Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 01:48

General

  • Target

    8a732bc777d147791d4d04da3814bd341735ed2ccbe89a0fc944e0c7815d58dd.exe

  • Size

    1.0MB

  • MD5

    065f53ea8607b6b184dac41c2357be59

  • SHA1

    c763cf81e6bec72022766204bbefe5fbf665ff65

  • SHA256

    8a732bc777d147791d4d04da3814bd341735ed2ccbe89a0fc944e0c7815d58dd

  • SHA512

    2349d42d454c1825d9f304f52097eaa3aaeae35048074a72f0699b9f8eb013db9c5ee57a10a614f00cce6a8863581ab0de4630a436dbcaaf745eb5401ee55fb1

  • SSDEEP

    24576:U9ycUdpSXnG1+02gMBdes3z/X67Fqy++yxGZ4kV0waGuU:YycUdpMDtNy5qb+RykV0wo

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a732bc777d147791d4d04da3814bd341735ed2ccbe89a0fc944e0c7815d58dd.exe
    "C:\Users\Admin\AppData\Local\Temp\8a732bc777d147791d4d04da3814bd341735ed2ccbe89a0fc944e0c7815d58dd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4724
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:328
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 1080
              6⤵
              • Program crash
              PID:1092
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2656
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1316
            5⤵
            • Program crash
            PID:5108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1468
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4136
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:5012
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1060
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\5975271bda" /P "Admin:N"
                  5⤵
                    PID:3868
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    5⤵
                      PID:4524
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:5036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 440
                  2⤵
                  • Program crash
                  PID:1108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 328 -ip 328
                1⤵
                  PID:1776
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2656 -ip 2656
                  1⤵
                    PID:500
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4396 -ip 4396
                    1⤵
                      PID:4940
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4568
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:332

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge338304.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe

                      Filesize

                      772KB

                      MD5

                      1f43b76285fd9f1d5c220842bf575fb1

                      SHA1

                      d2f93a69eb535e433260ac93eeabb36cfd916f85

                      SHA256

                      e0148620a45ee687657e56135ef49ddcb0d67cf30e2d0ffe0fa75e83a0dfdc19

                      SHA512

                      c683f883ffbfdcd500ac7cf06756211610bb2a7a8861671b21a0043ea59b6f9522706a78f3caa511657bbb5ab8f80f9a5301cd87b590999207ad17e6d9bb6dc6

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6506.exe

                      Filesize

                      772KB

                      MD5

                      1f43b76285fd9f1d5c220842bf575fb1

                      SHA1

                      d2f93a69eb535e433260ac93eeabb36cfd916f85

                      SHA256

                      e0148620a45ee687657e56135ef49ddcb0d67cf30e2d0ffe0fa75e83a0dfdc19

                      SHA512

                      c683f883ffbfdcd500ac7cf06756211610bb2a7a8861671b21a0043ea59b6f9522706a78f3caa511657bbb5ab8f80f9a5301cd87b590999207ad17e6d9bb6dc6

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe

                      Filesize

                      175KB

                      MD5

                      8b0ea3120d3d291045b26bcea5ccef54

                      SHA1

                      07ed9587057ae936ca0610051142a4add4f7b6aa

                      SHA256

                      6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

                      SHA512

                      6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en095608.exe

                      Filesize

                      175KB

                      MD5

                      8b0ea3120d3d291045b26bcea5ccef54

                      SHA1

                      07ed9587057ae936ca0610051142a4add4f7b6aa

                      SHA256

                      6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

                      SHA512

                      6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe

                      Filesize

                      629KB

                      MD5

                      02cac318fe7a43cc9e4b5037cd9c5197

                      SHA1

                      0c82042aee3e94c4fcd67714a6069d16a81ac44a

                      SHA256

                      e8837f43fd8ddb89a6b5da9b8d2d8755676792d77067110045077dfa473a9d90

                      SHA512

                      fb3340972e962ba7869f821d34d3ce8f9bc0fa6f8071451e2d98a21b2e04118d8d07a37ba3f14aa1adf9b5ec7bc16ecfe5f6c814c65094f8005c7561a16e09c8

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8126.exe

                      Filesize

                      629KB

                      MD5

                      02cac318fe7a43cc9e4b5037cd9c5197

                      SHA1

                      0c82042aee3e94c4fcd67714a6069d16a81ac44a

                      SHA256

                      e8837f43fd8ddb89a6b5da9b8d2d8755676792d77067110045077dfa473a9d90

                      SHA512

                      fb3340972e962ba7869f821d34d3ce8f9bc0fa6f8071451e2d98a21b2e04118d8d07a37ba3f14aa1adf9b5ec7bc16ecfe5f6c814c65094f8005c7561a16e09c8

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe

                      Filesize

                      295KB

                      MD5

                      8dd11c4c5ac0fa9688da6b99bd23aa9e

                      SHA1

                      9de5486d62ab0b4d18ea99c531a31b06fd9badbe

                      SHA256

                      c97005af89bd916bc4ef8974ea8f907d7cf3c7d5939c8f0aa445e4a1c24218bf

                      SHA512

                      26618d51cb282be9e6c25823071f5ce74e8d682cca7c08e44f030a0954f82e2fb2ae8df7356fc43ec35d6bbee723a24223f58975074a5037df74106e31a4388e

