Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    108s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2023, 09:08

General

  • Target

    2e4f98ce6f401c8c8afea73bec40375c8e95de2c24b6499dbf24d43978cb4f31.exe

  • Size

    1.1MB

  • MD5

    eea29f870f08e19e22b57946b2dd1243

  • SHA1

    64978e5fb9cb5048b34b7afe3ccae1fed0f52e7e

  • SHA256

    2e4f98ce6f401c8c8afea73bec40375c8e95de2c24b6499dbf24d43978cb4f31

  • SHA512

    04d0c403aeed4888fbb5d9bcd50f425891147c172b4d3f4a28fc9411c605d149b62cab39119e5e03474b3ba92a6b4c908f9b2efa852b392486752ae279d616b3

  • SSDEEP

    24576:ufAWGVgUEf9R6E1iNQJKFzdHOOTc6nA9AcFn9gyCV5JNNBWUD:ufAWG6L1RP1iUKDOOT0793CTC

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e4f98ce6f401c8c8afea73bec40375c8e95de2c24b6499dbf24d43978cb4f31.exe
    "C:\Users\Admin\AppData\Local\Temp\2e4f98ce6f401c8c8afea73bec40375c8e95de2c24b6499dbf24d43978cb4f31.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6909.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6909.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4649.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4649.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:456
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9726.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9726.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8215.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8215.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8871.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8871.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1100
              6⤵
              • Program crash
              PID:3468
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvt46s77.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvt46s77.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1900
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 1336
            5⤵
            • Program crash
            PID:1108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en185244.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en185244.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge214537.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge214537.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2496
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1280
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4116
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4896
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4568
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1432
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:5108
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4080
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 528
                  2⤵
                  • Program crash
                  PID:4192
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4852 -ip 4852
                1⤵
                  PID:4864
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1900 -ip 1900
                  1⤵
                    PID:3224
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3388 -ip 3388
                    1⤵
                      PID:4480
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3300

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge214537.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge214537.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6909.exe

                      Filesize

                      823KB

                      MD5

                      3f6ee6e4420abf99de71289f74c55d0e

                      SHA1

                      d97bc3954988e228f74e54a103ac16540f5609ef

                      SHA256

                      78e8c6b9aca10f170e2460302e00e98dbeb717b7c1b810e6cb538c2b5b037e1f

                      SHA512

                      8920f3dc52059777d09f72d2bbc287debeb31bdfcb02168428f3cc16cafa266e3c9181b7b70c4169356042d4a10ce93a2ed1e450756d2aa18afacb390d16c9d4

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6909.exe

                      Filesize

                      823KB

                      MD5

                      3f6ee6e4420abf99de71289f74c55d0e

                      SHA1

                      d97bc3954988e228f74e54a103ac16540f5609ef

                      SHA256

                      78e8c6b9aca10f170e2460302e00e98dbeb717b7c1b810e6cb538c2b5b037e1f

                      SHA512

                      8920f3dc52059777d09f72d2bbc287debeb31bdfcb02168428f3cc16cafa266e3c9181b7b70c4169356042d4a10ce93a2ed1e450756d2aa18afacb390d16c9d4

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en185244.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en185244.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4649.exe

                      Filesize

                      681KB

                      MD5

                      a17645b0619c9cee206b9b5005938f62

                      SHA1

                      17dc77dbd22dda49435980ea64f16f50af712135

                      SHA256

                      1ffdc86c5082859f407c64f0957cb96fc0f493d7965361576917b6b81ec06611

                      SHA512

                      ecd8b7336e01de9fbfb530a7a9c52c667fe3cc80691e731e7d986ef0704649d1468417610ba74fc318cfac9bccaa75e16a89b2d0ea8fc4423c96601eedad53f5

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4649.exe

                      Filesize

                      681KB

                      MD5

                      a17645b0619c9cee206b9b5005938f62

                      SHA1

                      17dc77dbd22dda49435980ea64f16f50af712135

                      SHA256

                      1ffdc86c5082859f407c64f0957cb96fc0f493d7965361576917b6b81ec06611

                      SHA512

                      ecd8b7336e01de9fbfb530a7a9c52c667fe3cc80691e731e7d986ef0704649d1468417610ba74fc318cfac9bccaa75e16a89b2d0ea8fc4423c96601eedad53f5

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvt46s77.exe

                      Filesize

                      343KB

                      MD5

                      b58a3c5b0cc5922dbd8cec1bf434f743

                      SHA1

                      1807b33a35f497e2ef919c921b609ee391a0e33a

                      SHA256

                      12f3bdf0699561e14986911f14e79b63621511d1e13e9b922f9395714953f487

                      SHA512

                      cea3f662e7cf35de07333e3dd95e4f5c011a8bb815c85d4898ef4ac3868f992ac37f466640b1bcc2b7f1891f225fb21054fe8fa8e310d883be029ae33bc91cb7

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvt46s77.exe

                      Filesize

                      343KB

                      MD5

                      b58a3c5b0cc5922dbd8cec1bf434f743

                      SHA1

                      1807b33a35f497e2ef919c921b609ee391a0e33a

                      SHA256

                      12f3bdf0699561e14986911f14e79b63621511d1e13e9b922f9395714953f487

                      SHA512

                      cea3f662e7cf35de07333e3dd95e4f5c011a8bb815c85d4898ef4ac3868f992ac37f466640b1bcc2b7f1891f225fb21054fe8fa8e310d883be029ae33bc91cb7

