Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2023, 04:50

General

  • Target

    33dab35b804ae073d69e3a6d9f050bfebf10ad3a9064bc130ae552143dfb179a.exe

  • Size

    1.1MB

  • MD5

    79b866cba6cb9faafbe4df2a728368c8

  • SHA1

    4f9aac5afc876ba12d66281932f9f4e7ba789100

  • SHA256

    33dab35b804ae073d69e3a6d9f050bfebf10ad3a9064bc130ae552143dfb179a

  • SHA512

    99dda3607cd1e8677a0bab00fd54b14875cd22f4bbf0d8343caa32585c46294a05b44387da67d02f28bc3dc4362a439e4e360f0e77b08d9a808859965d377c62

  • SSDEEP

    24576:ZiZX7AELNOxHsP62iMb78G4WB5yCpW+5t8FTZUd:Z4rAEOxM/5bAq5fzto

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

relon

C2

193.233.20.30:4125

Attributes
  • auth_value

    17da69809725577b595e217ba006b869

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33dab35b804ae073d69e3a6d9f050bfebf10ad3a9064bc130ae552143dfb179a.exe
    "C:\Users\Admin\AppData\Local\Temp\33dab35b804ae073d69e3a6d9f050bfebf10ad3a9064bc130ae552143dfb179a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3787.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3787.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4742.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4742.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4660.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4660.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2608.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2608.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3464
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con9784.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con9784.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:912
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 1080
              6⤵
              • Program crash
              PID:2680
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dnw97s39.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dnw97s39.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:768
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 1348
            5⤵
            • Program crash
            PID:3704
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en814366.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en814366.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3892
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge865906.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge865906.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4236
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3536
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:776
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1472
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4120
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3668
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 484
                  2⤵
                  • Program crash
                  PID:2744
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 912 -ip 912
                1⤵
                  PID:2056
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 768 -ip 768
                  1⤵
                    PID:3300
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1004 -ip 1004
                    1⤵
                      PID:5036
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1696
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3832
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe start wuauserv
                      1⤵
                      • Launches sc.exe
                      PID:640

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge865906.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge865906.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3787.exe

                      Filesize

                      819KB

                      MD5

                      40e9d77649f21b9070209f4e906ff7c3

                      SHA1

                      f921cd3a68e646bebf1c95fea866493d1d76f426

                      SHA256

                      b7ee47c7d9c13f5f115c3ac9e83add3ebedb74e222dc2f5dff4db203446e87c8

                      SHA512

                      f9107e796f264a0c8b82fbf9a101bd0d14e9f086b8bd4998a675b2e86ddab4e836a2535a4489f54953864bdd7a61a61587476655bc12be5114f5e55615bc621e

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3787.exe

                      Filesize

                      819KB

                      MD5

                      40e9d77649f21b9070209f4e906ff7c3

                      SHA1

                      f921cd3a68e646bebf1c95fea866493d1d76f426

                      SHA256

                      b7ee47c7d9c13f5f115c3ac9e83add3ebedb74e222dc2f5dff4db203446e87c8

                      SHA512

                      f9107e796f264a0c8b82fbf9a101bd0d14e9f086b8bd4998a675b2e86ddab4e836a2535a4489f54953864bdd7a61a61587476655bc12be5114f5e55615bc621e

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en814366.exe

                      Filesize

                      175KB

                      MD5

                      6fbff2d7c9ba7f0a71f02a5c70df9dfc

                      SHA1

                      003da0075734cd2d7f201c5b0e4779b8e1f33621

                      SHA256

                      cb56407367a42f61993842b66bcd24993a30c87116313c26d6af9e37bbb1b6b3

                      SHA512

                      25842b9df4767b16096f2bfcedc9d368a9696e6c6d9c7b2c75987769a5b338ae04b23b1e89f18eef2244e84f04e4acf6af56643a97abfe5b605f66cba0bac27f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en814366.exe