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dGf92s79.exe

                      Filesize

                      295KB

                      MD5

                      8dd11c4c5ac0fa9688da6b99bd23aa9e

                      SHA1

                      9de5486d62ab0b4d18ea99c531a31b06fd9badbe

                      SHA256

                      c97005af89bd916bc4ef8974ea8f907d7cf3c7d5939c8f0aa445e4a1c24218bf

                      SHA512

                      26618d51cb282be9e6c25823071f5ce74e8d682cca7c08e44f030a0954f82e2fb2ae8df7356fc43ec35d6bbee723a24223f58975074a5037df74106e31a4388e

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe

                      Filesize

                      312KB

                      MD5

                      92d4eb19dcfd02626efba239802f525d

                      SHA1

                      2c2977f980689e106ec3590f3f4eececf7b32d7b

                      SHA256

                      39bd7aa54f8f001e970c04a9c86eea347f0c74d74203a18db442507f20f3a5b9

                      SHA512

                      4794846e26ae32a7bb446e1b6f87f65c9420fa6a86619217a13e8be66b50bdd223b7b7903edae4d9f68da997207a7d8c0d40126fcd652d5ea8dc2d94fb8c1848

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3107.exe

                      Filesize

                      312KB

                      MD5

                      92d4eb19dcfd02626efba239802f525d

                      SHA1

                      2c2977f980689e106ec3590f3f4eececf7b32d7b

                      SHA256

                      39bd7aa54f8f001e970c04a9c86eea347f0c74d74203a18db442507f20f3a5b9

                      SHA512

                      4794846e26ae32a7bb446e1b6f87f65c9420fa6a86619217a13e8be66b50bdd223b7b7903edae4d9f68da997207a7d8c0d40126fcd652d5ea8dc2d94fb8c1848

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus1653.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe

                      Filesize

                      237KB

                      MD5

                      cf47d0ad67b0b5f2293b428f019a6b45

                      SHA1

                      8edced9ed9309a673e71776fe05585f1d812168e

                      SHA256

                      4431953d8dd481a1c90b70a471cf01f42ca790b9a04c77657abb76b01ca7e590

                      SHA512

                      897bd27dde0546720e936a9eec7232d9d4b3ddf55ab761e23e7585b8baf7429677bee693bdbce537a27895db35468c1e4e116020340fe04fa7ec87cf6fe542fa

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con8421.exe

                      Filesize

                      237KB

                      MD5

                      cf47d0ad67b0b5f2293b428f019a6b45

                      SHA1

                      8edced9ed9309a673e71776fe05585f1d812168e

                      SHA256

                      4431953d8dd481a1c90b70a471cf01f42ca790b9a04c77657abb76b01ca7e590

                      SHA512

                      897bd27dde0546720e936a9eec7232d9d4b3ddf55ab761e23e7585b8baf7429677bee693bdbce537a27895db35468c1e4e116020340fe04fa7ec87cf6fe542fa

                    • memory/328-191-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-207-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-189-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-185-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-193-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-195-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-197-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-199-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-200-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-201-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-202-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-204-0x0000000000400000-0x00000000004BA000-memory.dmp

                      Filesize

                      744KB

                    • memory/328-206-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-187-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-208-0x0000000002420000-0x0000000002430000-memory.dmp

                      Filesize

                      64KB

                    • memory/328-209-0x0000000000400000-0x00000000004BA000-memory.dmp

                      Filesize

                      744KB

                    • memory/328-183-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-181-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-179-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-177-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-175-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-173-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-172-0x0000000002430000-0x0000000002442000-memory.dmp

                      Filesize

                      72KB

                    • memory/328-171-0x0000000004C40000-0x00000000051E4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/328-170-0x0000000000590000-0x00000000005BD000-memory.dmp

                      Filesize

                      180KB

                    • memory/1568-1146-0x0000000000C30000-0x0000000000C62000-memory.dmp

                      Filesize

                      200KB

                    • memory/1568-1147-0x0000000005880000-0x0000000005890000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-223-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-238-0x00000000005A0000-0x00000000005EB000-memory.dmp

                      Filesize

                      300KB

                    • memory/2656-237-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-240-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-242-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-241-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-244-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-246-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-248-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-1123-0x0000000005120000-0x0000000005738000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/2656-1124-0x0000000005770000-0x000000000587A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/2656-1125-0x00000000058B0000-0x00000000058C2000-memory.dmp

                      Filesize

                      72KB

                    • memory/2656-1126-0x00000000058D0000-0x000000000590C000-memory.dmp

                      Filesize

                      240KB

                    • memory/2656-1127-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-1129-0x0000000005BC0000-0x0000000005C26000-memory.dmp

                      Filesize

                      408KB

                    • memory/2656-1130-0x0000000006270000-0x0000000006302000-memory.dmp

                      Filesize

                      584KB

                    • memory/2656-1132-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-1133-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-1134-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-1135-0x00000000065A0000-0x0000000006616000-memory.dmp

                      Filesize

                      472KB

                    • memory/2656-1136-0x0000000006630000-0x0000000006680000-memory.dmp

                      Filesize

                      320KB

                    • memory/2656-1137-0x00000000067F0000-0x00000000069B2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/2656-1138-0x00000000069C0000-0x0000000006EEC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/2656-1141-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2656-235-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-233-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-231-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-229-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-227-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-225-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-221-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-219-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-217-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-215-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2656-214-0x0000000004AC0000-0x0000000004AFE000-memory.dmp

                      Filesize

                      248KB

                    • memory/4396-163-0x0000000002490000-0x0000000002580000-memory.dmp

                      Filesize

                      960KB

                    • memory/4396-164-0x0000000000400000-0x0000000000583000-memory.dmp

                      Filesize

                      1.5MB

                    • memory/4724-162-0x00000000002E0000-0x00000000002EA000-memory.dmp

                      Filesize

                      40KB