Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    117s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/03/2023, 06:10

General

  • Target

    d06d2df155e9a12722bb63aed6a2c40d3dbf93d0862b7188a5a0fd71af5b8310.exe

  • Size

    1.1MB

  • MD5

    39c24fc6e0ddfb7a9d7ded91b5bb5c58

  • SHA1

    4a4a78369a0dba9fcfb5b8d088685712c7404f80

  • SHA256

    d06d2df155e9a12722bb63aed6a2c40d3dbf93d0862b7188a5a0fd71af5b8310

  • SHA512

    557c1e3742f2b92ac1191e851fed79c6f0c11280ae7f45c23d2acd04f1e44d597429f1fc9e1da15bc90e10c090d28406817d0b5c4883dc87dbc714f0e83bb94d

  • SSDEEP

    24576:jIpYjWsLGJzJF0DuVXBs5xo9qTwg/mwiEptybz7rWwNXVdq:6YqhJzJKyVXBs7Tz/b2bz7rWAX

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d06d2df155e9a12722bb63aed6a2c40d3dbf93d0862b7188a5a0fd71af5b8310.exe
    "C:\Users\Admin\AppData\Local\Temp\d06d2df155e9a12722bb63aed6a2c40d3dbf93d0862b7188a5a0fd71af5b8310.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2128
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4424
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4552
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:704
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4672
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3180
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3912
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:5096
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4952
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4964
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:4852

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                Filesize

                787KB

                MD5

                56434c8ed4c19d4973c9022bed5d65fc

                SHA1

                c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                SHA256

                d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                SHA512

                56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                Filesize

                787KB

                MD5

                56434c8ed4c19d4973c9022bed5d65fc

                SHA1

                c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                SHA256

                d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                SHA512

                56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                Filesize

                644KB

                MD5

                6fe2dd254687fd7b7b7a66610b0ce909

                SHA1

                af521d0a550c657e5bac77e010c5f9e960eb72c6

                SHA256

                dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                SHA512

                1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                Filesize

                644KB

                MD5

                6fe2dd254687fd7b7b7a66610b0ce909

                SHA1

                af521d0a550c657e5bac77e010c5f9e960eb72c6

                SHA256

                dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                SHA512

                1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                Filesize

                297KB

                MD5

                f0bef689623bac4a599617ca12e59f57

                SHA1

                181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                SHA256

                8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                SHA512

                433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                Filesize

                297KB

                MD5

                f0bef689623bac4a599617ca12e59f57

                SHA1

                181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                SHA256

                8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                SHA512

                433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                Filesize

                319KB

                MD5

                c8538173a294a6e854caa1bb6c6971d3

                SHA1

                8aae18c96ac645abd4762b544a6a632ae6d604ce

                SHA256

                6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                SHA512

                3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                Filesize

                319KB

                MD5

                c8538173a294a6e854caa1bb6c6971d3

                SHA1

                8aae18c96ac645abd4762b544a6a632ae6d604ce

                SHA256

                6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                SHA512

                3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                Filesize

                239KB

                MD5

                3b9ebc8cf697ac2228177a4836d30419

                SHA1

                da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                SHA256

                63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                SHA512

                802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                Filesize

                239KB

                MD5

                3b9ebc8cf697ac2228177a4836d30419

                SHA1

                da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                SHA256

                63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                SHA512

                802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

              • memory/2128-148-0x0000000000810000-0x000000000081A000-memory.dmp

                Filesize

                40KB

              • memory/2588-149-0x0000000000400000-0x00000000005A1000-memory.dmp

                Filesize

                1.6MB

              • memory/2588-123-0x0000000004510000-0x0000000004604000-memory.dmp

                Filesize

                976KB

              • memory/3020-1137-0x0000000005660000-0x00000000056AB000-memory.dmp

                Filesize

                300KB

              • memory/3020-1136-0x0000000005810000-0x0000000005820000-memory.dmp

                Filesize

                64KB

              • memory/3020-1135-0x0000000000C20000-0x0000000000C52000-memory.dmp

                Filesize

                200KB

              • memory/4132-1114-0x00000000052E0000-0x00000000052F2000-memory.dmp

                Filesize

                72KB

              • memory/4132-233-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-1129-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1128-0x00000000068A0000-0x0000000006DCC000-memory.dmp

                Filesize

                5.2MB

              • memory/4132-1127-0x00000000066C0000-0x0000000006882000-memory.dmp

                Filesize

                1.8MB

              • memory/4132-1126-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1125-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1124-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1122-0x0000000006500000-0x0000000006550000-memory.dmp

                Filesize

                320KB

              • memory/4132-1121-0x0000000006480000-0x00000000064F6000-memory.dmp

                Filesize

                472KB

              • memory/4132-1120-0x0000000005680000-0x00000000056E6000-memory.dmp

                Filesize

                408KB

              • memory/4132-1119-0x00000000055E0000-0x0000000005672000-memory.dmp

                Filesize

                584KB

              • memory/4132-1117-0x0000000005450000-0x000000000549B000-memory.dmp

                Filesize

                300KB

              • memory/4132-1116-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1115-0x0000000005300000-0x000000000533E000-memory.dmp

                Filesize

                248KB

              • memory/4132-200-0x0000000002460000-0x00000000024A6000-memory.dmp

                Filesize

                280KB

              • memory/4132-201-0x0000000002620000-0x0000000002664000-memory.dmp

                Filesize

                272KB

              • memory/4132-202-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-203-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-205-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-207-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-209-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-211-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-213-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-217-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-215-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-219-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-221-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-223-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-225-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-227-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-229-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-231-0x0000000002620000-0x000000000265E000-memory.dmp

                Filesize

                248KB

              • memory/4132-1113-0x00000000051D0000-0x00000000052DA000-memory.dmp

                Filesize

                1.0MB

              • memory/4132-485-0x00000000004D0000-0x000000000051B000-memory.dmp

                Filesize

                300KB

              • memory/4132-489-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-486-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-490-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                Filesize

                64KB

              • memory/4132-1112-0x00000000057E0000-0x0000000005DE6000-memory.dmp

                Filesize

                6.0MB

              • memory/4424-181-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-160-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

                Filesize

                64KB

              • memory/4424-171-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-173-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-195-0x0000000000400000-0x00000000004BB000-memory.dmp

                Filesize

                748KB

              • memory/4424-193-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

                Filesize

                64KB

              • memory/4424-192-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

                Filesize

                64KB

              • memory/4424-191-0x0000000000400000-0x00000000004BB000-memory.dmp

                Filesize

                748KB

              • memory/4424-189-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-187-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-185-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-183-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-169-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-175-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-162-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-167-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-165-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-163-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-177-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-161-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

                Filesize

                64KB

              • memory/4424-159-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

                Filesize

                64KB

              • memory/4424-157-0x00000000024F0000-0x0000000002508000-memory.dmp

                Filesize

                96KB

              • memory/4424-179-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/4424-158-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/4424-156-0x0000000004AC0000-0x0000000004FBE000-memory.dmp

                Filesize

                5.0MB

              • memory/4424-155-0x0000000002160000-0x000000000217A000-memory.dmp

                Filesize

                104KB