CACLS "ghaaer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3808
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3300
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "ghaaer.exe" /P "Admin:N"
                6⤵
                  PID:3716
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "ghaaer.exe" /P "Admin:R" /E
                  6⤵
                    PID:4968
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3824
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:N"
                      6⤵
                        PID:1956
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\5975271bda" /P "Admin:R" /E
                        6⤵
                          PID:2208
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:1200
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdAh35MD47.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdAh35MD47.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3644
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1856 -ip 1856
                1⤵
                  PID:4904
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5048
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3920

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdAh35MD47.exe

                  Filesize

                  176KB

                  MD5

                  c57092ef7ecbcdba4fb11c3e4528f5b0

                  SHA1

                  ca6aee9da28c7dd23417ab0d781c71e8f627ae40

                  SHA256

                  63e5b1991b7914796ff6da96b5898500c479b48128172ca9bb0acb1cba989ef6

                  SHA512

                  7744e854595298a61082337c8287bd61a7182b9053630648ad08d5830ca7af0f446e185f837b345fe8ae311f3c8d3b99fe3760361b281fae79a51cd5bea78f63

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdAh35MD47.exe

                  Filesize

                  176KB

                  MD5

                  c57092ef7ecbcdba4fb11c3e4528f5b0

                  SHA1

                  ca6aee9da28c7dd23417ab0d781c71e8f627ae40

                  SHA256

                  63e5b1991b7914796ff6da96b5898500c479b48128172ca9bb0acb1cba989ef6

                  SHA512

                  7744e854595298a61082337c8287bd61a7182b9053630648ad08d5830ca7af0f446e185f837b345fe8ae311f3c8d3b99fe3760361b281fae79a51cd5bea78f63

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zkbV6109Tz.exe

                  Filesize

                  548KB

                  MD5

                  ebd246c50d0fe0f7a6f12df9ba02ae0b

                  SHA1

                  9942f6b9ccb803b0287098a958c35ba7bc6fcd71

                  SHA256

                  5ee5b0629d5084f6e15788158fdfcf388e81226450dc0f2663c1640cbff4984d

                  SHA512

                  85509e220fc5b9e5d38cb8ca20d8c75fdcc1ddc0e884cda3b6731883041896158758849c1615f4848cefc60adb0a1dc9dd92acabfb642d2aa4de22f8c3165ea6

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zkbV6109Tz.exe

                  Filesize

                  548KB

                  MD5

                  ebd246c50d0fe0f7a6f12df9ba02ae0b

                  SHA1

                  9942f6b9ccb803b0287098a958c35ba7bc6fcd71

                  SHA256

                  5ee5b0629d5084f6e15788158fdfcf388e81226450dc0f2663c1640cbff4984d

                  SHA512

                  85509e220fc5b9e5d38cb8ca20d8c75fdcc1ddc0e884cda3b6731883041896158758849c1615f4848cefc60adb0a1dc9dd92acabfb642d2aa4de22f8c3165ea6

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm15WZ23wm33.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm15WZ23wm33.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkfl4305ev.exe

                  Filesize

                  361KB

                  MD5

                  c6c02b35bcb23afe3498b2445b530fac

                  SHA1

                  48ab672502e5c7a01de137695c4293f74d602a01

                  SHA256

                  2a628d9cd39ccc06e7adc1382bae6f54083d7883bd88a70ecfa9edad80ba3749

                  SHA512

                  a3a1b02c5c9925f8ea9fc19029609e4c1a69cc85ae8332b4edcc89fd89618bb83a8c3e5d1f977e523c083dd75e9cbbcc00f4c8acdc42aed14c6b8b693da1c9b9

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkfl4305ev.exe

                  Filesize

                  361KB

                  MD5

                  c6c02b35bcb23afe3498b2445b530fac

                  SHA1

                  48ab672502e5c7a01de137695c4293f74d602a01

                  SHA256

                  2a628d9cd39ccc06e7adc1382bae6f54083d7883bd88a70ecfa9edad80ba3749

                  SHA512

                  a3a1b02c5c9925f8ea9fc19029609e4c1a69cc85ae8332b4edcc89fd89618bb83a8c3e5d1f977e523c083dd75e9cbbcc00f4c8acdc42aed14c6b8b693da1c9b9

