Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2023, 14:30

General

  • Target

    82ba64ae2eb89d2f97cc4e9d3f7ab54aa05131baaf0c38469f0ff33add9b486f.exe

  • Size

    1005KB

  • MD5

    cc802b9dd4ecdd63c929b28c8ac434e9

  • SHA1

    ef7554e455ea348a8920da1e6dc8209b00517d88

  • SHA256

    82ba64ae2eb89d2f97cc4e9d3f7ab54aa05131baaf0c38469f0ff33add9b486f

  • SHA512

    7ed6a9fa2e9971057ceda65638287f801382862c7e1d70eaaf6331ba895bcfcedb71814a52dfbd9d823f7da654cb83e138a4dbffba6b072892d3889638f7d1a5

  • SSDEEP

    24576:5y6cVX6bFx6vTmNt8nJcLvcTU/GH3NHE3c1yZfPyA4:slKbFx6ve8niYUGXGsMZSA

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

maxi

C2

193.233.20.30:4125

Attributes
  • auth_value

    6e90da232d4c2e35c1a36c250f5f8904

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82ba64ae2eb89d2f97cc4e9d3f7ab54aa05131baaf0c38469f0ff33add9b486f.exe
    "C:\Users\Admin\AppData\Local\Temp\82ba64ae2eb89d2f97cc4e9d3f7ab54aa05131baaf0c38469f0ff33add9b486f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7779.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7779.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino9804.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino9804.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8875.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8875.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3704
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8985.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8985.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4804
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5952.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5952.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1692
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 1080
              6⤵
              • Program crash
              PID:2220
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBA68s52.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBA68s52.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:568
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 1792
            5⤵
            • Program crash
            PID:3068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en584873.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en584873.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2160
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge589893.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge589893.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4916
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5044
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3600
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3196
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1788
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3804
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:3872
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3120
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1692 -ip 1692
                1⤵
                  PID:1996
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 568 -ip 568
                  1⤵
                    PID:2200
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4232
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4128

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge589893.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge589893.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7779.exe

                    Filesize

                    823KB

                    MD5

                    32ecb702c481e7df951f74779173c941

                    SHA1

                    15bd8868ee51d8d9de000e5a05bd466eb08bb535

                    SHA256

                    18cf053088de8138484e82c3694f8c8ffd057dd556e2d900897abe62c85aa9b3

                    SHA512

                    5215593db31af0a9bf5f1553118230b69d4b961b997774d18e9a378a184ba65f79bd2eea06479289401e1603c17abb788257f198ae87433c00b5b53b70728838

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7779.exe

                    Filesize

                    823KB

                    MD5

                    32ecb702c481e7df951f74779173c941

                    SHA1

                    15bd8868ee51d8d9de000e5a05bd466eb08bb535

                    SHA256

                    18cf053088de8138484e82c3694f8c8ffd057dd556e2d900897abe62c85aa9b3

                    SHA512

                    5215593db31af0a9bf5f1553118230b69d4b961b997774d18e9a378a184ba65f79bd2eea06479289401e1603c17abb788257f198ae87433c00b5b53b70728838

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en584873.exe

                    Filesize

                    175KB

                    MD5

                    0bad76cd3276f38206bf62a5f6061853

                    SHA1

                    e7f11197db98b02eff7904e04e7a3f6af5bfd898

                    SHA256

                    5ee4a25885ee8a675008057b7e76ee78f1e6750bc65f673ba260e95525588504

                    SHA512

                    41d3b0443e4aed4e5e6b4ed285edd1c675f21dfd5db6ccf66be11150bb60a5fbb68f79f835516bad143fbe12d4dfef46a4c80852d9332afb3db50316d83f4f59

