Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 00:13

General

  • Target

    8f3622ef77c03c00a84f353635e217a90377523f0935748bb03ddd13d6be116b.exe

  • Size

    1.0MB

  • MD5

    16fb5020c3a5dd7fd5bb7b3b7d440bc3

  • SHA1

    58f7b351c024d247b8fb31d53255ef44de858cd0

  • SHA256

    8f3622ef77c03c00a84f353635e217a90377523f0935748bb03ddd13d6be116b

  • SHA512

    9b7eacd0a598e190131ee174592883c628853a407c72ae8b8138138d73627d9aa3578950bef0da929141e649a8b3f3d590b9bf7df065c85c61dd08e74c115406

  • SSDEEP

    24576:89ycUdpSXnG1+02gMBdes3z/X67Fqy++yxGZ4kV0waGuU:AycUdpMDtNy5qb+RykV0wo

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f3622ef77c03c00a84f353635e217a90377523f0935748bb03ddd13d6be116b.exe
    "C:\Users\Admin\AppData\Local\Temp\8f3622ef77c03c00a84f353635e217a90377523f0935748bb03ddd13d6be116b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3308
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4052
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 1084
              6⤵
              • Program crash
              PID:4384
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5008
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 1364
            5⤵
            • Program crash
            PID:5064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:460
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4940
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:1404
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4748
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4800
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:996
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:2976
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 440
                  2⤵
                  • Program crash
                  PID:3600
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4052 -ip 4052
                1⤵
                  PID:4680
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5008 -ip 5008
                  1⤵
                    PID:4720
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2624 -ip 2624
                    1⤵
                      PID:1732
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3852

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe

                      Filesize

                      772KB

                      MD5

                      1f43b76285fd9f1d5c220842bf575fb1

                      SHA1

                      d2f93a69eb535e433260ac93eeabb36cfd916f85

                      SHA256

                      e0148620a45ee687657e56135ef49ddcb0d67cf30e2d0ffe0fa75e83a0dfdc19

                      SHA512

                      c683f883ffbfdcd500ac7cf06756211610bb2a7a8861671b21a0043ea59b6f9522706a78f3caa511657bbb5ab8f80f9a5301cd87b590999207ad17e6d9bb6dc6

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe

                      Filesize

                      772KB

                      MD5

                      1f43b76285fd9f1d5c220842bf575fb1

                      SHA1

                      d2f93a69eb535e433260ac93eeabb36cfd916f85

                      SHA256

                      e0148620a45ee687657e56135ef49ddcb0d67cf30e2d0ffe0fa75e83a0dfdc19

                      SHA512

                      c683f883ffbfdcd500ac7cf06756211610bb2a7a8861671b21a0043ea59b6f9522706a78f3caa511657bbb5ab8f80f9a5301cd87b590999207ad17e6d9bb6dc6

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe

                      Filesize

                      175KB

                      MD5

                      8b0ea3120d3d291045b26bcea5ccef54

                      SHA1

                      07ed9587057ae936ca0610051142a4add4f7b6aa

                      SHA256

                      6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

                      SHA512

                      6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe

                      Filesize

                      175KB

                      MD5

                      8b0ea3120d3d291045b26bcea5ccef54

                      SHA1

                      07ed9587057ae936ca0610051142a4add4f7b6aa

                      SHA256

                      6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

                      SHA512

                      6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe

                      Filesize

                      629KB

                      MD5

                      02cac318fe7a43cc9e4b5037cd9c5197

                      SHA1

                      0c82042aee3e94c4fcd67714a6069d16a81ac44a

                      SHA256

                      e8837f43fd8ddb89a6b5da9b8d2d8755676792d77067110045077dfa473a9d90

                      SHA512

                      fb3340972e962ba7869f821d34d3ce8f9bc0fa6f8071451e2d98a21b2e04118d8d07a37ba3f14aa1adf9b5ec7bc16ecfe5f6c814c65094f8005c7561a16e09c8

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe

                      Filesize

                      629KB

                      MD5

                      02cac318fe7a43cc9e4b5037cd9c5197

                      SHA1

                      0c82042aee3e94c4fcd67714a6069d16a81ac44a

                      SHA256

                      e8837f43fd8ddb89a6b5da9b8d2d8755676792d77067110045077dfa473a9d90

                      SHA512

                      fb3340972e962ba7869f821d34d3ce8f9bc0fa6f8071451e2d98a21b2e04118d8d07a37ba3f14aa1adf9b5ec7bc16ecfe5f6c814c65094f8005c7561a16e09c8

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe

                      Filesize

                      295KB

                      MD5

                      8dd11c4c5ac0fa9688da6b99bd23aa9e

                      SHA1

                      9de5486d62ab0b4d18ea99c531a31b06fd9badbe

                      SHA256

                      c97005af89bd916bc4ef8974ea8f907d7cf3c7d5939c8f0aa445e4a1c24218bf

                      SHA512

                      26618d51cb282be9e6c25823071f5ce74e8d682cca7c08e44f030a0954f82e2fb2ae8df7356fc43ec35d6bbee723a24223f58975074a5037df74106e31a4388e

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe

                      Filesize

                      295KB

                      MD5

                      8dd11c4c5ac0fa9688da6b99bd23aa9e

                      SHA1

                      9de5486d62ab0b4d18ea99c531a31b06fd9badbe

                      SHA256

                      c97005af89bd916bc4ef8974ea8f907d7cf3c7d5939c8f0aa445e4a1c24218bf

                      SHA512

                      26618d51cb282be9e6c25823071f5ce74e8d682cca7c08e44f030a0954f82e2fb2ae8df7356fc43ec35d6bbee723a24223f58975074a5037df74106e31a4388e