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knzQ75OQ29.exe

                  Filesize

                  362KB

                  MD5

                  370ce87b40603491b8bb720481815ba9

                  SHA1

                  15e39291cfecfeb70695c3be69d62b01a30e8e82

                  SHA256

                  49c8c62162fe062c40052643d81bfd63268971ba7c348a0979bbf5262ca9dc56

                  SHA512

                  84c0bd19293e338e727b032180bba6a776b244596baa5ba9083b2e9e018888cb52f4df47aa7ab83ed78189a06e48744abdc123a9d5f4fb42de87812bf71b828e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knzQ75OQ29.exe

                  Filesize

                  362KB

                  MD5

                  370ce87b40603491b8bb720481815ba9

                  SHA1

                  15e39291cfecfeb70695c3be69d62b01a30e8e82

                  SHA256

                  49c8c62162fe062c40052643d81bfd63268971ba7c348a0979bbf5262ca9dc56

                  SHA512

                  84c0bd19293e338e727b032180bba6a776b244596baa5ba9083b2e9e018888cb52f4df47aa7ab83ed78189a06e48744abdc123a9d5f4fb42de87812bf71b828e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljhh58ef24.exe

                  Filesize

                  11KB

                  MD5

                  6012705c51c7dc0836bc11f31b02ba7a

                  SHA1

                  3ba5140a73ac83917172102101183180a18627d8

                  SHA256

                  3aa1f2064c496020030de6ba44e3aa8a8f2afb982400a3c88f9150edfa4ead66

                  SHA512

                  4b80cfdcaa252c2852826e07f9b709a03b1bc742a092fff0e79a10a0941ec9bb3dd6ca74a8b380a605689703c684e6036a79742eaf3bcd2cc09d41a1d4d963eb

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljhh58ef24.exe

                  Filesize

                  11KB

                  MD5

                  6012705c51c7dc0836bc11f31b02ba7a

                  SHA1

                  3ba5140a73ac83917172102101183180a18627d8

                  SHA256

                  3aa1f2064c496020030de6ba44e3aa8a8f2afb982400a3c88f9150edfa4ead66

                  SHA512

                  4b80cfdcaa252c2852826e07f9b709a03b1bc742a092fff0e79a10a0941ec9bb3dd6ca74a8b380a605689703c684e6036a79742eaf3bcd2cc09d41a1d4d963eb

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1088-197-0x0000000000170000-0x000000000017A000-memory.dmp

                  Filesize

                  40KB

                • memory/1856-191-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-173-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-185-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-187-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-188-0x0000000000400000-0x0000000002BC8000-memory.dmp

                  Filesize

                  39.8MB

                • memory/1856-189-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-190-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-181-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-193-0x0000000000400000-0x0000000002BC8000-memory.dmp

                  Filesize

                  39.8MB

                • memory/1856-179-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-177-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-175-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-171-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-161-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-169-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-167-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-165-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-162-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-163-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-183-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-155-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

                  Filesize

                  180KB

                • memory/1856-156-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

                  Filesize

                  64KB

                • memory/1856-157-0x0000000007180000-0x0000000007724000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1856-158-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/1856-159-0x0000000004BF0000-0x0000000004C02000-memory.dmp

                  Filesize

                  72KB

                • memory/3644-214-0x0000000000510000-0x0000000000542000-memory.dmp

                  Filesize

                  200KB

                • memory/3644-221-0x0000000005260000-0x00000000052C6000-memory.dmp

                  Filesize

                  408KB

                • memory/3644-222-0x0000000006510000-0x0000000006586000-memory.dmp

                  Filesize

                  472KB

                • memory/3644-223-0x0000000006590000-0x00000000065E0000-memory.dmp

                  Filesize

                  320KB

                • memory/3644-224-0x0000000004E60000-0x0000000004E70000-memory.dmp

                  Filesize

                  64KB

                • memory/3644-225-0x00000000067B0000-0x0000000006972000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3644-226-0x0000000006EB0000-0x00000000073DC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3644-220-0x0000000005930000-0x00000000059C2000-memory.dmp

                  Filesize

                  584KB

                • memory/3644-219-0x0000000004E10000-0x0000000004E4C000-memory.dmp

                  Filesize

                  240KB

                • memory/3644-217-0x0000000004E60000-0x0000000004E70000-memory.dmp

                  Filesize

                  64KB

                • memory/3644-218-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

                  Filesize

                  72KB

                • memory/3644-216-0x0000000004E80000-0x0000000004F8A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3644-215-0x0000000005310000-0x0000000005928000-memory.dmp

                  Filesize

                  6.1MB