Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    116s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/03/2023, 11:14

General

  • Target

    dac978c58c03d41c483e6a84162ba60fff4ddf3805b13e4f40a2ebe693083dc2.exe

  • Size

    1.0MB

  • MD5

    408010481723fef3ef93c8e8839fea3c

  • SHA1

    7b5848f0fbbee5beaa03cbb763d0530f97cc2b00

  • SHA256

    dac978c58c03d41c483e6a84162ba60fff4ddf3805b13e4f40a2ebe693083dc2

  • SHA512

    3a3ea39d3acdec9040aaf2bbd8f57dcea5aa169d2eb939038e3189d525727f6e4ae0122602acc7ce5d847c63a8d41f15079bc22d90c28eac0b4351b641a804b0

  • SSDEEP

    24576:QyXhMKmdrizzSD3K/VybRZ5AkDmT6nO8AwR9NoYW:XP0FjKtERfVDWIOUR9NoY

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

gong

C2

193.233.20.33:4125

Attributes
  • auth_value

    16950897b83de3bba9e4de36f06a8c05

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dac978c58c03d41c483e6a84162ba60fff4ddf3805b13e4f40a2ebe693083dc2.exe
    "C:\Users\Admin\AppData\Local\Temp\dac978c58c03d41c483e6a84162ba60fff4ddf3805b13e4f40a2ebe693083dc2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6154.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6154.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina1369.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina1369.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2550.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2550.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu348647.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu348647.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2100
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1736.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1736.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2548
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHu48s60.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHu48s60.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en764579.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en764579.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3152
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge146702.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge146702.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:756
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4376
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4416
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4828
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4836
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:2212
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4308
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4852
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3428
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:5048

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge146702.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge146702.exe

                Filesize

                227KB

                MD5

                a6166ae14a97618298c27aa861f7414e

                SHA1

                f71bb9dd0e8f75fc23b4570e03e875dd1775725d

                SHA256

                b320bcf82d8f30058f032c19c5ed03d64b84ea939b7a7df2530edece70f68b18

                SHA512

                d453429a1824ba78a49866868741229de5589c11846587abca5253526aa8ccbe783f02508dd1c9a71a993127ff232e7f98f130295381a06128f6e2121cb457fb

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6154.exe

                Filesize

                842KB

                MD5

                6f45346c3cc0b102636118dc56515e1d

                SHA1

                fada746aa010ffb979cd3bc409b583665bc2632d

                SHA256

                34e9bff46f1dfa22575d3b764f5518f3bbe62f33cd26cb709a61c51616a23136

                SHA512

                467ac6ea223806346008fbcd565fbe05b5ea737c417022ed5534f264ffc9a57d9ce4643367df33a170ffd6a0d213a7faa342f7e7b0aa73fb3e0d7fb0d6129ed2

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6154.exe

                Filesize

                842KB

                MD5

                6f45346c3cc0b102636118dc56515e1d

                SHA1

                fada746aa010ffb979cd3bc409b583665bc2632d

                SHA256

                34e9bff46f1dfa22575d3b764f5518f3bbe62f33cd26cb709a61c51616a23136

                SHA512

                467ac6ea223806346008fbcd565fbe05b5ea737c417022ed5534f264ffc9a57d9ce4643367df33a170ffd6a0d213a7faa342f7e7b0aa73fb3e0d7fb0d6129ed2

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en764579.exe

                Filesize

                175KB

                MD5

                8945eed5bb13e09711eb8e0098e37ad0

                SHA1

                c54b6843eb1dd87b8be16b764fe9ee0d78e6850c

                SHA256

                c6f06dd9a337a180d6cf6be00283869eed41b6f30da32ded9ed1adbd0f489dc6

                SHA512

                1a880059c60925fe67b4aa490f0c412877677229fb7c6fa3ea95ed5b3ec34e6c07a84cea9693451ae991b4bb58c44c33788fc769b465854b50837670b2c2f9a8

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en764579.exe

                Filesize

                175KB

                MD5

                8945eed5bb13e09711eb8e0098e37ad0

                SHA1

                c54b6843eb1dd87b8be16b764fe9ee0d78e6850c

                SHA256

                c6f06dd9a337a180d6cf6be00283869eed41b6f30da32ded9ed1adbd0f489dc6

                SHA512

                1a880059c60925fe67b4aa490f0c412877677229fb7c6fa3ea95ed5b3ec34e6c07a84cea9693451ae991b4bb58c44c33788fc769b465854b50837670b2c2f9a8

