Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2023, 19:00

General

  • Target

    71d9da644e43db69b617a3c210e58c37436a601d87faa2cd6bef26182b092a6b.exe

  • Size

    1.3MB

  • MD5

    726299a4c3ff33e2eeb3504a295ed18a

  • SHA1

    10b70e0ebf5c4ae8da393f9ad821c4c7dbe48d40

  • SHA256

    71d9da644e43db69b617a3c210e58c37436a601d87faa2cd6bef26182b092a6b

  • SHA512

    29e739f68053bd9a6aac5e63bb7313a24d8c979bd53a526d33f85c43357e2d97033bcddd1c354a6134fd37d35357c1b37dade646b89492d8a6850f95c82087f4

  • SSDEEP

    24576:y+aqUiqL+HcgPFd2eF/xdm/QHTrpXRCzp2DM7+vQx8k7dXeD:yoURLWCeJtzVXRCYI+4V7dXe

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

maxi

C2

193.233.20.30:4125

Attributes
  • auth_value

    6e90da232d4c2e35c1a36c250f5f8904

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71d9da644e43db69b617a3c210e58c37436a601d87faa2cd6bef26182b092a6b.exe
    "C:\Users\Admin\AppData\Local\Temp\71d9da644e43db69b617a3c210e58c37436a601d87faa2cd6bef26182b092a6b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino9539.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino9539.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino5371.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino5371.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1116.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1116.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2328
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2264.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2264.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5108
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5744.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5744.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4108
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dMM62s56.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dMM62s56.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:752
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 1356
            5⤵
            • Program crash
            PID:3696
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en274046.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en274046.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1036
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge868115.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge868115.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3056
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4244
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3908
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4332
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3452
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:2628
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1604
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 484
                  2⤵
                  • Program crash
                  PID:4984
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 752 -ip 752
                1⤵
                  PID:876
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1676 -ip 1676
                  1⤵
                    PID:3412
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4012
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2256

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge868115.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge868115.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino9539.exe

                    Filesize

                    907KB

                    MD5

                    3fa57accbcd75b227aef6da60fdc70d3

                    SHA1

                    866708253ca90e4c51672a7400a0a2efdaf32a87

                    SHA256

                    b845e47d836374e5d4e9e15094d59f5f240dbec75d2771df71441ac9ac197b85

                    SHA512

                    82b135f44bc878851e8f902ba6e93f861cde74e0a3d3e13e9e0b55c049d150fd9a5154cf38c89f8e05668a767dd041dba126662dd30b27555ca540cb371328d4

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino9539.exe

                    Filesize

                    907KB

                    MD5

                    3fa57accbcd75b227aef6da60fdc70d3

                    SHA1

                    866708253ca90e4c51672a7400a0a2efdaf32a87

                    SHA256

                    b845e47d836374e5d4e9e15094d59f5f240dbec75d2771df71441ac9ac197b85

                    SHA512

                    82b135f44bc878851e8f902ba6e93f861cde74e0a3d3e13e9e0b55c049d150fd9a5154cf38c89f8e05668a767dd041dba126662dd30b27555ca540cb371328d4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en274046.exe

                    Filesize

                    175KB

                    MD5

                    0bad76cd3276f38206bf62a5f6061853

                    SHA1

                    e7f11197db98b02eff7904e04e7a3f6af5bfd898

                    SHA256

                    5ee4a25885ee8a675008057b7e76ee78f1e6750bc65f673ba260e95525588504

                    SHA512

                    41d3b0443e4aed4e5e6b4ed285edd1c675f21dfd5db6ccf66be11150bb60a5fbb68f79f835516bad143fbe12d4dfef46a4c80852d9332afb3db50316d83f4f59

