Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 07:12

General

  • Target

    55fd914cab3907f1720f76340d0948ea7a311433f2975c77b45084e3faa5360f.exe

  • Size

    1.1MB

  • MD5

    cc2318137b46ef2c974cd6f3dbd615de

  • SHA1

    051ad68bb768397d10ab56ff20ff8a9eb7e45077

  • SHA256

    55fd914cab3907f1720f76340d0948ea7a311433f2975c77b45084e3faa5360f

  • SHA512

    50f34a32ba4e12c5a195d3df035d4348c45045f136c37573c0fcaa49b6a025bbc222095a3b3ddc85ca7deef0ba293c486c968baeea868a448c0f7a14e6c66303

  • SSDEEP

    24576:hBob971gPQISVZLYOd8kT2lZEWHztrxbOb2om3rch18D362:hG7KSVZLYXvlaOxbOWrF

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

sito

C2

193.233.20.28:4125

Attributes
  • auth_value

    030f94d8e396dbe51ce339b815cdad17

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55fd914cab3907f1720f76340d0948ea7a311433f2975c77b45084e3faa5360f.exe
    "C:\Users\Admin\AppData\Local\Temp\55fd914cab3907f1720f76340d0948ea7a311433f2975c77b45084e3faa5360f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3798.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3798.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7002.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7002.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3035.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3035.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5992.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5992.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:352
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7447.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7447.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1840
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1088
              6⤵
              • Program crash
              PID:5012
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dtR78s46.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dtR78s46.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1316
            5⤵
            • Program crash
            PID:4980
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en738609.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en738609.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge884549.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge884549.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4688
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1548
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5044
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3116
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4928
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\5975271bda" /P "Admin:N"
                  5⤵
                    PID:1640
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    5⤵
                      PID:4460
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:5004
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 484
                  2⤵
                  • Program crash
                  PID:3184
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1840 -ip 1840
                1⤵
                  PID:4256
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2416 -ip 2416
                  1⤵
                    PID:2972
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4908 -ip 4908
                    1⤵
                      PID:3404
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2796
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2500

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge884549.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge884549.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3798.exe

                      Filesize

                      879KB

                      MD5

                      562860cf2fd0b9c2131f328ea539ea8c

                      SHA1

                      d7f0d4505bec91950d0ba8cc7ed9742b99209b8b

                      SHA256

                      8f419f40b19a2e562068f60ce85abcfd1adfaaa252202b3e1839bd6885a4c764

                      SHA512

                      3928f86c229031b6b72d63e87856d6ff45081875a5d3a98aaa30ea73c7c5fdcb2c1346bc78bbde9ff9643a4d6efd278406a825df10e0da01258f6751e795614e

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3798.exe

                      Filesize

                      879KB

                      MD5

                      562860cf2fd0b9c2131f328ea539ea8c

                      SHA1

                      d7f0d4505bec91950d0ba8cc7ed9742b99209b8b

                      SHA256

                      8f419f40b19a2e562068f60ce85abcfd1adfaaa252202b3e1839bd6885a4c764

                      SHA512

                      3928f86c229031b6b72d63e87856d6ff45081875a5d3a98aaa30ea73c7c5fdcb2c1346bc78bbde9ff9643a4d6efd278406a825df10e0da01258f6751e795614e

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en738609.exe

                      Filesize

                      175KB

                      MD5

                      795f3fe5687db9b19853eaf6acdc389a

                      SHA1

                      cd1ba862909c58a01d3a8e44c29cb71bb6b50630

                      SHA256

                      448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

                      SHA512

                      d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en738609.exe

                      Filesize

                      175KB

                      MD5

                      795f3fe5687db9b19853eaf6acdc389a

                      SHA1

                      cd1ba862909c58a01d3a8e44c29cb71bb6b50630

                      SHA256

                      448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

                      SHA512

                      d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7002.exe

                      Filesize

                      737KB

                      MD5

                      990f584b6790ea99167b6bca43a223d9

                      SHA1

                      f1b168c533d3e964005836dbf946124432bb2e1c

                      SHA256

                      6add433182105722cdc959524ac6ab1d884deaed0167fa0bbea45d348877d9fc

                      SHA512

                      fab694036e3ea95528c4c19e80c5bdc4ee3f91bf7dd20c8ccc5b58bc2b3b54d73b7c28dd7646b8e337130f6f8d1dbaffa8c068855f2bf0c2b4973d934f0a78d8

