Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 14:24

General

  • Target

    file.exe

  • Size

    1021KB

  • MD5

    f616eefd5bfdb6319b6314777d18cfcc

  • SHA1

    c6f6ac1c9418b787cf3e06c1b8ccd737397f9704

  • SHA256

    cf88c19e1ed803ce213ffd1685f3cbdd787937c918a5dda0f0a2b33d62d18ee3

  • SHA512

    a908c0f41436b85419134c6ef0185e8f74d5382ec48d61fc99867850fb2a34b7e1569762e03d9a5c7a9613f899269f09de9e765bcf39a8a3315648bd83989b9f

  • SSDEEP

    24576:fy2IEjzDoJ3CM0yMaBku1LXA/NNMQV2QbRI6nQvZ4V:q/ODoRCzayu1kDMyNQx

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

gong

C2

193.233.20.33:4125

Attributes
  • auth_value

    16950897b83de3bba9e4de36f06a8c05

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0972.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0972.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3734.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3734.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5033.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5033.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu234314.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu234314.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1952
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8871.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8871.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1588
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 1084
              6⤵
              • Program crash
              PID:4760
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dql25s57.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dql25s57.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 1904
            5⤵
            • Program crash
            PID:3116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en690725.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en690725.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge746930.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge746930.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3744
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3436
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:936
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3076
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4560
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3736
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4028
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1140
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1588 -ip 1588
                1⤵
                  PID:1412
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4640 -ip 4640
                  1⤵
                    PID:652
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3476

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge746930.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge746930.exe

                    Filesize

                    227KB

                    MD5

                    77c33b2ecf123a1e122f7f6aa041843f

                    SHA1

                    5b798452ef52be82225e4883053c64f853538d24

                    SHA256

                    92cc06142cca15c265e1ce58c561d955f817ac7af332d34ea28f95c9c546bb7f

                    SHA512

                    287f79a82e6fb11b56eeb9fa57b499e6d6368830ed1581de40a1f84c7ebf3ec311ca9505e759951030c1bf5019b192013e5f90a7904b24739ededc97df75a14b

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0972.exe

                    Filesize

                    838KB

                    MD5

                    1eb350c001b40f02ab64ac4bb24d9485

                    SHA1

                    3e66abbe7473a9c5a04dd1d423fa3c98034b2913

                    SHA256

                    6ffe572e9a99cb8841e987efa1c49c230c2364b9171d005ab7962bfff418f9df

                    SHA512

                    919b434750ffae20cbaab26e1d3211f051051b0e9fbf2a01acd2ad79fe9e0a7a17cda1a43645bb3ee6899573d96c76c4940a46acf5e5773c650b6f6681fa1629

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0972.exe

                    Filesize

                    838KB

                    MD5

                    1eb350c001b40f02ab64ac4bb24d9485

                    SHA1

                    3e66abbe7473a9c5a04dd1d423fa3c98034b2913

                    SHA256

                    6ffe572e9a99cb8841e987efa1c49c230c2364b9171d005ab7962bfff418f9df

                    SHA512

                    919b434750ffae20cbaab26e1d3211f051051b0e9fbf2a01acd2ad79fe9e0a7a17cda1a43645bb3ee6899573d96c76c4940a46acf5e5773c650b6f6681fa1629

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en690725.exe

                    Filesize

                    175KB

                    MD5

                    52969041479679cb9cb21cb5afa3e724

                    SHA1

                    b817b690a986937e77e60a235e3224080dda8ef9

                    SHA256

                    d42422cdad078d75db4e7da89a8210a8090dd46528427bdd9ae92f7b09671ae9

                    SHA512

                    76d39bd3c8d23173fb95e37caef77748fde91c368113e7219f365f9594fe2164a85c639ff51588707f4d6a929aa876c0b7f1a1f1521afa6791804d49a230f987

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en690725.exe

                    Filesize

                    175KB

                    MD5

                    52969041479679cb9cb21cb5afa3e724

                    SHA1

                    b817b690a986937e77e60a235e3224080dda8ef9

                    SHA256

                    d42422cdad078d75db4e7da89a8210a8090dd46528427bdd9ae92f7b09671ae9

                    SHA512

                    76d39bd3c8d23173fb95e37caef77748fde91c368113e7219f365f9594fe2164a85c639ff51588707f4d6a929aa876c0b7f1a1f1521afa6791804d49a230f987