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en274046.exe

                    Filesize

                    175KB

                    MD5

                    0bad76cd3276f38206bf62a5f6061853

                    SHA1

                    e7f11197db98b02eff7904e04e7a3f6af5bfd898

                    SHA256

                    5ee4a25885ee8a675008057b7e76ee78f1e6750bc65f673ba260e95525588504

                    SHA512

                    41d3b0443e4aed4e5e6b4ed285edd1c675f21dfd5db6ccf66be11150bb60a5fbb68f79f835516bad143fbe12d4dfef46a4c80852d9332afb3db50316d83f4f59

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino5371.exe

                    Filesize

                    765KB

                    MD5

                    014634f2e54682b58671bb69a1e6d603

                    SHA1

                    c45ca93c4a2df2e1200e0c23537a4addabd2b16a

                    SHA256

                    3604ce6d40c664778e33105084198ad85e3b9d9b470b14cedcc9becd7b212ded

                    SHA512

                    bacac13024ad449e26ef0125c534817bf65306db825cb880654b50d45bf01304bf0f8a5a4ea6308c26177e4013a8502e4a97db63c4d1f1b8ba99f94e64c26ad5

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino5371.exe

                    Filesize

                    765KB

                    MD5

                    014634f2e54682b58671bb69a1e6d603

                    SHA1

                    c45ca93c4a2df2e1200e0c23537a4addabd2b16a

                    SHA256

                    3604ce6d40c664778e33105084198ad85e3b9d9b470b14cedcc9becd7b212ded

                    SHA512

                    bacac13024ad449e26ef0125c534817bf65306db825cb880654b50d45bf01304bf0f8a5a4ea6308c26177e4013a8502e4a97db63c4d1f1b8ba99f94e64c26ad5

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dMM62s56.exe

                    Filesize

                    456KB

                    MD5

                    0c2e81e96daed9fb11c235211c6ef382

                    SHA1

                    5f7653c0dd8ed0f766fae28f371f28ea40930604

                    SHA256

                    0bd0c51da385286ec3582bfad6f10ed45404f914082586f5a3a3a21de8f6f7c5

                    SHA512

                    90360a7d7a9458198ac91ed25833b3158c7f62af7c55f5275ede6ab49c8c1db6a25956da28590eb8d03a9e074b1a290f003640d22b3384bbfdbd400d6fad7f8c

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dMM62s56.exe

                    Filesize

                    456KB

                    MD5

                    0c2e81e96daed9fb11c235211c6ef382

                    SHA1

                    5f7653c0dd8ed0f766fae28f371f28ea40930604

                    SHA256

                    0bd0c51da385286ec3582bfad6f10ed45404f914082586f5a3a3a21de8f6f7c5

                    SHA512

                    90360a7d7a9458198ac91ed25833b3158c7f62af7c55f5275ede6ab49c8c1db6a25956da28590eb8d03a9e074b1a290f003640d22b3384bbfdbd400d6fad7f8c

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1116.exe

                    Filesize

                    378KB

                    MD5

                    37638fcc272bb63bc2fbaee5eed08bc7

                    SHA1

                    b02dcc1be58b7edc84c8f56c9574f416ed260e7e

                    SHA256

                    8a3414fc223a9b9b3ea453a50deaffb004f79916c8445097e93fda052c9b8666

                    SHA512

                    d222020673aa5a714da3f24808b2636317b324b5ad4e008161e0e2738c97daa3beb9c1338373cfaa5db4b5aa9bfdc98110add9253b90e83f2f48d9d8597877b4

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1116.exe

                    Filesize

                    378KB

                    MD5

                    37638fcc272bb63bc2fbaee5eed08bc7

                    SHA1

                    b02dcc1be58b7edc84c8f56c9574f416ed260e7e

                    SHA256

                    8a3414fc223a9b9b3ea453a50deaffb004f79916c8445097e93fda052c9b8666

                    SHA512

                    d222020673aa5a714da3f24808b2636317b324b5ad4e008161e0e2738c97daa3beb9c1338373cfaa5db4b5aa9bfdc98110add9253b90e83f2f48d9d8597877b4

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2264.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus2264.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5744.exe