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7002.exe

                      Filesize

                      737KB

                      MD5

                      990f584b6790ea99167b6bca43a223d9

                      SHA1

                      f1b168c533d3e964005836dbf946124432bb2e1c

                      SHA256

                      6add433182105722cdc959524ac6ab1d884deaed0167fa0bbea45d348877d9fc

                      SHA512

                      fab694036e3ea95528c4c19e80c5bdc4ee3f91bf7dd20c8ccc5b58bc2b3b54d73b7c28dd7646b8e337130f6f8d1dbaffa8c068855f2bf0c2b4973d934f0a78d8

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dtR78s46.exe

                      Filesize

                      446KB

                      MD5

                      443b6bc90196c9dba8ac37e159feb4ca

                      SHA1

                      f470d7bdc072080f3a5e74da1297684efdd0a0f0

                      SHA256

                      854f5d14742a1fc79b7ccc30dcde5cf8df1178e955b5517f1422aeb0d6085e17

                      SHA512

                      a958b711447839f21c331a34b3a585869d182ce202e65aac6719b294fcb30e409631bf7284fb4fa2f10668ec7708794c41c644dd89325f46d4ec24d8d979a492

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dtR78s46.exe

                      Filesize

                      446KB

                      MD5

                      443b6bc90196c9dba8ac37e159feb4ca

                      SHA1

                      f470d7bdc072080f3a5e74da1297684efdd0a0f0

                      SHA256

                      854f5d14742a1fc79b7ccc30dcde5cf8df1178e955b5517f1422aeb0d6085e17

                      SHA512

                      a958b711447839f21c331a34b3a585869d182ce202e65aac6719b294fcb30e409631bf7284fb4fa2f10668ec7708794c41c644dd89325f46d4ec24d8d979a492

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3035.exe

                      Filesize

                      365KB

                      MD5

                      b834903fe703055f008d3e7ac46faf28

                      SHA1

                      1efd256b9637ea054f90c8468151641d8b46025b

                      SHA256

                      38ccc99f011b9c92526d362c3b6487caab7f7569eeb7399f6fda052b76fa11de

                      SHA512

                      bde92a94f2ea7a683587e026ef926e3ccac3c63e9c251f29fd7ccdb85c572c58f18d35fe6001e7ed698488a76ced0754f14e9ce6c2940e434f3729d3a08974e6

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3035.exe

                      Filesize

                      365KB

                      MD5

                      b834903fe703055f008d3e7ac46faf28

                      SHA1

                      1efd256b9637ea054f90c8468151641d8b46025b

                      SHA256

                      38ccc99f011b9c92526d362c3b6487caab7f7569eeb7399f6fda052b76fa11de

                      SHA512

                      bde92a94f2ea7a683587e026ef926e3ccac3c63e9c251f29fd7ccdb85c572c58f18d35fe6001e7ed698488a76ced0754f14e9ce6c2940e434f3729d3a08974e6

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5992.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus5992.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7447.exe

                      Filesize

                      388KB

                      MD5

                      b0038583f38cd256a4e6c00849b3adf3

                      SHA1

                      6d011053bb3a57b0971846b5e1656a378f4439bf

                      SHA256

                      57d4fb734c24c4348cd88a891a26a858131d1d81c543e31a271f4efdf1e3a048

                      SHA512

                      784d3338f0485225d7b6d94de018075b82eea1fcb8acbde617269a1f08e97284e5d225e707426fcc2a65dd9e8f41577da2de9adcb411961c0f023a235df7dc92

