Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2023, 03:40

General

  • Target

    988878720960b2f609009e0d59294dd01bcc03a73732981577c2ef14101dd745.exe

  • Size

    1016KB

  • MD5

    df40e11f35bf3bb2fa3c63c4d6e8c466

  • SHA1

    370d687ef49a75468dd00577c4695464f9be9f18

  • SHA256

    988878720960b2f609009e0d59294dd01bcc03a73732981577c2ef14101dd745

  • SHA512

    583b91d48e7893f78571afee114f507b1c4bb7634541d73ccdcd75542674a5564268092c3e71fe808ccfe38f9ee90dedd58f73303a14e4d66ef9f34f1ab8eab0

  • SSDEEP

    24576:qy+w6n8ANnSPCFW0qHfM6Wt8lvyP59fZ3ACl9Wfqhksk6:xRW8ynSz3Wt8lvyRHBlPh

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

C2

193.233.20.31:4125

Attributes
  • auth_value

    9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\988878720960b2f609009e0d59294dd01bcc03a73732981577c2ef14101dd745.exe
    "C:\Users\Admin\AppData\Local\Temp\988878720960b2f609009e0d59294dd01bcc03a73732981577c2ef14101dd745.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4603.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4603.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3026.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3026.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5820.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5820.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3599.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3599.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3368
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1117.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1117.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1332
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1088
              6⤵
              • Program crash
              PID:3748
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dmG73s58.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dmG73s58.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4556
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 2032
            5⤵
            • Program crash
            PID:4560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en811827.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en811827.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge153663.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge153663.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3144
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4144
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3308
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4604
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3068
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3616
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:3932
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3468
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1332 -ip 1332
                1⤵
                  PID:4596
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4556 -ip 4556
                  1⤵
                    PID:3596
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:824
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1880

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge153663.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge153663.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4603.exe

                    Filesize

                    842KB

                    MD5

                    6aad069452db1e353e1dd99390849c91

                    SHA1

                    633f3ef9ef1e9424ffdf8c5207ef68209ef6376c

                    SHA256

                    f06dabe597875d7d0f204e5b8187ceb58df3afca2d3bba8dc14dfbdb75b27c11

                    SHA512

                    71366e4004b05ebf946f8b8f025b684555f87e5982220d732657719faa5523ae3b7af61f8f949f5a17e6005ce926e45f055bdd5898c5daacb8cc97bff88f59e2

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino4603.exe

                    Filesize

                    842KB

                    MD5

                    6aad069452db1e353e1dd99390849c91

                    SHA1

                    633f3ef9ef1e9424ffdf8c5207ef68209ef6376c

                    SHA256

                    f06dabe597875d7d0f204e5b8187ceb58df3afca2d3bba8dc14dfbdb75b27c11

                    SHA512

                    71366e4004b05ebf946f8b8f025b684555f87e5982220d732657719faa5523ae3b7af61f8f949f5a17e6005ce926e45f055bdd5898c5daacb8cc97bff88f59e2

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en811827.exe

                    Filesize

                    175KB

                    MD5

                    30bf410db5f6c05f0dee763f5a0fe5b7

                    SHA1

                    1f4187925e1af163603a12bb116e869f8f137455

                    SHA256

                    d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

                    SHA512

                    5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en811827.exe

                    Filesize

                    175KB

                    MD5

                    30bf410db5f6c05f0dee763f5a0fe5b7

                    SHA1

                    1f4187925e1af163603a12bb116e869f8f137455

                    SHA256

                    d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

                    SHA512

                    5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3026.exe

                    Filesize

                    700KB

                    MD5

                    2d072f69d358ffb3bf1368e5c0c8acf7

                    SHA1

                    508dff26b906ee78b26807005c6eb5b5b9bba814

                    SHA256

                    82f0bbd778bb92ab5d0ab67cbe39ced61859f8bb8c971c67686855bdd992b31a

                    SHA512

                    fb83916c2f8811d4d8872ad7c58f4e77405b70faa49a0021a00a4f2fe5700064f0973572c7e51774cc1ba3d29ab2b364f39580e9e41d97c58743a7c1688596f6

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino3026.exe

                    Filesize

                    700KB

                    MD5

                    2d072f69d358ffb3bf1368e5c0c8acf7

                    SHA1

                    508dff26b906ee78b26807005c6eb5b5b9bba814

                    SHA256

                    82f0bbd778bb92ab5d0ab67cbe39ced61859f8bb8c971c67686855bdd992b31a

                    SHA512

                    fb83916c2f8811d4d8872ad7c58f4e77405b70faa49a0021a00a4f2fe5700064f0973572c7e51774cc1ba3d29ab2b364f39580e9e41d97c58743a7c1688596f6

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dmG73s58.exe

                    Filesize

                    358KB

                    MD5

                    617e4b74024b8d3a8e6ffb811e4d3c04

                    SHA1

                    38c4a78677a853de3046443afcbcc38704990f5a

                    SHA256

                    5211a6022191fad2a73266275e082bf670b9a58170e586c259bf99f2faac370d

                    SHA512

                    ce8ae878d6c9990e722efb8ed6ccf68319ab8c26cf5bb8aa89c62f21cf834c6eff1f001c7c7e776e705f221488ebfd94878d8d992f6dfb133753fc533165143c