                    Filesize

                    398KB

                    MD5

                    ba6d82ef0b33ee1ab51cfff0ba010577

                    SHA1

                    a71d760ec6cc90b8e44b373ea4eb89bb35bd9a66

                    SHA256

                    b28dafcb8dd2c8548db0aecdec318ae1fd5af1568691d12a6c03763a719e9e0e

                    SHA512

                    88459a0b24af44ee9725360abe4f7ea31f6ba28255f45d8cf903ed8f1fa35801a8e1b6dc8670d59a7f44f65df8ce226c97429e8c80a77e08f29dbb5345e30dd4

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con5744.exe

                    Filesize

                    398KB

                    MD5

                    ba6d82ef0b33ee1ab51cfff0ba010577

                    SHA1

                    a71d760ec6cc90b8e44b373ea4eb89bb35bd9a66

                    SHA256

                    b28dafcb8dd2c8548db0aecdec318ae1fd5af1568691d12a6c03763a719e9e0e

                    SHA512

                    88459a0b24af44ee9725360abe4f7ea31f6ba28255f45d8cf903ed8f1fa35801a8e1b6dc8670d59a7f44f65df8ce226c97429e8c80a77e08f29dbb5345e30dd4

                  • memory/752-1127-0x0000000005F70000-0x0000000006002000-memory.dmp

                    Filesize

                    584KB

                  • memory/752-240-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-1137-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-1136-0x0000000007240000-0x0000000007290000-memory.dmp

                    Filesize

                    320KB

                  • memory/752-1135-0x00000000071C0000-0x0000000007236000-memory.dmp

                    Filesize

                    472KB

                  • memory/752-1134-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-1133-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-1132-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-1131-0x0000000006B50000-0x000000000707C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/752-1130-0x0000000006970000-0x0000000006B32000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/752-1128-0x0000000006010000-0x0000000006076000-memory.dmp

                    Filesize

                    408KB

                  • memory/752-1125-0x0000000005C80000-0x0000000005CBC000-memory.dmp

                    Filesize

                    240KB

                  • memory/752-1123-0x0000000005C60000-0x0000000005C72000-memory.dmp

                    Filesize

                    72KB

                  • memory/752-1124-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-1122-0x0000000005B20000-0x0000000005C2A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/752-1121-0x0000000005480000-0x0000000005A98000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/752-211-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-212-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-214-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-216-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-218-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-220-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-222-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-224-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-226-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-228-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-232-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-230-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-234-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-238-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-236-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-413-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-242-0x00000000052F0000-0x000000000532E000-memory.dmp

                    Filesize

                    248KB

                  • memory/752-409-0x0000000000740000-0x000000000078B000-memory.dmp

                    Filesize

                    300KB

                  • memory/752-410-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/752-412-0x0000000004D30000-0x0000000004D40000-memory.dmp

                    Filesize

                    64KB

                  • memory/1036-1143-0x0000000000870000-0x00000000008A2000-memory.dmp

                    Filesize

                    200KB

                  • memory/1036-1144-0x0000000005170000-0x0000000005180000-memory.dmp

                    Filesize

                    64KB

                  • memory/1676-134-0x00000000026F0000-0x0000000002802000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1676-164-0x0000000000400000-0x0000000000811000-memory.dmp

                    Filesize

                    4.1MB

                  • memory/4108-171-0x0000000004EB0000-0x0000000005454000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4108-199-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-185-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-201-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4108-200-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4108-193-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-195-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-189-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-179-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-191-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-202-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4108-206-0x0000000000400000-0x0000000000726000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/4108-197-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-177-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-183-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-181-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-175-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-173-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-172-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-187-0x00000000024B0000-0x00000000024C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4108-170-0x0000000000730000-0x000000000075D000-memory.dmp

                    Filesize

                    180KB

                  • memory/4108-204-0x0000000000400000-0x0000000000726000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/5108-163-0x0000000000E10000-0x0000000000E1A000-memory.dmp

                    Filesize

                    40KB