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina1369.exe

                Filesize

                700KB

                MD5

                50afc22ef7a9f973d98dd5447e67cfc8

                SHA1

                474f6ae2ea3790566f72788799af0d015de85894

                SHA256

                c2fb41b28677f8367f195223b3be34ccc1bbfd5719bf81f48277e326b2113fc4

                SHA512

                ca77f093457c302e9eeb9c09309d63fe45c9beac39f79c5269c29c32cb2d802e8dd9feaedeee8616ca6186c4613b17be7be9376cfd3320914f1498d88e31d258

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina1369.exe

                Filesize

                700KB

                MD5

                50afc22ef7a9f973d98dd5447e67cfc8

                SHA1

                474f6ae2ea3790566f72788799af0d015de85894

                SHA256

                c2fb41b28677f8367f195223b3be34ccc1bbfd5719bf81f48277e326b2113fc4

                SHA512

                ca77f093457c302e9eeb9c09309d63fe45c9beac39f79c5269c29c32cb2d802e8dd9feaedeee8616ca6186c4613b17be7be9376cfd3320914f1498d88e31d258

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHu48s60.exe

                Filesize

                359KB

                MD5

                0ff2bab8b5d2ff1a89b7aa3b7a6dd77d

                SHA1

                6c14afa6947064d555d5c5971c6aa56ac72a58ae

                SHA256

                e9d3b545e897e3f1498708921bb91b39e78c1eea5846b78f37bbb140b6c31e8f

                SHA512

                adc35ab6adc962c892f02b38fe54978e656de3544dda9dcb3e73117d1aa08fcd994fa1367ef370f1abe605451d63d00d0897700a011afa5cb35c589cef548978

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHu48s60.exe

                Filesize

                359KB

                MD5

                0ff2bab8b5d2ff1a89b7aa3b7a6dd77d

                SHA1

                6c14afa6947064d555d5c5971c6aa56ac72a58ae

                SHA256

                e9d3b545e897e3f1498708921bb91b39e78c1eea5846b78f37bbb140b6c31e8f

                SHA512

                adc35ab6adc962c892f02b38fe54978e656de3544dda9dcb3e73117d1aa08fcd994fa1367ef370f1abe605451d63d00d0897700a011afa5cb35c589cef548978

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2550.exe

                Filesize

                347KB

                MD5

                5e8ca29899b5481792d26d7bb87afb1d

                SHA1

                67f15a1eba5b16d718fee136a834c24a6160fe2d

                SHA256

                420bcd28d5524c5d69c202380f5863a68a75cb0f60a939e1b3bbff236e5e2924

                SHA512

                bf7afcd65a9e4ba26a2aa01aabcb69ea2fdeedfdbef6ec0159d0f10ed0785645e1b83b43ef34808eff57b2fa1401eaeb51367357a5773a3c7ec6f2d8f2495c12

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2550.exe

                Filesize

                347KB

                MD5

                5e8ca29899b5481792d26d7bb87afb1d

                SHA1

                67f15a1eba5b16d718fee136a834c24a6160fe2d

                SHA256

                420bcd28d5524c5d69c202380f5863a68a75cb0f60a939e1b3bbff236e5e2924

                SHA512

                bf7afcd65a9e4ba26a2aa01aabcb69ea2fdeedfdbef6ec0159d0f10ed0785645e1b83b43ef34808eff57b2fa1401eaeb51367357a5773a3c7ec6f2d8f2495c12

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu348647.exe

                Filesize

                12KB

                MD5

                a5d28b7be3b996ff8e3dec2756eb8785

                SHA1

                f1ea9e227d1730e94d28740629b05701d31ea83a

                SHA256

                a3d57a819d5ccd603ae755475ce85ed7e2a570b9b11cee6922629d4015a29a78

                SHA512

                df326518eaa7707bc01c0509100b786935dd5ea94533a3102adf197f322a211f81a97ae4ff81244cf0f4773d3e07f878cad84b469ae263ed4a10b1257c6fdc9f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu348647.exe

                Filesize

                12KB

                MD5

                a5d28b7be3b996ff8e3dec2756eb8785

                SHA1

                f1ea9e227d1730e94d28740629b05701d31ea83a

                SHA256

                a3d57a819d5ccd603ae755475ce85ed7e2a570b9b11cee6922629d4015a29a78

                SHA512

                df326518eaa7707bc01c0509100b786935dd5ea94533a3102adf197f322a211f81a97ae4ff81244cf0f4773d3e07f878cad84b469ae263ed4a10b1257c6fdc9f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1736.exe

                Filesize

                300KB

                MD5

                4f821bb64078bb41222d6626a0fe9925

                SHA1

                4b5ca63d702c63a359f9d5b2bdecf5014c5324c5

                SHA256

                c878687b0365df6bdc657c84cf85a57012af900663ece753d26ccd4e6718e838

                SHA512

                0104351583355d45d9a513de3d8acb790d1d6f405c5aa70ae74d3b4bff12a38b3007b44313cdf3d5a38d5cb9a5886885f01c7d706c310f0c2ee3401ec1f4efa3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1736.exe