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dmG73s58.exe

                    Filesize

                    358KB

                    MD5

                    617e4b74024b8d3a8e6ffb811e4d3c04

                    SHA1

                    38c4a78677a853de3046443afcbcc38704990f5a

                    SHA256

                    5211a6022191fad2a73266275e082bf670b9a58170e586c259bf99f2faac370d

                    SHA512

                    ce8ae878d6c9990e722efb8ed6ccf68319ab8c26cf5bb8aa89c62f21cf834c6eff1f001c7c7e776e705f221488ebfd94878d8d992f6dfb133753fc533165143c

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5820.exe

                    Filesize

                    347KB

                    MD5

                    6f997dba135a715094acf72d6cfcf5fd

                    SHA1

                    e9ab78d17aef2d1ce7dc55a163003b67e130d998

                    SHA256

                    3a22e84c600aae31371b8ab060e0d512c197c1ecf55b1e3b5ad4236286a93d9b

                    SHA512

                    aad64d54df1d87782543dfd9761e9b0cef7476fcbf4a7eaf2ef768fea7b4a9029f767816690e938edd9a7df27d629678a57aeee626ab734d786030ca11ef8749

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino5820.exe

                    Filesize

                    347KB

                    MD5

                    6f997dba135a715094acf72d6cfcf5fd

                    SHA1

                    e9ab78d17aef2d1ce7dc55a163003b67e130d998

                    SHA256

                    3a22e84c600aae31371b8ab060e0d512c197c1ecf55b1e3b5ad4236286a93d9b

                    SHA512

                    aad64d54df1d87782543dfd9761e9b0cef7476fcbf4a7eaf2ef768fea7b4a9029f767816690e938edd9a7df27d629678a57aeee626ab734d786030ca11ef8749

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3599.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3599.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1117.exe

                    Filesize

                    300KB

                    MD5

                    ae7695e28ddc0f7572a0b4e25fad65be

                    SHA1

                    7a9ee4b7eb9a6a9a52c3f3a3621b94d74719f273

                    SHA256

                    c4fdadf0120879f900a78ca39884828b835e75c1a1019a631ec9286e4f420603

                    SHA512

                    826ac455147ea2737989802e5c6271f5d8ce9c5a0692f152bac715687bf10dec02bb262bf34761e3910b447765f1a70a3adf48564d0f46734547bd31f4b772e2

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1117.exe

                    Filesize

                    300KB

                    MD5

                    ae7695e28ddc0f7572a0b4e25fad65be

                    SHA1

                    7a9ee4b7eb9a6a9a52c3f3a3621b94d74719f273

                    SHA256

                    c4fdadf0120879f900a78ca39884828b835e75c1a1019a631ec9286e4f420603

                    SHA512

                    826ac455147ea2737989802e5c6271f5d8ce9c5a0692f152bac715687bf10dec02bb262bf34761e3910b447765f1a70a3adf48564d0f46734547bd31f4b772e2

                  • memory/1332-190-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-200-0x0000000000400000-0x000000000070E000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1332-191-0x0000000004F40000-0x0000000004F50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1332-167-0x00000000009B0000-0x00000000009DD000-memory.dmp

                    Filesize

                    180KB

                  • memory/1332-192-0x0000000004F40000-0x0000000004F50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1332-182-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-180-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-178-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-197-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-195-0x0000000004F40000-0x0000000004F50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1332-199-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-194-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-172-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-188-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-201-0x0000000004F40000-0x0000000004F50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1332-202-0x0000000004F40000-0x0000000004F50000-memory.dmp

                    Filesize

                    64KB

                  • memory/1332-204-0x0000000000400000-0x000000000070E000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/1332-168-0x0000000004F50000-0x00000000054F4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1332-184-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-186-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-176-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-174-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-170-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/1332-169-0x0000000002660000-0x0000000002672000-memory.dmp

                    Filesize

                    72KB

                  • memory/3368-161-0x00000000004A0000-0x00000000004AA000-memory.dmp

                    Filesize

                    40KB

                  • memory/3884-1139-0x0000000000D70000-0x0000000000DA2000-memory.dmp

                    Filesize

                    200KB

                  • memory/3884-1140-0x0000000005B90000-0x0000000005BA0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-214-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-228-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-230-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-232-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-234-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-236-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-238-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-240-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-242-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-276-0x0000000000880000-0x00000000008CB000-memory.dmp

                    Filesize

                    300KB

                  • memory/4556-277-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-279-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-1118-0x00000000054C0000-0x0000000005AD8000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4556-1119-0x0000000005B00000-0x0000000005C0A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4556-1120-0x0000000005C40000-0x0000000005C52000-memory.dmp

                    Filesize

                    72KB

                  • memory/4556-1121-0x0000000005C60000-0x0000000005C9C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4556-1122-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-1124-0x0000000005F50000-0x0000000005FE2000-memory.dmp

                    Filesize

                    584KB

                  • memory/4556-1125-0x0000000005FF0000-0x0000000006056000-memory.dmp

                    Filesize

                    408KB

                  • memory/4556-1126-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-1127-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-1128-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4556-1129-0x0000000006B50000-0x0000000006D12000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4556-1130-0x0000000006D30000-0x000000000725C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4556-1131-0x0000000007380000-0x00000000073F6000-memory.dmp

                    Filesize

                    472KB

                  • memory/4556-226-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-224-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-222-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-220-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-218-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-216-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-212-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-210-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-209-0x00000000027D0000-0x000000000280E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4556-1132-0x0000000007420000-0x0000000007470000-memory.dmp

                    Filesize

                    320KB

                  • memory/4556-1133-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB