Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    120s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/03/2023, 13:17

General

  • Target

    54edf529c92a24a8cdd31d680a3a522dfcabd71d67ea82748bf198dc63709360.exe

  • Size

    1.0MB

  • MD5

    21814cba1abb7cf494c1563be313fa53

  • SHA1

    cbdd5953310b44c80451c32262feac4f6fc5bc60

  • SHA256

    54edf529c92a24a8cdd31d680a3a522dfcabd71d67ea82748bf198dc63709360

  • SHA512

    7c18f136c01d2a4fa03503d204ce3c0a90efc515eaf633f111b2c177df5c013f2f6edc8a5ec9b862bb7cc6df5c8e2caa206d23fe9471192c9daf4abd8988c930

  • SSDEEP

    24576:7b8Ll91FlKor4hIlTkVNVbjzPlWXUG8q8mD5J6+56Dkn:Mncor4h6wVTok5dC5J6sK

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54edf529c92a24a8cdd31d680a3a522dfcabd71d67ea82748bf198dc63709360.exe
    "C:\Users\Admin\AppData\Local\Temp\54edf529c92a24a8cdd31d680a3a522dfcabd71d67ea82748bf198dc63709360.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7530.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7530.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2701.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2701.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino6077.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino6077.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4896
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9412.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9412.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3720
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7027.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7027.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3540
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\diw31s85.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\diw31s85.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en813455.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en813455.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge339351.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge339351.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4528
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4240
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5096
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:5112
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1628
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:400
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:1068
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1072
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:804

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge339351.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge339351.exe

                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7530.exe

                Filesize

                777KB

                MD5

                1ad6b941bf0bc81dc0f2e7e33398655d

                SHA1

                233f8a4cd7ccae4b14b2cb011b7be06b3437e89f

                SHA256

                d17d597169fe3de965dbbfb11b128907a4813747a8df46b3436ada9e55120dac

                SHA512

                8e9af948138777e28eb1556728baa940699b778e36d1e95e54b09918aa4eeae02bcb712e5b5b32d1dfe859300c9e427269b3d23cd7dbdc6625798e43319c7e51

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7530.exe

                Filesize

                777KB

                MD5

                1ad6b941bf0bc81dc0f2e7e33398655d

                SHA1

                233f8a4cd7ccae4b14b2cb011b7be06b3437e89f

                SHA256

                d17d597169fe3de965dbbfb11b128907a4813747a8df46b3436ada9e55120dac

                SHA512

                8e9af948138777e28eb1556728baa940699b778e36d1e95e54b09918aa4eeae02bcb712e5b5b32d1dfe859300c9e427269b3d23cd7dbdc6625798e43319c7e51

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en813455.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en813455.exe

                Filesize

                175KB

                MD5

                9796505f0e48281006d920d7c01dfe7b

                SHA1

                409d6a3760f682cc6e10c4f63e16755081d1342e

                SHA256

                acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                SHA512

                c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2701.exe

                Filesize

                634KB

                MD5

                394b2f4d03d061755c744f741dfc781e

                SHA1

                a8f1c6c134a23353bcb5edfb9d56f9f012f2dbda

                SHA256

                a74912a7a6343f707fcf223737039dcb2909248fe84ce32ae3cf2af73396e856

                SHA512

                709cc5f77cc47a53712b60edf0d49be0759ee8527d12b7b73fff88081db6a94f643253ddc3bf9d51e6c0088bd2b3181fe59453865946e25ff6c687dfcd87dd29

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino2701.exe

                Filesize

                634KB

                MD5

                394b2f4d03d061755c744f741dfc781e

                SHA1

                a8f1c6c134a23353bcb5edfb9d56f9f012f2dbda

                SHA256

                a74912a7a6343f707fcf223737039dcb2909248fe84ce32ae3cf2af73396e856

                SHA512

                709cc5f77cc47a53712b60edf0d49be0759ee8527d12b7b73fff88081db6a94f643253ddc3bf9d51e6c0088bd2b3181fe59453865946e25ff6c687dfcd87dd29

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\diw31s85.exe

                Filesize

                305KB

                MD5

                24030eb194b17caed9b6a6e0579d8bc1

                SHA1

                5a128d3f3af5af4a0c132f8af7c7c85702e21a91

                SHA256

                4f4b2a804722cf3d4d45f0ef67fd9b743a3ce9a649814f35070768d893c7b411

                SHA512

                09a4bcb9de6961182a01b4f855422e52cb927cacd4f2a96c9b16aca42b0c322d381fb5837a66ea0dd15fb21f1a3f44432b750444ac69f71e6f55af843dec61e7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\diw31s85.exe

                Filesize

                305KB

                MD5

                24030eb194b17caed9b6a6e0579d8bc1

                SHA1

                5a128d3f3af5af4a0c132f8af7c7c85702e21a91

                SHA256

                4f4b2a804722cf3d4d45f0ef67fd9b743a3ce9a649814f35070768d893c7b411

                SHA512

                09a4bcb9de6961182a01b4f855422e52cb927cacd4f2a96c9b16aca42b0c322d381fb5837a66ea0dd15fb21f1a3f44432b750444ac69f71e6f55af843dec61e7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino6077.exe

                Filesize

                314KB

                MD5

                6c005d2e52d4a83ba5e58518b73deee7

                SHA1

                3882eaf94aa0b8c08b2ae9cb8719707e92d458d0

                SHA256

                1fb0e5b7deafc3ee605428069986fdd8c12a19088e1a86cb0b6bb133f7744556

                SHA512

                315fd1ea6e86c933e0b7a8220b8f5801c9d95e4438e8f1420eec304d18c546b9debe305f69a76480f1b1cb45f0407acd5995aff0f717c8d7dc6f5ac4cc563e00