                      Filesize

                      175KB

                      MD5

                      6fbff2d7c9ba7f0a71f02a5c70df9dfc

                      SHA1

                      003da0075734cd2d7f201c5b0e4779b8e1f33621

                      SHA256

                      cb56407367a42f61993842b66bcd24993a30c87116313c26d6af9e37bbb1b6b3

                      SHA512

                      25842b9df4767b16096f2bfcedc9d368a9696e6c6d9c7b2c75987769a5b338ae04b23b1e89f18eef2244e84f04e4acf6af56643a97abfe5b605f66cba0bac27f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4742.exe

                      Filesize

                      676KB

                      MD5

                      35e71a243cae2331bdc1270f3ce00cd9

                      SHA1

                      d878b1304eea239cd2b89dc9f2108973d8fde5eb

                      SHA256

                      14e001705aab950c0b822dea2903a34eb783ff40347fcbadd0f3324f10303942

                      SHA512

                      b79b1f560c052dafc6321e40a80f7c984ee553c005ac0568e4521910088a39cb7366c591519fcf498ab7b14b22b380d070d6076db50d7433b1e2db07fdb947c4

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino4742.exe

                      Filesize

                      676KB

                      MD5

                      35e71a243cae2331bdc1270f3ce00cd9

                      SHA1

                      d878b1304eea239cd2b89dc9f2108973d8fde5eb

                      SHA256

                      14e001705aab950c0b822dea2903a34eb783ff40347fcbadd0f3324f10303942

                      SHA512

                      b79b1f560c052dafc6321e40a80f7c984ee553c005ac0568e4521910088a39cb7366c591519fcf498ab7b14b22b380d070d6076db50d7433b1e2db07fdb947c4

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dnw97s39.exe

                      Filesize

                      349KB

                      MD5

                      7215b459ac264ffcbc437cbe871c53fc

                      SHA1

                      7cd3451c5e0579ace889c01f009f0174fbf319de

                      SHA256

                      86bf1c41bf808cb3086e4e78b2d60c5a65dc485718b467415d5b5416c9677a8b

                      SHA512

                      e75f20087fe2ac2a960215dd764b949ab96d34fdeebc4acdbf0a66d14ece6be003fa8d862ac5e7d7d19f2dc9b2f0ec8eeed30c4886b7c1ecbaba9d6ae650a0c9

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dnw97s39.exe

                      Filesize

                      349KB

                      MD5

                      7215b459ac264ffcbc437cbe871c53fc

                      SHA1

                      7cd3451c5e0579ace889c01f009f0174fbf319de

                      SHA256

                      86bf1c41bf808cb3086e4e78b2d60c5a65dc485718b467415d5b5416c9677a8b

                      SHA512

                      e75f20087fe2ac2a960215dd764b949ab96d34fdeebc4acdbf0a66d14ece6be003fa8d862ac5e7d7d19f2dc9b2f0ec8eeed30c4886b7c1ecbaba9d6ae650a0c9

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4660.exe

                      Filesize

                      334KB

                      MD5

                      f84c8e5eea7a2813bdc2e778a0363fd6

                      SHA1

                      ab60dc9639c5da67938652e73b8487ed85184666

                      SHA256

                      2364c3e4506dd37f5bf0270f1d9bf78f4f5e4896783676f9af0f36bb616a9d7c

                      SHA512

                      74298aa7005565eb2512cd7baabaaeaca5aa4e4648055cc07f1b04067865e8607c4503bdb6d1f6953e76122da7114d3bc5180fb08d672ab63c1ce192544f0c29

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino4660.exe

                      Filesize

                      334KB

                      MD5

                      f84c8e5eea7a2813bdc2e778a0363fd6

                      SHA1

                      ab60dc9639c5da67938652e73b8487ed85184666

                      SHA256

                      2364c3e4506dd37f5bf0270f1d9bf78f4f5e4896783676f9af0f36bb616a9d7c

                      SHA512

                      74298aa7005565eb2512cd7baabaaeaca5aa4e4648055cc07f1b04067865e8607c4503bdb6d1f6953e76122da7114d3bc5180fb08d672ab63c1ce192544f0c29

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2608.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2608.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con9784.exe