                Filesize

                300KB

                MD5

                4f821bb64078bb41222d6626a0fe9925

                SHA1

                4b5ca63d702c63a359f9d5b2bdecf5014c5324c5

                SHA256

                c878687b0365df6bdc657c84cf85a57012af900663ece753d26ccd4e6718e838

                SHA512

                0104351583355d45d9a513de3d8acb790d1d6f405c5aa70ae74d3b4bff12a38b3007b44313cdf3d5a38d5cb9a5886885f01c7d706c310f0c2ee3401ec1f4efa3

              • memory/2100-149-0x00000000008B0000-0x00000000008BA000-memory.dmp

                Filesize

                40KB

              • memory/2548-163-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-187-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-165-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-167-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-169-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-171-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-173-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-175-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-177-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-179-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-181-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-183-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-185-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-160-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-188-0x0000000004D80000-0x0000000004D90000-memory.dmp

                Filesize

                64KB

              • memory/2548-189-0x0000000004D80000-0x0000000004D90000-memory.dmp

                Filesize

                64KB

              • memory/2548-190-0x0000000000400000-0x000000000070E000-memory.dmp

                Filesize

                3.1MB

              • memory/2548-191-0x0000000004D80000-0x0000000004D90000-memory.dmp

                Filesize

                64KB

              • memory/2548-193-0x0000000000400000-0x000000000070E000-memory.dmp

                Filesize

                3.1MB

              • memory/2548-161-0x0000000002540000-0x0000000002552000-memory.dmp

                Filesize

                72KB

              • memory/2548-159-0x0000000002540000-0x0000000002558000-memory.dmp

                Filesize

                96KB

              • memory/2548-158-0x0000000004D90000-0x000000000528E000-memory.dmp

                Filesize

                5.0MB

              • memory/2548-157-0x0000000000C00000-0x0000000000C1A000-memory.dmp

                Filesize

                104KB

              • memory/2548-156-0x0000000004D80000-0x0000000004D90000-memory.dmp

                Filesize

                64KB

              • memory/2548-155-0x00000000001D0000-0x00000000001FD000-memory.dmp

                Filesize

                180KB

              • memory/2740-203-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-1113-0x0000000005410000-0x000000000544E000-memory.dmp

                Filesize

                248KB

              • memory/2740-211-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-213-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-215-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-217-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-219-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-221-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-223-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-225-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-227-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-229-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-231-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-233-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-300-0x00000000007F0000-0x000000000083B000-memory.dmp

                Filesize

                300KB

              • memory/2740-302-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-304-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-306-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-1110-0x0000000005840000-0x0000000005E46000-memory.dmp

                Filesize

                6.0MB

              • memory/2740-1111-0x00000000052B0000-0x00000000053BA000-memory.dmp

                Filesize

                1.0MB

              • memory/2740-1112-0x00000000053F0000-0x0000000005402000-memory.dmp

                Filesize

                72KB

              • memory/2740-209-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-1114-0x0000000005560000-0x00000000055AB000-memory.dmp

                Filesize

                300KB

              • memory/2740-1115-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-1116-0x00000000056F0000-0x0000000005756000-memory.dmp

                Filesize

                408KB

              • memory/2740-1118-0x00000000063D0000-0x0000000006462000-memory.dmp

                Filesize

                584KB

              • memory/2740-1119-0x0000000006470000-0x00000000064E6000-memory.dmp

                Filesize

                472KB

              • memory/2740-1120-0x0000000006500000-0x0000000006550000-memory.dmp

                Filesize

                320KB

              • memory/2740-1121-0x0000000006580000-0x0000000006742000-memory.dmp

                Filesize

                1.8MB

              • memory/2740-1122-0x0000000006760000-0x0000000006C8C000-memory.dmp

                Filesize

                5.2MB

              • memory/2740-1123-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-1124-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-1125-0x0000000004C60000-0x0000000004C70000-memory.dmp

                Filesize

                64KB

              • memory/2740-198-0x0000000004C20000-0x0000000004C66000-memory.dmp

                Filesize

                280KB

              • memory/2740-199-0x00000000051B0000-0x00000000051F4000-memory.dmp

                Filesize

                272KB

              • memory/2740-200-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-207-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-205-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/2740-201-0x00000000051B0000-0x00000000051EE000-memory.dmp

                Filesize

                248KB

              • memory/3152-1133-0x00000000054E0000-0x00000000054F0000-memory.dmp

                Filesize

                64KB

              • memory/3152-1132-0x0000000005370000-0x00000000053BB000-memory.dmp

                Filesize

                300KB

              • memory/3152-1131-0x0000000000930000-0x0000000000962000-memory.dmp

                Filesize

                200KB