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en584873.exe

                    Filesize

                    175KB

                    MD5

                    0bad76cd3276f38206bf62a5f6061853

                    SHA1

                    e7f11197db98b02eff7904e04e7a3f6af5bfd898

                    SHA256

                    5ee4a25885ee8a675008057b7e76ee78f1e6750bc65f673ba260e95525588504

                    SHA512

                    41d3b0443e4aed4e5e6b4ed285edd1c675f21dfd5db6ccf66be11150bb60a5fbb68f79f835516bad143fbe12d4dfef46a4c80852d9332afb3db50316d83f4f59

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino9804.exe

                    Filesize

                    681KB

                    MD5

                    db4f326ff32b9cc46f7124ddea27e930

                    SHA1

                    c9592a700af8fa29abe5ee3c1ce470b151cb3ebc

                    SHA256

                    53d14939815d7d6161ac8feaea9df26f8b248e44a334a55bf6de99e63423c417

                    SHA512

                    90338915f315e00ccb3461410087dd965b57a50aa5765cda3548ba37c29b65676735d1d2dba51e47acc592f7caeec45d021aac060485451425d43385cbe35fd0

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino9804.exe

                    Filesize

                    681KB

                    MD5

                    db4f326ff32b9cc46f7124ddea27e930

                    SHA1

                    c9592a700af8fa29abe5ee3c1ce470b151cb3ebc

                    SHA256

                    53d14939815d7d6161ac8feaea9df26f8b248e44a334a55bf6de99e63423c417

                    SHA512

                    90338915f315e00ccb3461410087dd965b57a50aa5765cda3548ba37c29b65676735d1d2dba51e47acc592f7caeec45d021aac060485451425d43385cbe35fd0

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBA68s52.exe

                    Filesize

                    468KB

                    MD5

                    1385f2f57a4783fe546041768434582c

                    SHA1

                    0b7924fc426f402bccf2295855330975ec2deac7

                    SHA256

                    702b135f79d9480f52eb8e6f778cc644c4b2e430c474c4052642bf7dc3f26d02

                    SHA512

                    238f515282c83f3b29938995be9ef068feb2e88c0015ef6f570b951a1697bdc4fcdd21a78a3198bd0009aff2c036f8d7c55759056543dac3efba36d3c2888407

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBA68s52.exe

                    Filesize

                    468KB

                    MD5

                    1385f2f57a4783fe546041768434582c

                    SHA1

                    0b7924fc426f402bccf2295855330975ec2deac7

                    SHA256

                    702b135f79d9480f52eb8e6f778cc644c4b2e430c474c4052642bf7dc3f26d02

                    SHA512

                    238f515282c83f3b29938995be9ef068feb2e88c0015ef6f570b951a1697bdc4fcdd21a78a3198bd0009aff2c036f8d7c55759056543dac3efba36d3c2888407

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8875.exe

                    Filesize

                    338KB

                    MD5

                    63ff0cd1f54627ec1f8531eb2e6ed515

                    SHA1

                    feb9c414bb955db1c0ab0c364cef907813b92925

                    SHA256

                    662b64afc0e0f3825366225ebb5165ab3e07697c1774e17a3d80b77c7007b1a8

                    SHA512

                    d91bed13955d4c5a86f03ede7e1d9d25e4bbc63e3613d39b8f1a39c2af4686ac7e83f530bec403a9e821e1ea1e0816959591e7b8f48a680d025dfdc35e5262d0

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8875.exe

                    Filesize

                    338KB

                    MD5

                    63ff0cd1f54627ec1f8531eb2e6ed515

                    SHA1

                    feb9c414bb955db1c0ab0c364cef907813b92925

                    SHA256

                    662b64afc0e0f3825366225ebb5165ab3e07697c1774e17a3d80b77c7007b1a8

                    SHA512

                    d91bed13955d4c5a86f03ede7e1d9d25e4bbc63e3613d39b8f1a39c2af4686ac7e83f530bec403a9e821e1ea1e0816959591e7b8f48a680d025dfdc35e5262d0

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8985.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus8985.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5952.exe

