Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 16:06

General

  • Target

    7739b42c7a6f56a27a2d86b873482b9d2945bc1226e368d2a5bfeefaf4cf95d8.exe

  • Size

    1.0MB

  • MD5

    ceacdbe2b8a87509e6bf11578b2b2453

  • SHA1

    58f5b3bc8a1c6f640c913dfbbe0d3b9bef67e0cc

  • SHA256

    7739b42c7a6f56a27a2d86b873482b9d2945bc1226e368d2a5bfeefaf4cf95d8

  • SHA512

    051809e8aaa04350357fa7bd0cb3fd8a8f3a4236548bb46b2a39c09fa5f8990d867e22b743b89d9a692978a2c2219556f3193c31283cd54d878e09d9b59f65cc

  • SSDEEP

    24576:0gHEObseZu44wqJnysRme1JS0Tk6G3rVu+T1/WcZ6:0Cb6nyymei0T23U+TRW

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rako

C2

193.233.20.28:4125

Attributes
  • auth_value

    69e2d139981e0b037a6786e01a92824d

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 17 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7739b42c7a6f56a27a2d86b873482b9d2945bc1226e368d2a5bfeefaf4cf95d8.exe
    "C:\Users\Admin\AppData\Local\Temp\7739b42c7a6f56a27a2d86b873482b9d2945bc1226e368d2a5bfeefaf4cf95d8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3047.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3047.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3484.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3484.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4765.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4765.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0135.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0135.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:432
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2689.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2689.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4312
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1084
              6⤵
              • Program crash
              PID:3408
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAp85s79.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAp85s79.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4492
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 1332
            5⤵
            • Program crash
            PID:896
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en981278.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en981278.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3940
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge007592.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge007592.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3084
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2072
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4052
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:444
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:944
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4440
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\5975271bda" /P "Admin:N"
                  5⤵
                    PID:3784
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    5⤵
                      PID:4356
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4900
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 480
                  2⤵
                  • Program crash
                  PID:4316
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4312 -ip 4312
                1⤵
                  PID:4804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4492 -ip 4492
                  1⤵
                    PID:4488
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 368 -ip 368
                    1⤵
                      PID:1576
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4564

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge007592.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge007592.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3047.exe

                      Filesize

                      778KB

                      MD5

                      e13af2e55e3b50cda25df5a6fba41a9a

                      SHA1

                      9a745fb2dab5064350535c3d561b4a4926f1fefb

                      SHA256

                      45bcc5467b6638a0d8fdf78ca2fbd94d92a156412e66c991fab0bc254bcdf854

                      SHA512

                      e03aa9206d9e83bfef316626577a4db6dce490629ffc00faecc822458b79846cc46b60b2d77f221d91cdbc37729f4b161dc4568f7a8c1f0dda22550cf2ee124c

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3047.exe

                      Filesize

                      778KB

                      MD5

                      e13af2e55e3b50cda25df5a6fba41a9a

                      SHA1

                      9a745fb2dab5064350535c3d561b4a4926f1fefb

                      SHA256

                      45bcc5467b6638a0d8fdf78ca2fbd94d92a156412e66c991fab0bc254bcdf854

                      SHA512

                      e03aa9206d9e83bfef316626577a4db6dce490629ffc00faecc822458b79846cc46b60b2d77f221d91cdbc37729f4b161dc4568f7a8c1f0dda22550cf2ee124c

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en981278.exe

                      Filesize

                      175KB

                      MD5

                      759627441452bd502f0d0fba797bcd52

                      SHA1

                      18eea75008b488b74217784ee0c88428af8fc30e

                      SHA256

                      0898215e951a61929012606a99ecc6f18db7e35aea3b46294be9e0bdc4a634e6

                      SHA512

                      45b9a4cb1b1f4a1277a905a9a16d3491ec8a5ba87264ab83aebf87158bc3beb50b32093aaf406b44b85f353fd2b2636fbcd34866d99c4e2f5fbb3c2b8e888bdc