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9726.exe

                      Filesize

                      337KB

                      MD5

                      8cb92be8a236eb8f633e552aaa0f7e22

                      SHA1

                      1d174a28c35dc7b47ce83924e83b1e0099802265

                      SHA256

                      3ad53ce31b9dadbd99fa7b714b29b80416e0ccd109d117476f4baba2cb70cf11

                      SHA512

                      bea06f502bfaba18eff6a4d06bd91dfff1642c441d1320ec62a8e61ee03d78b5a4784186366ea5cc861b8b9ebb0a7245480c1c2e47378be87f6b3c1970f30c85

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino9726.exe

                      Filesize

                      337KB

                      MD5

                      8cb92be8a236eb8f633e552aaa0f7e22

                      SHA1

                      1d174a28c35dc7b47ce83924e83b1e0099802265

                      SHA256

                      3ad53ce31b9dadbd99fa7b714b29b80416e0ccd109d117476f4baba2cb70cf11

                      SHA512

                      bea06f502bfaba18eff6a4d06bd91dfff1642c441d1320ec62a8e61ee03d78b5a4784186366ea5cc861b8b9ebb0a7245480c1c2e47378be87f6b3c1970f30c85

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8215.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8215.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8871.exe

                      Filesize

                      285KB

                      MD5

                      aeafc76d80a9302266a9f1b29c902301

                      SHA1

                      9b08310586c10f22439b66d8ce7ef536003c6b4e

                      SHA256

                      14dfd877335d4eea9a0dbdbba765b6e8ce676a6f6ad3d837022cf5ccf1e00400

                      SHA512

                      3da5535584a3753103e4b60864fe62e82f6bdd72ad3624dc43aa698a97f5eb54e5503304a284327ae3a1779b58d9863feeeb588564e706a3494ea06565eba6f6

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8871.exe

                      Filesize

                      285KB

                      MD5

                      aeafc76d80a9302266a9f1b29c902301

                      SHA1

                      9b08310586c10f22439b66d8ce7ef536003c6b4e

                      SHA256

                      14dfd877335d4eea9a0dbdbba765b6e8ce676a6f6ad3d837022cf5ccf1e00400

                      SHA512

                      3da5535584a3753103e4b60864fe62e82f6bdd72ad3624dc43aa698a97f5eb54e5503304a284327ae3a1779b58d9863feeeb588564e706a3494ea06565eba6f6

                    • memory/216-1147-0x0000000005700000-0x0000000005710000-memory.dmp

                      Filesize

                      64KB

                    • memory/216-1146-0x0000000000E40000-0x0000000000E72000-memory.dmp

                      Filesize

                      200KB

                    • memory/1900-1126-0x0000000005A00000-0x0000000005A12000-memory.dmp

                      Filesize

                      72KB

                    • memory/1900-1133-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-1141-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-1138-0x0000000006EA0000-0x0000000006EF0000-memory.dmp

                      Filesize

                      320KB

                    • memory/1900-1137-0x0000000006E00000-0x0000000006E76000-memory.dmp

                      Filesize

                      472KB

                    • memory/1900-1136-0x00000000067B0000-0x0000000006CDC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/1900-1135-0x00000000065D0000-0x0000000006792000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/1900-1134-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-1132-0x0000000005DB0000-0x0000000005E16000-memory.dmp

                      Filesize

                      408KB

                    • memory/1900-1131-0x0000000005D10000-0x0000000005DA2000-memory.dmp

                      Filesize

                      584KB

                    • memory/1900-1129-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-1127-0x0000000005A20000-0x0000000005A5C000-memory.dmp

                      Filesize

                      240KB

                    • memory/1900-1125-0x00000000058D0000-0x00000000059DA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/1900-1124-0x00000000052B0000-0x00000000058C8000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/1900-369-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-368-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-366-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                      Filesize

                      64KB

                    • memory/1900-365-0x0000000002150000-0x000000000219B000-memory.dmp

                      Filesize

                      300KB

                    • memory/1900-214-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-215-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-217-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-219-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-221-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-223-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-225-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-227-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-229-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-231-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-233-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-235-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-237-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-239-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-241-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-243-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1900-245-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2908-163-0x0000000000B20000-0x0000000000B2A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3388-138-0x00000000025B0000-0x00000000026AD000-memory.dmp

                      Filesize

                      1012KB

                    • memory/3388-164-0x0000000000400000-0x000000000059B000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4852-195-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-191-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-207-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-208-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-204-0x0000000000400000-0x00000000004C6000-memory.dmp

                      Filesize

                      792KB

                    • memory/4852-202-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-201-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-200-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-187-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-199-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-197-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-183-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-193-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-206-0x0000000004C10000-0x0000000004C20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4852-189-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-181-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-179-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-177-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-175-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-173-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-172-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB

                    • memory/4852-171-0x0000000004C20000-0x00000000051C4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4852-170-0x0000000000620000-0x000000000064D000-memory.dmp

                      Filesize

                      180KB

                    • memory/4852-209-0x0000000000400000-0x00000000004C6000-memory.dmp

                      Filesize

                      792KB

                    • memory/4852-185-0x00000000023F0000-0x0000000002402000-memory.dmp

                      Filesize

                      72KB