                    Filesize

                    412KB

                    MD5

                    03e266282232e6a79dc802f2d5a11b2f

                    SHA1

                    f66f76ac7ecd0093eb8a475e6792882781ea91b9

                    SHA256

                    dfe8e34c0cf31dd6f7cd3e40123861bd020e9a0a133a63c12f90e767250d54f5

                    SHA512

                    d349a58421f34c48cede88def85315af203d2191f463a5b02e5ca21763da12c052ac4d80b212eec6373b3732b84e5402a08bd1b97bececcb06f82208ee8c6038

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5952.exe

                    Filesize

                    412KB

                    MD5

                    03e266282232e6a79dc802f2d5a11b2f

                    SHA1

                    f66f76ac7ecd0093eb8a475e6792882781ea91b9

                    SHA256

                    dfe8e34c0cf31dd6f7cd3e40123861bd020e9a0a133a63c12f90e767250d54f5

                    SHA512

                    d349a58421f34c48cede88def85315af203d2191f463a5b02e5ca21763da12c052ac4d80b212eec6373b3732b84e5402a08bd1b97bececcb06f82208ee8c6038

                  • memory/568-1123-0x0000000005BF0000-0x0000000005C82000-memory.dmp

                    Filesize

                    584KB

                  • memory/568-235-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-1133-0x0000000007FA0000-0x0000000007FF0000-memory.dmp

                    Filesize

                    320KB

                  • memory/568-1132-0x00000000022C0000-0x0000000002336000-memory.dmp

                    Filesize

                    472KB

                  • memory/568-1131-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-1130-0x0000000007940000-0x0000000007E6C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/568-1129-0x0000000007760000-0x0000000007922000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/568-1128-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-1127-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-1126-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-1124-0x0000000005C90000-0x0000000005CF6000-memory.dmp

                    Filesize

                    408KB

                  • memory/568-1122-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-1121-0x0000000005900000-0x000000000593C000-memory.dmp

                    Filesize

                    240KB

                  • memory/568-1120-0x00000000058E0000-0x00000000058F2000-memory.dmp

                    Filesize

                    72KB

                  • memory/568-1119-0x00000000057A0000-0x00000000058AA000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/568-208-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-209-0x00000000005F0000-0x000000000063B000-memory.dmp

                    Filesize

                    300KB

                  • memory/568-211-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-210-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-213-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-215-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

                    Filesize

                    64KB

                  • memory/568-214-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-217-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-219-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-221-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-223-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-225-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-227-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-229-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-231-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-233-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-1118-0x0000000005100000-0x0000000005718000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/568-237-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-239-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-241-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-243-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/568-245-0x00000000050A0000-0x00000000050DE000-memory.dmp

                    Filesize

                    248KB

                  • memory/1692-190-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-168-0x0000000000610000-0x000000000063D000-memory.dmp

                    Filesize

                    180KB

                  • memory/1692-182-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-203-0x0000000000400000-0x00000000004E7000-memory.dmp

                    Filesize

                    924KB

                  • memory/1692-201-0x0000000004D20000-0x0000000004D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1692-178-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-200-0x0000000004D20000-0x0000000004D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1692-199-0x0000000000400000-0x00000000004E7000-memory.dmp

                    Filesize

                    924KB

                  • memory/1692-198-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-196-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-194-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-186-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-180-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-184-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-192-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-176-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-174-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-167-0x0000000004D30000-0x00000000052D4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1692-188-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-170-0x0000000004D20000-0x0000000004D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/1692-171-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-172-0x0000000004B90000-0x0000000004BA2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1692-169-0x0000000004D20000-0x0000000004D30000-memory.dmp

                    Filesize

                    64KB

                  • memory/2160-1141-0x0000000004F70000-0x0000000004F80000-memory.dmp

                    Filesize

                    64KB

                  • memory/2160-1140-0x0000000004F70000-0x0000000004F80000-memory.dmp

                    Filesize

                    64KB

                  • memory/2160-1139-0x0000000000690000-0x00000000006C2000-memory.dmp

                    Filesize

                    200KB

                  • memory/4804-161-0x0000000000990000-0x000000000099A000-memory.dmp

                    Filesize

                    40KB