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en981278.exe

                      Filesize

                      175KB

                      MD5

                      759627441452bd502f0d0fba797bcd52

                      SHA1

                      18eea75008b488b74217784ee0c88428af8fc30e

                      SHA256

                      0898215e951a61929012606a99ecc6f18db7e35aea3b46294be9e0bdc4a634e6

                      SHA512

                      45b9a4cb1b1f4a1277a905a9a16d3491ec8a5ba87264ab83aebf87158bc3beb50b32093aaf406b44b85f353fd2b2636fbcd34866d99c4e2f5fbb3c2b8e888bdc

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3484.exe

                      Filesize

                      635KB

                      MD5

                      e2821e674dd78e127304f76707eee32f

                      SHA1

                      4f8e19016a6213e7af6d73b3fbdda867b0fc8445

                      SHA256

                      d08b8653f7cf51de060a720885e2d01a835b4032dd003d2700a3e63c327319f1

                      SHA512

                      20d858058cd5bd1f1edfc25683b6c4d72cd8de086304f43e8fb575714a0770692b9c1a7e4abc49fe178ce2daa7e6e0c9aeda3799d8304c1c215437edc9a2b0a6

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3484.exe

                      Filesize

                      635KB

                      MD5

                      e2821e674dd78e127304f76707eee32f

                      SHA1

                      4f8e19016a6213e7af6d73b3fbdda867b0fc8445

                      SHA256

                      d08b8653f7cf51de060a720885e2d01a835b4032dd003d2700a3e63c327319f1

                      SHA512

                      20d858058cd5bd1f1edfc25683b6c4d72cd8de086304f43e8fb575714a0770692b9c1a7e4abc49fe178ce2daa7e6e0c9aeda3799d8304c1c215437edc9a2b0a6

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAp85s79.exe

                      Filesize

                      284KB

                      MD5

                      5ef815b8be58a494bf9c4ccb5713114e

                      SHA1

                      882b915c06810b6b7010f16d0b055e3cd6475159

                      SHA256

                      6d8c14625043f066a47b5b6b5df153cdb288e7f07eb79a8029c8805a2a2ae301

                      SHA512

                      c4809808c91d9ff4a524ff46250dfa60314727e421d489fc2ab8bacbd29b2ce8a8ae6afa79e389e19c00546d5983164b8bdd19715d10620bde9d7bc9ba50e2c3

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dAp85s79.exe

                      Filesize

                      284KB

                      MD5

                      5ef815b8be58a494bf9c4ccb5713114e

                      SHA1

                      882b915c06810b6b7010f16d0b055e3cd6475159

                      SHA256

                      6d8c14625043f066a47b5b6b5df153cdb288e7f07eb79a8029c8805a2a2ae301

                      SHA512

                      c4809808c91d9ff4a524ff46250dfa60314727e421d489fc2ab8bacbd29b2ce8a8ae6afa79e389e19c00546d5983164b8bdd19715d10620bde9d7bc9ba50e2c3

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4765.exe

                      Filesize

                      315KB

                      MD5

                      0f3e0bd9ec7de50494e353417fb61d9e

                      SHA1

                      7531e0723dd11d17fda4f9cbb65bb1992a4b4598

                      SHA256

                      f69714e0689e1f929755278153168e7544dbc88fdcaf58f1aba549880862eb97

                      SHA512

                      fb85b050ced087e52a0f871f7a17b223433d1e68bb74b655e8905d42dcc4a43c19417036daac4b7cfb5fc2aa9257e31ac7d83fb5a1aa01cf22bb7d04dc1ada55

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4765.exe

                      Filesize

                      315KB

                      MD5

                      0f3e0bd9ec7de50494e353417fb61d9e

                      SHA1

                      7531e0723dd11d17fda4f9cbb65bb1992a4b4598

                      SHA256

                      f69714e0689e1f929755278153168e7544dbc88fdcaf58f1aba549880862eb97

                      SHA512

                      fb85b050ced087e52a0f871f7a17b223433d1e68bb74b655e8905d42dcc4a43c19417036daac4b7cfb5fc2aa9257e31ac7d83fb5a1aa01cf22bb7d04dc1ada55

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0135.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus0135.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2689.exe

