Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2023, 10:18

General

  • Target

    4546a0af2d77dbe7c015d05b51dd2f630c6c657b20f0ef8bac1fabe89a6b016e.exe

  • Size

    1.1MB

  • MD5

    7fa93883b02f6545d1834e23db76cd1e

  • SHA1

    383a3b179d1e1d5075bd6445d88c0e47ec9dbc3c

  • SHA256

    4546a0af2d77dbe7c015d05b51dd2f630c6c657b20f0ef8bac1fabe89a6b016e

  • SHA512

    2e3b418a48843bff42e1a008121c6216a62c49ce0746315aef0512468bb682756be58233077755de94695e2025e2016635d638307521daeb46bc8b46f5186b6b

  • SSDEEP

    24576:P1NG3gOqY0E3/MspPRHRrb/pFijEGl7AqYVKicIl8G5mlq:tQd0+MUR9tFijGqk

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 17 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4546a0af2d77dbe7c015d05b51dd2f630c6c657b20f0ef8bac1fabe89a6b016e.exe
    "C:\Users\Admin\AppData\Local\Temp\4546a0af2d77dbe7c015d05b51dd2f630c6c657b20f0ef8bac1fabe89a6b016e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1272
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3296
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4840
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1080
              6⤵
              • Program crash
              PID:2984
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3608
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 1324
            5⤵
            • Program crash
            PID:4132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2216
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:2008
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:2984
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:2224
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\5975271bda" /P "Admin:N"
                  5⤵
                    PID:1360
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    5⤵
                      PID:1272
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:2212
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 480
                  2⤵
                  • Program crash
                  PID:1260
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4840 -ip 4840
                1⤵
                  PID:1924
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3608 -ip 3608
                  1⤵
                    PID:4460
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5104 -ip 5104
                    1⤵
                      PID:4748
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2988
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1928

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                      Filesize

                      787KB

                      MD5

                      56434c8ed4c19d4973c9022bed5d65fc

                      SHA1

                      c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                      SHA256

                      d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                      SHA512

                      56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                      Filesize

                      787KB

                      MD5

                      56434c8ed4c19d4973c9022bed5d65fc

                      SHA1

                      c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                      SHA256

                      d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                      SHA512

                      56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                      Filesize

                      644KB

                      MD5

                      6fe2dd254687fd7b7b7a66610b0ce909

                      SHA1

                      af521d0a550c657e5bac77e010c5f9e960eb72c6

                      SHA256

                      dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                      SHA512

                      1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                      Filesize

                      644KB

                      MD5

                      6fe2dd254687fd7b7b7a66610b0ce909

                      SHA1

                      af521d0a550c657e5bac77e010c5f9e960eb72c6

                      SHA256

                      dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                      SHA512

                      1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                      Filesize

                      297KB

                      MD5

                      f0bef689623bac4a599617ca12e59f57

                      SHA1

                      181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                      SHA256

                      8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                      SHA512

                      433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                      Filesize

                      297KB

                      MD5

                      f0bef689623bac4a599617ca12e59f57

                      SHA1

                      181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                      SHA256

                      8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                      SHA512

                      433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                      Filesize

                      319KB

                      MD5

                      c8538173a294a6e854caa1bb6c6971d3

                      SHA1

                      8aae18c96ac645abd4762b544a6a632ae6d604ce

                      SHA256

                      6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                      SHA512

                      3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                      Filesize

                      319KB

                      MD5

                      c8538173a294a6e854caa1bb6c6971d3

                      SHA1

                      8aae18c96ac645abd4762b544a6a632ae6d604ce

                      SHA256

                      6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                      SHA512

                      3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                      Filesize

                      239KB

                      MD5

                      3b9ebc8cf697ac2228177a4836d30419

                      SHA1

                      da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                      SHA256

                      63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                      SHA512

                      802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                      Filesize

                      239KB

                      MD5

                      3b9ebc8cf697ac2228177a4836d30419

                      SHA1

                      da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                      SHA256

                      63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                      SHA512

                      802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

                    • memory/3296-163-0x00000000005C0000-0x00000000005CA000-memory.dmp

                      Filesize

                      40KB

                    • memory/3608-1126-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-1136-0x0000000006380000-0x0000000006542000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/3608-1141-0x0000000008030000-0x0000000008080000-memory.dmp

                      Filesize

                      320KB

                    • memory/3608-1140-0x0000000007FA0000-0x0000000008016000-memory.dmp

                      Filesize

                      472KB

                    • memory/3608-1138-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-1137-0x0000000006560000-0x0000000006A8C000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/3608-1135-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-1134-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-1133-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-1131-0x0000000005C60000-0x0000000005CC6000-memory.dmp

                      Filesize

                      408KB

                    • memory/3608-1130-0x0000000005BC0000-0x0000000005C52000-memory.dmp

                      Filesize

                      584KB

                    • memory/3608-1128-0x00000000058D0000-0x000000000590C000-memory.dmp

                      Filesize

                      240KB

                    • memory/3608-1127-0x00000000058B0000-0x00000000058C2000-memory.dmp

                      Filesize

                      72KB

                    • memory/3608-1125-0x0000000005770000-0x000000000587A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/3608-1124-0x00000000050D0000-0x00000000056E8000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/3608-304-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-307-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-302-0x0000000002520000-0x0000000002530000-memory.dmp

                      Filesize

                      64KB

                    • memory/3608-214-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-215-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-217-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-219-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-221-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-223-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-225-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-227-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-229-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-231-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-233-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-235-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-237-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-239-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-241-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-243-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-245-0x0000000005090000-0x00000000050CE000-memory.dmp

                      Filesize

                      248KB

                    • memory/3608-300-0x0000000000990000-0x00000000009DB000-memory.dmp

                      Filesize

                      300KB

                    • memory/4524-1147-0x0000000000A00000-0x0000000000A32000-memory.dmp

                      Filesize

                      200KB

                    • memory/4524-1148-0x0000000005310000-0x0000000005320000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-204-0x0000000000400000-0x00000000004BB000-memory.dmp

                      Filesize

                      748KB

                    • memory/4840-171-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-206-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-170-0x0000000000570000-0x000000000059D000-memory.dmp

                      Filesize

                      180KB

                    • memory/4840-205-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-181-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-202-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-201-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-199-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-197-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-195-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-189-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-208-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-193-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-185-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-187-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-179-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-177-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-209-0x0000000000400000-0x00000000004BB000-memory.dmp

                      Filesize

                      748KB

                    • memory/4840-183-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-175-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-174-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4840-173-0x0000000004CE0000-0x0000000005284000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4840-172-0x0000000002940000-0x0000000002950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4840-191-0x00000000025C0000-0x00000000025D2000-memory.dmp

                      Filesize

                      72KB

                    • memory/5104-134-0x0000000002550000-0x0000000002644000-memory.dmp

                      Filesize

                      976KB

                    • memory/5104-164-0x0000000000400000-0x00000000005A1000-memory.dmp

                      Filesize

                      1.6MB