Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/03/2023, 22:40

General

  • Target

    90082b434a93110de390480ab513dbabb031701776d6419ef107f2e218a71692.exe

  • Size

    1.2MB

  • MD5

    e37f7b9e60103bba79766a9dee6c8f54

  • SHA1

    45dd9523f41035e433fc1770351f5150f42fad72

  • SHA256

    90082b434a93110de390480ab513dbabb031701776d6419ef107f2e218a71692

  • SHA512

    5ae862d527111d1e0fc9e6847a0c2ffd5efb43d866b13edac36408d8ef3ef89db5b45a8f9f900a4d485b1db30dc4eb13316943190f7494856f9968bfd07bf7b5

  • SSDEEP

    24576:JTAfoxECBlasBR73KvUy4hIOdhmTOeCWTS1mvCc/zTaseWQtZOF9Kqy:ZAfwEwseDKYr2vC82mvRaTWuu

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90082b434a93110de390480ab513dbabb031701776d6419ef107f2e218a71692.exe
    "C:\Users\Admin\AppData\Local\Temp\90082b434a93110de390480ab513dbabb031701776d6419ef107f2e218a71692.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3200.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3200.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2038.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2038.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5883.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5883.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus4772.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus4772.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4620
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5478.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5478.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3956
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dZm98s69.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dZm98s69.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en313728.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en313728.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge457571.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge457571.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5080
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:792
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:880
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:800
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4188
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:428
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:608
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:3364
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:1088

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge457571.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge457571.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3200.exe

                Filesize

                853KB

                MD5

                c13bd57821f5fd3c2e89687e3c00d36e

                SHA1

                c62930b27312bec0951737a3ad58cd9f0bd79007

                SHA256

                55dff9dcc7c955a0c821831f094a90df6ea4e6287e75bb36d850623579665dc9

                SHA512

                c18e359e6cb82bce1fb6a6fb02685ec11bfb5a10679d58042711a1840ae7d844a135217510463fa8aaa4a762a299a7376ddde3bc597fdd7115210504b43ab65c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3200.exe

                Filesize

                853KB

                MD5

                c13bd57821f5fd3c2e89687e3c00d36e

                SHA1

                c62930b27312bec0951737a3ad58cd9f0bd79007

                SHA256

                55dff9dcc7c955a0c821831f094a90df6ea4e6287e75bb36d850623579665dc9

                SHA512

                c18e359e6cb82bce1fb6a6fb02685ec11bfb5a10679d58042711a1840ae7d844a135217510463fa8aaa4a762a299a7376ddde3bc597fdd7115210504b43ab65c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en313728.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en313728.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2038.exe

                Filesize

                711KB

                MD5

                ef74efc501460be78ba2f6edc0cacb1a

                SHA1

                8bf192b52c6774e6935dcfcf4bd49f5f52255902

                SHA256

                9e39690f05affa71e7faf55bdbb714428bb53841aa1c77a543a780696ff84b49

                SHA512

                f7eb0479f6497d2b43c3ac341cd083aa2529567af664e84295956bd2c79435fddffae7e0786e664eab4b0090d3cd9f62bbc675bb7a2f1972170af72640a7fe33

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2038.exe

                Filesize

                711KB

                MD5

                ef74efc501460be78ba2f6edc0cacb1a

                SHA1

                8bf192b52c6774e6935dcfcf4bd49f5f52255902

                SHA256

                9e39690f05affa71e7faf55bdbb714428bb53841aa1c77a543a780696ff84b49

                SHA512

                f7eb0479f6497d2b43c3ac341cd083aa2529567af664e84295956bd2c79435fddffae7e0786e664eab4b0090d3cd9f62bbc675bb7a2f1972170af72640a7fe33

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dZm98s69.exe

                Filesize

                426KB

                MD5

                8ebe750a8750642b6a7d5324ea235f41

                SHA1

                95c5adc2bd70d3df8bde1569c33aa31d5873c0ab

                SHA256

                86e77d5285bce7ccd218e14d2c04d75012cd6b6fecc6c1337a85c205aee24ea3

                SHA512

                a74951313fe6c74f0711cdf45fb9a507e6f0dff2d3f4ec1e81c206fc624c1cc56d5b6185ddcdebeee2c7a741a7f5b280e33141793c35e0efdb6ae68125cc2370

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dZm98s69.exe

                Filesize

                426KB

                MD5

                8ebe750a8750642b6a7d5324ea235f41

                SHA1

                95c5adc2bd70d3df8bde1569c33aa31d5873c0ab

                SHA256

                86e77d5285bce7ccd218e14d2c04d75012cd6b6fecc6c1337a85c205aee24ea3

                SHA512

                a74951313fe6c74f0711cdf45fb9a507e6f0dff2d3f4ec1e81c206fc624c1cc56d5b6185ddcdebeee2c7a741a7f5b280e33141793c35e0efdb6ae68125cc2370

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5883.exe

                Filesize

                353KB

                MD5

                e9f570e98085fe1dece68abb25040199

                SHA1

                a4185edc596d2b71802f4179610d7b0f9ec4bb9d

                SHA256

                15def9da08051e979d2bf22e2c5139f9023e5e6c343007de52197aca2a67b21d

                SHA512

                e965d1c3ec23df5bdd2283c2326017191009ea3b55b0eb26dd4c990f758cccda36b6e041af2baae3c4e7b35d35491b8ce8229a3a34ef53326cf62098a3e8a916