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino6077.exe

                Filesize

                314KB

                MD5

                6c005d2e52d4a83ba5e58518b73deee7

                SHA1

                3882eaf94aa0b8c08b2ae9cb8719707e92d458d0

                SHA256

                1fb0e5b7deafc3ee605428069986fdd8c12a19088e1a86cb0b6bb133f7744556

                SHA512

                315fd1ea6e86c933e0b7a8220b8f5801c9d95e4438e8f1420eec304d18c546b9debe305f69a76480f1b1cb45f0407acd5995aff0f717c8d7dc6f5ac4cc563e00

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9412.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9412.exe

                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7027.exe

                Filesize

                247KB

                MD5

                a6772fff3285a1766f99a73a673568d5

                SHA1

                7dbc82d5c04626c52a9383870f3c2b23f7478420

                SHA256

                cdd2051bbba1780d6d7dc79bba3eb89d5ab9161817f0fc615369fd56caacf7eb

                SHA512

                7946c9c4cde18299493f13858bfa23da973a3afd6c978b12c937062b836a4112f75b2fdc87f698f39eb76b82738ef464501707d3829906701c884978aa3fbbd5

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7027.exe

                Filesize

                247KB

                MD5

                a6772fff3285a1766f99a73a673568d5

                SHA1

                7dbc82d5c04626c52a9383870f3c2b23f7478420

                SHA256

                cdd2051bbba1780d6d7dc79bba3eb89d5ab9161817f0fc615369fd56caacf7eb

                SHA512

                7946c9c4cde18299493f13858bfa23da973a3afd6c978b12c937062b836a4112f75b2fdc87f698f39eb76b82738ef464501707d3829906701c884978aa3fbbd5

              • memory/3540-180-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-196-0x0000000000400000-0x00000000004BD000-memory.dmp

                Filesize

                756KB

              • memory/3540-176-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-178-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-172-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-182-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-184-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-186-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-188-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-189-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/3540-190-0x0000000002590000-0x00000000025A0000-memory.dmp

                Filesize

                64KB

              • memory/3540-191-0x0000000002590000-0x00000000025A0000-memory.dmp

                Filesize

                64KB

              • memory/3540-192-0x0000000002590000-0x00000000025A0000-memory.dmp

                Filesize

                64KB

              • memory/3540-194-0x0000000000400000-0x00000000004BD000-memory.dmp

                Filesize

                756KB

              • memory/3540-170-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-174-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-158-0x0000000002190000-0x00000000021AA000-memory.dmp

                Filesize

                104KB

              • memory/3540-159-0x0000000004A10000-0x0000000004F0E000-memory.dmp

                Filesize

                5.0MB

              • memory/3540-160-0x00000000025A0000-0x00000000025B8000-memory.dmp

                Filesize

                96KB

              • memory/3540-166-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-168-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-164-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-162-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3540-161-0x00000000025A0000-0x00000000025B2000-memory.dmp

                Filesize

                72KB

              • memory/3720-151-0x0000000000A10000-0x0000000000A1A000-memory.dmp

                Filesize

                40KB

              • memory/4212-152-0x0000000000400000-0x0000000000584000-memory.dmp

                Filesize

                1.5MB

              • memory/4212-140-0x00000000044F0000-0x00000000045E1000-memory.dmp

                Filesize

                964KB

              • memory/4600-1139-0x0000000005310000-0x0000000005320000-memory.dmp

                Filesize

                64KB

              • memory/4600-1137-0x0000000005500000-0x000000000554B000-memory.dmp

                Filesize

                300KB

              • memory/4600-1136-0x0000000000AC0000-0x0000000000AF2000-memory.dmp

                Filesize

                200KB

              • memory/4936-208-0x00000000005C0000-0x000000000060B000-memory.dmp

                Filesize

                300KB

              • memory/4936-218-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-220-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-222-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-224-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-226-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-228-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-230-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-232-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-234-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-236-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-238-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-1113-0x0000000005830000-0x0000000005E36000-memory.dmp

                Filesize

                6.0MB

              • memory/4936-1114-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

                Filesize

                1.0MB

              • memory/4936-1115-0x0000000002720000-0x0000000002732000-memory.dmp

                Filesize

                72KB

              • memory/4936-1116-0x0000000004CD0000-0x0000000004D0E000-memory.dmp

                Filesize

                248KB

              • memory/4936-1117-0x0000000005320000-0x000000000536B000-memory.dmp

                Filesize

                300KB

              • memory/4936-1118-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-1120-0x00000000054A0000-0x0000000005506000-memory.dmp

                Filesize

                408KB

              • memory/4936-1122-0x0000000006180000-0x0000000006212000-memory.dmp

                Filesize

                584KB

              • memory/4936-1123-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-1124-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-1125-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-1126-0x00000000074F0000-0x0000000007566000-memory.dmp

                Filesize

                472KB

              • memory/4936-1127-0x0000000007580000-0x00000000075D0000-memory.dmp

                Filesize

                320KB

              • memory/4936-1128-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-1129-0x00000000076F0000-0x00000000078B2000-memory.dmp

                Filesize

                1.8MB

              • memory/4936-1130-0x00000000078C0000-0x0000000007DEC000-memory.dmp

                Filesize

                5.2MB

              • memory/4936-213-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-216-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-214-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-210-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-211-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-209-0x0000000004D10000-0x0000000004D20000-memory.dmp

                Filesize

                64KB

              • memory/4936-206-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-204-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-203-0x00000000023D0000-0x000000000240E000-memory.dmp

                Filesize

                248KB

              • memory/4936-202-0x00000000023D0000-0x0000000002414000-memory.dmp

                Filesize

                272KB

              • memory/4936-201-0x0000000002040000-0x0000000002086000-memory.dmp

                Filesize

                280KB