                      Filesize

                      290KB

                      MD5

                      87e23073e79d6c466608b577020518be

                      SHA1

                      2500f2cee5ffe9249251f182e590cc73a6586469

                      SHA256

                      dfadb8abdfcd8a0dc2a31ecc2260a927d5f7482272993faddeafe6826b131ab1

                      SHA512

                      475119c94d363c57112fed992c8bf91c80a8940a9ce5d9e934cce64ff2cbe3ec14dd79afb9ab72c70616e4846721d5fd3bbf7bf14f3bd851283cc05a33bafd04

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con9784.exe

                      Filesize

                      290KB

                      MD5

                      87e23073e79d6c466608b577020518be

                      SHA1

                      2500f2cee5ffe9249251f182e590cc73a6586469

                      SHA256

                      dfadb8abdfcd8a0dc2a31ecc2260a927d5f7482272993faddeafe6826b131ab1

                      SHA512

                      475119c94d363c57112fed992c8bf91c80a8940a9ce5d9e934cce64ff2cbe3ec14dd79afb9ab72c70616e4846721d5fd3bbf7bf14f3bd851283cc05a33bafd04

                    • memory/768-1126-0x0000000005C20000-0x0000000005C32000-memory.dmp

                      Filesize

                      72KB

                    • memory/768-1134-0x0000000007020000-0x0000000007096000-memory.dmp

                      Filesize

                      472KB

                    • memory/768-1142-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-1139-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-1138-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-1137-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-1135-0x00000000070C0000-0x0000000007110000-memory.dmp

                      Filesize

                      320KB

                    • memory/768-1133-0x00000000069D0000-0x0000000006EFC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/768-1132-0x00000000067F0000-0x00000000069B2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/768-1131-0x0000000005FD0000-0x0000000006036000-memory.dmp

                      Filesize

                      408KB

                    • memory/768-1130-0x0000000005F30000-0x0000000005FC2000-memory.dmp

                      Filesize

                      584KB

                    • memory/768-1128-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-1127-0x0000000005C40000-0x0000000005C7C000-memory.dmp

                      Filesize

                      240KB

                    • memory/768-1125-0x0000000004F00000-0x000000000500A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/768-1124-0x00000000055F0000-0x0000000005C08000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/768-487-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-485-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-482-0x0000000005030000-0x0000000005040000-memory.dmp

                      Filesize

                      64KB

                    • memory/768-481-0x00000000009D0000-0x0000000000A1B000-memory.dmp

                      Filesize

                      300KB

                    • memory/768-214-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-217-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-215-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-219-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-221-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-223-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-225-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-227-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-231-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-229-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-233-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-235-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-237-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-239-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-241-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-243-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/768-245-0x0000000002A90000-0x0000000002ACE000-memory.dmp

                      Filesize

                      248KB

                    • memory/912-195-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-177-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-209-0x0000000000400000-0x0000000000830000-memory.dmp

                      Filesize

                      4.2MB

                    • memory/912-208-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-207-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-206-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-170-0x0000000000980000-0x00000000009AD000-memory.dmp

                      Filesize

                      180KB

                    • memory/912-204-0x0000000000400000-0x0000000000830000-memory.dmp

                      Filesize

                      4.2MB

                    • memory/912-202-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-201-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-200-0x0000000002690000-0x00000000026A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/912-199-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-197-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-185-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-183-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-181-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-171-0x0000000004E30000-0x00000000053D4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/912-189-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-187-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-179-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-193-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-172-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-191-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-175-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/912-173-0x00000000028A0000-0x00000000028B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/1004-138-0x00000000029A0000-0x0000000002A9C000-memory.dmp

                      Filesize

                      1008KB

                    • memory/1004-164-0x0000000000400000-0x0000000000904000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/3464-163-0x0000000000F20000-0x0000000000F2A000-memory.dmp

                      Filesize

                      40KB

                    • memory/3892-1146-0x0000000000690000-0x00000000006C2000-memory.dmp

                      Filesize

                      200KB

                    • memory/3892-1147-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                      Filesize

                      64KB