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3734.exe

                    Filesize

                    696KB

                    MD5

                    129cab0a3459709d4aeebe20c692f560

                    SHA1

                    1a954dead0ef36e878d8ea5363e7d32b356ac485

                    SHA256

                    3b79fd8867d1b86969f3f324d465c542d966c1fe55f03a003002a9ec23e305c0

                    SHA512

                    3bab8c02de75d4d636a337e51bf57484891c78345388d46000a1bf95695f5d2593d3ee5e2fb2533bda180a3ee0e2372f32713a46d701182094febbe408a5ad20

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3734.exe

                    Filesize

                    696KB

                    MD5

                    129cab0a3459709d4aeebe20c692f560

                    SHA1

                    1a954dead0ef36e878d8ea5363e7d32b356ac485

                    SHA256

                    3b79fd8867d1b86969f3f324d465c542d966c1fe55f03a003002a9ec23e305c0

                    SHA512

                    3bab8c02de75d4d636a337e51bf57484891c78345388d46000a1bf95695f5d2593d3ee5e2fb2533bda180a3ee0e2372f32713a46d701182094febbe408a5ad20

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dql25s57.exe

                    Filesize

                    350KB

                    MD5

                    1d7b22b689ef134bbfe24f55cf4b497c

                    SHA1

                    1a1eb10295dc35134fdcc62da19d497ca3ac862e

                    SHA256

                    972a10430769a7229fa121d65816678508b4cfb78df7f14aa545207152bef78f

                    SHA512

                    8dae8494d33495c7b5b48feb4922af2737a10ecaf53f7b9d7fa6956994d3891dcae3ed4d6bd11e1b1bea69bc1b7b6efb1321f2250e4e6879c116eb3e3cde4888

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dql25s57.exe

                    Filesize

                    350KB

                    MD5

                    1d7b22b689ef134bbfe24f55cf4b497c

                    SHA1

                    1a1eb10295dc35134fdcc62da19d497ca3ac862e

                    SHA256

                    972a10430769a7229fa121d65816678508b4cfb78df7f14aa545207152bef78f

                    SHA512

                    8dae8494d33495c7b5b48feb4922af2737a10ecaf53f7b9d7fa6956994d3891dcae3ed4d6bd11e1b1bea69bc1b7b6efb1321f2250e4e6879c116eb3e3cde4888

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5033.exe

                    Filesize

                    345KB

                    MD5

                    b7adbe9e6f0d957f8d107ffbdbbcb5b6

                    SHA1

                    d464982a171cc2c658d0db66257420da678e0907

                    SHA256

                    49f8be4113def80c02b282461c35a83e2ea741eafcbf2b1a6013e744b8cf485f

                    SHA512

                    f11af91207de08781a548376814201043a763b0fec296e6d7f1ab382312e748e10d543582c8aa370decba98fba7d266ce7d623ec5fca7cdb376470dabfa87e1c

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5033.exe

                    Filesize

                    345KB

                    MD5

                    b7adbe9e6f0d957f8d107ffbdbbcb5b6

                    SHA1

                    d464982a171cc2c658d0db66257420da678e0907

                    SHA256

                    49f8be4113def80c02b282461c35a83e2ea741eafcbf2b1a6013e744b8cf485f

                    SHA512

                    f11af91207de08781a548376814201043a763b0fec296e6d7f1ab382312e748e10d543582c8aa370decba98fba7d266ce7d623ec5fca7cdb376470dabfa87e1c

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu234314.exe

                    Filesize

                    12KB

                    MD5

                    55af4fd37268f12cca5fc17eb70ad549

                    SHA1

                    8146bb8071b28cbf6f8742888bce2071451116c8

                    SHA256

                    dd859825f6bcaafcf0a72dbe154a4155bf4870ec27812fedf15743ba7c0bc448

                    SHA512

                    86a34ca39477008b57de293db651a66f8fe085b71cc8aa0ae907358b75fb67d857255c8eb43aa172be879513072865af212d483f6a4c3d364a4b68b9cbd9012a