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe

                      Filesize

                      312KB

                      MD5

                      92d4eb19dcfd02626efba239802f525d

                      SHA1

                      2c2977f980689e106ec3590f3f4eececf7b32d7b

                      SHA256

                      39bd7aa54f8f001e970c04a9c86eea347f0c74d74203a18db442507f20f3a5b9

                      SHA512

                      4794846e26ae32a7bb446e1b6f87f65c9420fa6a86619217a13e8be66b50bdd223b7b7903edae4d9f68da997207a7d8c0d40126fcd652d5ea8dc2d94fb8c1848

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe

                      Filesize

                      312KB

                      MD5

                      92d4eb19dcfd02626efba239802f525d

                      SHA1

                      2c2977f980689e106ec3590f3f4eececf7b32d7b

                      SHA256

                      39bd7aa54f8f001e970c04a9c86eea347f0c74d74203a18db442507f20f3a5b9

                      SHA512

                      4794846e26ae32a7bb446e1b6f87f65c9420fa6a86619217a13e8be66b50bdd223b7b7903edae4d9f68da997207a7d8c0d40126fcd652d5ea8dc2d94fb8c1848

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe

                      Filesize

                      237KB

                      MD5

                      cf47d0ad67b0b5f2293b428f019a6b45

                      SHA1

                      8edced9ed9309a673e71776fe05585f1d812168e

                      SHA256

                      4431953d8dd481a1c90b70a471cf01f42ca790b9a04c77657abb76b01ca7e590

                      SHA512

                      897bd27dde0546720e936a9eec7232d9d4b3ddf55ab761e23e7585b8baf7429677bee693bdbce537a27895db35468c1e4e116020340fe04fa7ec87cf6fe542fa

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe

                      Filesize

                      237KB

                      MD5

                      cf47d0ad67b0b5f2293b428f019a6b45

                      SHA1

                      8edced9ed9309a673e71776fe05585f1d812168e

                      SHA256

                      4431953d8dd481a1c90b70a471cf01f42ca790b9a04c77657abb76b01ca7e590

                      SHA512

                      897bd27dde0546720e936a9eec7232d9d4b3ddf55ab761e23e7585b8baf7429677bee693bdbce537a27895db35468c1e4e116020340fe04fa7ec87cf6fe542fa

                    • memory/2624-164-0x0000000000400000-0x0000000000583000-memory.dmp

                      Filesize

                      1.5MB

                    • memory/2624-145-0x00000000024C0000-0x00000000025B0000-memory.dmp

                      Filesize

                      960KB

                    • memory/3308-163-0x0000000000E50000-0x0000000000E5A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3992-1146-0x00000000051E0000-0x00000000051F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3992-1144-0x0000000000900000-0x0000000000932000-memory.dmp

                      Filesize

                      200KB

                    • memory/4052-186-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-190-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-192-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-194-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-196-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-198-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-200-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-202-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-204-0x0000000000400000-0x00000000004BA000-memory.dmp

                      Filesize

                      744KB

                    • memory/4052-205-0x0000000004C30000-0x0000000004C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4052-206-0x0000000004C30000-0x0000000004C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4052-208-0x0000000000400000-0x00000000004BA000-memory.dmp

                      Filesize

                      744KB

                    • memory/4052-188-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-184-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-182-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-180-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-178-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-176-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-175-0x0000000002420000-0x0000000002432000-memory.dmp

                      Filesize

                      72KB

                    • memory/4052-174-0x0000000004C30000-0x0000000004C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4052-173-0x0000000004C30000-0x0000000004C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4052-172-0x0000000004C30000-0x0000000004C40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4052-171-0x00000000004C0000-0x00000000004ED000-memory.dmp

                      Filesize

                      180KB

                    • memory/4052-170-0x0000000004C40000-0x00000000051E4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/5008-218-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-234-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-236-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-238-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-240-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-242-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-244-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-464-0x00000000004D0000-0x000000000051B000-memory.dmp

                      Filesize

                      300KB

                    • memory/5008-468-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-465-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-469-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-1123-0x0000000005310000-0x0000000005928000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/5008-1124-0x0000000004BE0000-0x0000000004CEA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/5008-1125-0x0000000002770000-0x0000000002782000-memory.dmp

                      Filesize

                      72KB

                    • memory/5008-1126-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-1127-0x0000000004CF0000-0x0000000004D2C000-memory.dmp

                      Filesize

                      240KB

                    • memory/5008-1129-0x0000000005BC0000-0x0000000005C52000-memory.dmp

                      Filesize

                      584KB

                    • memory/5008-1131-0x0000000005C60000-0x0000000005CC6000-memory.dmp

                      Filesize

                      408KB

                    • memory/5008-1132-0x00000000064D0000-0x0000000006692000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/5008-1133-0x00000000066A0000-0x0000000006BCC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/5008-1134-0x0000000006DF0000-0x0000000006E66000-memory.dmp

                      Filesize

                      472KB

                    • memory/5008-1135-0x0000000006E80000-0x0000000006ED0000-memory.dmp

                      Filesize

                      320KB

                    • memory/5008-1136-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-1137-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-1139-0x0000000004D50000-0x0000000004D60000-memory.dmp

                      Filesize

                      64KB

                    • memory/5008-230-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-232-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-228-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-224-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-226-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-222-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-220-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-216-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-214-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB

                    • memory/5008-213-0x0000000002510000-0x000000000254E000-memory.dmp

                      Filesize

                      248KB