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5883.exe

                Filesize

                353KB

                MD5

                e9f570e98085fe1dece68abb25040199

                SHA1

                a4185edc596d2b71802f4179610d7b0f9ec4bb9d

                SHA256

                15def9da08051e979d2bf22e2c5139f9023e5e6c343007de52197aca2a67b21d

                SHA512

                e965d1c3ec23df5bdd2283c2326017191009ea3b55b0eb26dd4c990f758cccda36b6e041af2baae3c4e7b35d35491b8ce8229a3a34ef53326cf62098a3e8a916

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus4772.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus4772.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5478.exe

                Filesize

                369KB

                MD5

                103d8efd4c8df9709aaaa869bb22531b

                SHA1

                10aa7dc87ffaff1143faf192bc6ea2a074d39628

                SHA256

                27e9f56cf6a2a71c34db280ca733ba6125dfdca07d807284e8bdfd0d3a7d62f4

                SHA512

                30251fd99d934548008a97a477fe391a032f8e25eab97e71acbc2321fe0f439c639671b5da18109489bbb1bcafbdafba98e9adefd228a58f75a693fd081680d5

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5478.exe

                Filesize

                369KB

                MD5

                103d8efd4c8df9709aaaa869bb22531b

                SHA1

                10aa7dc87ffaff1143faf192bc6ea2a074d39628

                SHA256

                27e9f56cf6a2a71c34db280ca733ba6125dfdca07d807284e8bdfd0d3a7d62f4

                SHA512

                30251fd99d934548008a97a477fe391a032f8e25eab97e71acbc2321fe0f439c639671b5da18109489bbb1bcafbdafba98e9adefd228a58f75a693fd081680d5

              • memory/3956-181-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-197-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/3956-173-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-175-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-177-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-167-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-179-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-183-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-185-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-187-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-189-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-191-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-193-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-195-0x0000000000400000-0x00000000004DF000-memory.dmp

                Filesize

                892KB

              • memory/3956-196-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/3956-166-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/3956-199-0x0000000000400000-0x00000000004DF000-memory.dmp

                Filesize

                892KB

              • memory/3956-159-0x00000000020D0000-0x00000000020EA000-memory.dmp

                Filesize

                104KB

              • memory/3956-160-0x0000000004CD0000-0x00000000051CE000-memory.dmp

                Filesize

                5.0MB

              • memory/3956-161-0x0000000002180000-0x0000000002198000-memory.dmp

                Filesize

                96KB

              • memory/3956-170-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/3956-171-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-169-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/3956-163-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/3956-165-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/3956-162-0x0000000002180000-0x0000000002192000-memory.dmp

                Filesize

                72KB

              • memory/4240-153-0x0000000000400000-0x00000000005BC000-memory.dmp

                Filesize

                1.7MB

              • memory/4240-152-0x00000000044C0000-0x00000000045C4000-memory.dmp

                Filesize

                1.0MB

              • memory/4620-151-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

                Filesize

                40KB

              • memory/4976-1140-0x0000000004C80000-0x0000000004CCB000-memory.dmp

                Filesize

                300KB

              • memory/4976-1139-0x0000000004C70000-0x0000000004C80000-memory.dmp

                Filesize

                64KB

              • memory/4976-1138-0x00000000003C0000-0x00000000003F2000-memory.dmp

                Filesize

                200KB

              • memory/5048-206-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-227-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-229-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-231-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-233-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-235-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-237-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-324-0x0000000000600000-0x000000000064B000-memory.dmp

                Filesize

                300KB

              • memory/5048-325-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-327-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-328-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-1116-0x0000000005700000-0x0000000005D06000-memory.dmp

                Filesize

                6.0MB

              • memory/5048-1117-0x00000000050F0000-0x00000000051FA000-memory.dmp

                Filesize

                1.0MB

              • memory/5048-1118-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

                Filesize

                72KB

              • memory/5048-1120-0x0000000005200000-0x000000000523E000-memory.dmp

                Filesize

                248KB

              • memory/5048-1119-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-1121-0x0000000005340000-0x000000000538B000-memory.dmp

                Filesize

                300KB

              • memory/5048-1123-0x00000000054C0000-0x0000000005526000-memory.dmp

                Filesize

                408KB

              • memory/5048-1124-0x0000000006070000-0x0000000006102000-memory.dmp

                Filesize

                584KB

              • memory/5048-1125-0x0000000006280000-0x00000000062F6000-memory.dmp

                Filesize

                472KB

              • memory/5048-1126-0x0000000006300000-0x0000000006350000-memory.dmp

                Filesize

                320KB

              • memory/5048-1128-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-1129-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-1130-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/5048-1131-0x00000000065B0000-0x0000000006772000-memory.dmp

                Filesize

                1.8MB

              • memory/5048-1132-0x0000000006780000-0x0000000006CAC000-memory.dmp

                Filesize

                5.2MB

              • memory/5048-225-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-223-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-221-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-219-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-217-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-215-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-213-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-211-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-209-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-207-0x0000000004A80000-0x0000000004ABE000-memory.dmp

                Filesize

                248KB

              • memory/5048-205-0x0000000004A80000-0x0000000004AC4000-memory.dmp

                Filesize

                272KB

              • memory/5048-204-0x0000000002290000-0x00000000022D6000-memory.dmp

                Filesize

                280KB