                      Filesize

                      226KB

                      MD5

                      f1f6c8a25f731bb2d8ca8f87d6726298

                      SHA1

                      31818c0ad5b31481bbd326e3142364521c6b71bd

                      SHA256

                      8ffd32898c4028a3be101f6c62e68dcd8134a4c9b6e3611eaee4b66b283ba797

                      SHA512

                      88b74cbcd7183083b7eaddad00e71e7bea56d4c9acab52bc7791670aed2171198dab2ffeb6eecb2683d69cf9ec5584c44bb9be02915bd6e0168376b45c8afe47

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2689.exe

                      Filesize

                      226KB

                      MD5

                      f1f6c8a25f731bb2d8ca8f87d6726298

                      SHA1

                      31818c0ad5b31481bbd326e3142364521c6b71bd

                      SHA256

                      8ffd32898c4028a3be101f6c62e68dcd8134a4c9b6e3611eaee4b66b283ba797

                      SHA512

                      88b74cbcd7183083b7eaddad00e71e7bea56d4c9acab52bc7791670aed2171198dab2ffeb6eecb2683d69cf9ec5584c44bb9be02915bd6e0168376b45c8afe47

                    • memory/368-164-0x0000000000400000-0x0000000000582000-memory.dmp

                      Filesize

                      1.5MB

                    • memory/368-163-0x00000000023A0000-0x0000000002492000-memory.dmp

                      Filesize

                      968KB

                    • memory/432-162-0x00000000002E0000-0x00000000002EA000-memory.dmp

                      Filesize

                      40KB

                    • memory/3940-1147-0x0000000000430000-0x0000000000462000-memory.dmp

                      Filesize

                      200KB

                    • memory/3940-1148-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-185-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-189-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-191-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-193-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-195-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-197-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-199-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-200-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-201-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-202-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-204-0x0000000000400000-0x00000000004B8000-memory.dmp

                      Filesize

                      736KB

                    • memory/4312-206-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-207-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-208-0x0000000004C40000-0x0000000004C50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4312-209-0x0000000000400000-0x00000000004B8000-memory.dmp

                      Filesize

                      736KB

                    • memory/4312-187-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-183-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-181-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-179-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-177-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-175-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-173-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-172-0x0000000002670000-0x0000000002682000-memory.dmp

                      Filesize

                      72KB

                    • memory/4312-171-0x0000000004C50000-0x00000000051F4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4312-170-0x00000000005D0000-0x00000000005FD000-memory.dmp

                      Filesize

                      180KB

                    • memory/4492-216-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-231-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-233-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-235-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-237-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-239-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-241-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-243-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-245-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-247-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-249-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-1124-0x0000000005310000-0x0000000005928000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/4492-1125-0x0000000005930000-0x0000000005A3A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/4492-1126-0x0000000004C00000-0x0000000004C12000-memory.dmp

                      Filesize

                      72KB

                    • memory/4492-1127-0x0000000005A40000-0x0000000005A7C000-memory.dmp

                      Filesize

                      240KB

                    • memory/4492-1129-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-1130-0x0000000005D00000-0x0000000005D66000-memory.dmp

                      Filesize

                      408KB

                    • memory/4492-1131-0x00000000063D0000-0x0000000006462000-memory.dmp

                      Filesize

                      584KB

                    • memory/4492-1133-0x00000000064B0000-0x0000000006526000-memory.dmp

                      Filesize

                      472KB

                    • memory/4492-1134-0x0000000006530000-0x0000000006580000-memory.dmp

                      Filesize

                      320KB

                    • memory/4492-1135-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-1136-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-1137-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-1138-0x00000000066E0000-0x00000000068A2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/4492-1139-0x00000000068C0000-0x0000000006DEC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/4492-1141-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-229-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-227-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-225-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-223-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-221-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-219-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-218-0x0000000002500000-0x000000000253E000-memory.dmp

                      Filesize

                      248KB

                    • memory/4492-217-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4492-214-0x0000000000570000-0x00000000005BB000-memory.dmp

                      Filesize

                      300KB

                    • memory/4492-215-0x0000000004C50000-0x0000000004C60000-memory.dmp

                      Filesize

                      64KB