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con7447.exe

                      Filesize

                      388KB

                      MD5

                      b0038583f38cd256a4e6c00849b3adf3

                      SHA1

                      6d011053bb3a57b0971846b5e1656a378f4439bf

                      SHA256

                      57d4fb734c24c4348cd88a891a26a858131d1d81c543e31a271f4efdf1e3a048

                      SHA512

                      784d3338f0485225d7b6d94de018075b82eea1fcb8acbde617269a1f08e97284e5d225e707426fcc2a65dd9e8f41577da2de9adcb411961c0f023a235df7dc92

                    • memory/352-163-0x00000000003B0000-0x00000000003BA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1840-205-0x0000000004740000-0x0000000004750000-memory.dmp

                      Filesize

                      64KB

                    • memory/1840-184-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-190-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-192-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-194-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-196-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-198-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-200-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-202-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-207-0x0000000000400000-0x0000000002B27000-memory.dmp

                      Filesize

                      39.2MB

                    • memory/1840-188-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-186-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-204-0x0000000000400000-0x0000000002B27000-memory.dmp

                      Filesize

                      39.2MB

                    • memory/1840-182-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-180-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-178-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-176-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-175-0x0000000007790000-0x00000000077A2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1840-174-0x00000000071D0000-0x0000000007774000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/1840-173-0x0000000004740000-0x0000000004750000-memory.dmp

                      Filesize

                      64KB

                    • memory/1840-172-0x0000000004740000-0x0000000004750000-memory.dmp

                      Filesize

                      64KB

                    • memory/1840-171-0x0000000002C10000-0x0000000002C3D000-memory.dmp

                      Filesize

                      180KB

                    • memory/2416-225-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-1131-0x00000000089F0000-0x0000000008BB2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/2416-233-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-236-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-237-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-240-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-239-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-235-0x0000000002D90000-0x0000000002DDB000-memory.dmp

                      Filesize

                      300KB

                    • memory/2416-241-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-243-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-245-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-247-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-1123-0x00000000077B0000-0x0000000007DC8000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/2416-1124-0x0000000007DE0000-0x0000000007EEA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/2416-1125-0x0000000007F20000-0x0000000007F32000-memory.dmp

                      Filesize

                      72KB

                    • memory/2416-1126-0x0000000008040000-0x000000000807C000-memory.dmp

                      Filesize

                      240KB

                    • memory/2416-1127-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-1129-0x0000000008230000-0x0000000008296000-memory.dmp

                      Filesize

                      408KB

                    • memory/2416-1130-0x00000000088F0000-0x0000000008982000-memory.dmp

                      Filesize

                      584KB

                    • memory/2416-231-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-1132-0x0000000008BC0000-0x00000000090EC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/2416-1134-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-1135-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-1136-0x0000000009240000-0x00000000092B6000-memory.dmp

                      Filesize

                      472KB

                    • memory/2416-1137-0x00000000092C0000-0x0000000009310000-memory.dmp

                      Filesize

                      320KB

                    • memory/2416-1139-0x00000000071F0000-0x0000000007200000-memory.dmp

                      Filesize

                      64KB

                    • memory/2416-229-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-227-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-212-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-213-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-223-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-221-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-219-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-217-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/2416-215-0x0000000004BF0000-0x0000000004C2E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4212-1145-0x0000000005480000-0x0000000005490000-memory.dmp

                      Filesize

                      64KB

                    • memory/4212-1144-0x0000000000B70000-0x0000000000BA2000-memory.dmp

                      Filesize

                      200KB

                    • memory/4908-134-0x0000000002410000-0x0000000002519000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/4908-164-0x0000000000400000-0x000000000059B000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4908-165-0x0000000002410000-0x0000000002519000-memory.dmp

                      Filesize

                      1.0MB