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu234314.exe

                    Filesize

                    12KB

                    MD5

                    55af4fd37268f12cca5fc17eb70ad549

                    SHA1

                    8146bb8071b28cbf6f8742888bce2071451116c8

                    SHA256

                    dd859825f6bcaafcf0a72dbe154a4155bf4870ec27812fedf15743ba7c0bc448

                    SHA512

                    86a34ca39477008b57de293db651a66f8fe085b71cc8aa0ae907358b75fb67d857255c8eb43aa172be879513072865af212d483f6a4c3d364a4b68b9cbd9012a

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8871.exe

                    Filesize

                    292KB

                    MD5

                    9bd4651d2cd3722dc27e13a84abd9a9f

                    SHA1

                    d06b4354707f3a16fe92b7de30ee8447da6cb8b8

                    SHA256

                    293034154a4d94fc78fba2eef56f17e7788abc6b6baa1095b25c281014f273e1

                    SHA512

                    d7cdeec7e9bca05579ea691b0fde5b13e26f7ec4f4c26ff9b2ced92fd65b56adac24c89c306637d71a96b988e559b6529bc0639c91f86a3c18e6dbd01a122eaa

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor8871.exe

                    Filesize

                    292KB

                    MD5

                    9bd4651d2cd3722dc27e13a84abd9a9f

                    SHA1

                    d06b4354707f3a16fe92b7de30ee8447da6cb8b8

                    SHA256

                    293034154a4d94fc78fba2eef56f17e7788abc6b6baa1095b25c281014f273e1

                    SHA512

                    d7cdeec7e9bca05579ea691b0fde5b13e26f7ec4f4c26ff9b2ced92fd65b56adac24c89c306637d71a96b988e559b6529bc0639c91f86a3c18e6dbd01a122eaa

                  • memory/1588-177-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-203-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1588-183-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-187-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-189-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-191-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-193-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-195-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-197-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-198-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1588-199-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1588-200-0x0000000000400000-0x000000000070C000-memory.dmp

                    Filesize

                    3.0MB

                  • memory/1588-201-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1588-185-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-204-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1588-181-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-205-0x0000000000400000-0x000000000070C000-memory.dmp

                    Filesize

                    3.0MB

                  • memory/1588-167-0x00000000007E0000-0x000000000080D000-memory.dmp

                    Filesize

                    180KB

                  • memory/1588-179-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-175-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-173-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-170-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-171-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1588-169-0x0000000004F60000-0x0000000005504000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1588-168-0x0000000004F50000-0x0000000004F60000-memory.dmp

                    Filesize

                    64KB

                  • memory/1952-161-0x0000000000E40000-0x0000000000E4A000-memory.dmp

                    Filesize

                    40KB

                  • memory/4640-214-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-1125-0x0000000005E10000-0x0000000005EA2000-memory.dmp

                    Filesize

                    584KB

                  • memory/4640-226-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-228-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-230-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-232-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-234-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-236-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-238-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-240-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-242-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-244-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-246-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-483-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-1120-0x0000000005430000-0x0000000005A48000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4640-1121-0x0000000005A50000-0x0000000005B5A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4640-1122-0x0000000004E10000-0x0000000004E22000-memory.dmp

                    Filesize

                    72KB

                  • memory/4640-1123-0x0000000004E30000-0x0000000004E6C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4640-1124-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-224-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-1126-0x0000000005EB0000-0x0000000005F16000-memory.dmp

                    Filesize

                    408KB

                  • memory/4640-1128-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-1129-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-1130-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-1131-0x00000000066D0000-0x0000000006746000-memory.dmp

                    Filesize

                    472KB

                  • memory/4640-1132-0x0000000006750000-0x00000000067A0000-memory.dmp

                    Filesize

                    320KB

                  • memory/4640-1133-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-1134-0x0000000007A70000-0x0000000007C32000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4640-1135-0x0000000007C40000-0x000000000816C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4640-222-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-218-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-211-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4640-210-0x0000000000720000-0x000000000076B000-memory.dmp

                    Filesize

                    300KB

                  • memory/4640-220-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-216-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-213-0x00000000025D0000-0x000000000260E000-memory.dmp

                    Filesize

                    248KB

                  • memory/4640-212-0x0000000004E70000-0x0000000004E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/4876-1142-0x0000000005650000-0x0000000005660000-memory.dmp

                    Filesize

                    64KB

                  • memory/4876-1141-0x0000000000970000-0x00000000009A2000-memory.dmp

                    Filesize

                    200KB