Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2023, 14:01

General

  • Target

    setup.exe

  • Size

    1.1MB

  • MD5

    e026d7838bb264402ac3f1e6880433e0

  • SHA1

    3892bf4e1dad9abb9c10cae6e4cd3a9a006bfdb6

  • SHA256

    9ae352b627b6da67e07d6cbfe96fbc3a92edbc9f036be188139435ee03b8c058

  • SHA512

    9a7e37165c5a5acad29d2cabd1e50bcfa22f044525310861bd8b28ba2a9a049a431e321ea185ec7a572bef60d42201d99e33fcabc132f2b63b8fd2ad682fe5ed

  • SSDEEP

    24576:r2tTN3Ei6gLWwbtGxXyPyLMShCmoA6mTUpuT:4TNEg+ytbmoAJo

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

vina

C2

193.233.20.28:4125

Attributes
  • auth_value

    7e90e85c9cea0965a2bfd23e1cfc6bc8

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3612
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3232
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1092
              6⤵
              • Program crash
              PID:3104
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1336
            5⤵
            • Program crash
            PID:2016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:2192
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3916
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1784
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:2564
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3232
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4956
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:1552
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3560
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 660
                  2⤵
                  • Program crash
                  PID:2064
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4988 -ip 4988
                1⤵
                  PID:1608
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 952 -ip 952
                  1⤵
                    PID:3336
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1188 -ip 1188
                    1⤵
                      PID:1832
                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                      1⤵
                      • Executes dropped EXE
                      PID:220

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge440120.exe

                      Filesize

                      226KB

                      MD5

                      8627ebe3777cc777ed2a14b907162224

                      SHA1

                      06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                      SHA256

                      319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                      SHA512

                      9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                      Filesize

                      787KB

                      MD5

                      56434c8ed4c19d4973c9022bed5d65fc

                      SHA1

                      c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                      SHA256

                      d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                      SHA512

                      56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino3726.exe

                      Filesize

                      787KB

                      MD5

                      56434c8ed4c19d4973c9022bed5d65fc

                      SHA1

                      c0bd4a7d91aa4c85903f6b9d26ac1883bda40712

                      SHA256

                      d4cb8eb33baf0c88d8f42f94d125cc3fe3d91e31991686ee2240e5abaa850af3

                      SHA512

                      56ca5eab6899980b555c28ca75b495aa0a60d46e62c8fa8886dc82d9af5c47d1f42022c17a7e13b19c50703e4ca3f695cd0deb059341a8a3abfc6f6102f7822f

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en563783.exe

                      Filesize

                      175KB

                      MD5

                      9796505f0e48281006d920d7c01dfe7b

                      SHA1

                      409d6a3760f682cc6e10c4f63e16755081d1342e

                      SHA256

                      acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479

                      SHA512

                      c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                      Filesize

                      644KB

                      MD5

                      6fe2dd254687fd7b7b7a66610b0ce909

                      SHA1

                      af521d0a550c657e5bac77e010c5f9e960eb72c6

                      SHA256

                      dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                      SHA512

                      1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8383.exe

                      Filesize

                      644KB

                      MD5

                      6fe2dd254687fd7b7b7a66610b0ce909

                      SHA1

                      af521d0a550c657e5bac77e010c5f9e960eb72c6

                      SHA256

                      dff912ebe3d3a1190c168af03df996c4de6fb3364d36a260337560408798be4f

                      SHA512

                      1473b0ec7c9af268354f1358732e5defeb0e06aca55479ebee2872f69f0a1384e10d1c7c737c8f3350feebf06f15577f79440dd33f3f5fe2a79bebd50fe97359

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                      Filesize

                      297KB

                      MD5

                      f0bef689623bac4a599617ca12e59f57

                      SHA1

                      181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                      SHA256

                      8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                      SHA512

                      433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddE95s28.exe

                      Filesize

                      297KB

                      MD5

                      f0bef689623bac4a599617ca12e59f57

                      SHA1

                      181e6dfd3b8eb0dd5c0a6bef9f0e32185e262275

                      SHA256

                      8a59837d69ff5dcaedf3b964e91927458e218306332d5b47e7c4f09607b7d27a

                      SHA512

                      433fd35201bf800cb043539aa20ad8f9f60d2f8b0940d4b1223060b0e783905816384733c4ff34538ec9960fed93c59ae396354ceca892f338e89f424110f391

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                      Filesize

                      319KB

                      MD5

                      c8538173a294a6e854caa1bb6c6971d3

                      SHA1

                      8aae18c96ac645abd4762b544a6a632ae6d604ce

                      SHA256

                      6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                      SHA512

                      3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino8559.exe

                      Filesize

                      319KB

                      MD5

                      c8538173a294a6e854caa1bb6c6971d3

                      SHA1

                      8aae18c96ac645abd4762b544a6a632ae6d604ce

                      SHA256

                      6b8fd4ffa9c30e88bc1eee0b2898f6dbe1b5d86687092206436620f5491034ae

                      SHA512

                      3540230cafef2abe443713154e00862d498739c634488c29af74d7abb82d3240aa045be9e019e5625d7bd5e306dab32acb3e16a143881b821a32b871683557e8

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3672.exe

                      Filesize

                      11KB

                      MD5

                      7e93bacbbc33e6652e147e7fe07572a0

                      SHA1

                      421a7167da01c8da4dc4d5234ca3dd84e319e762

                      SHA256

                      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                      SHA512

                      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                      Filesize

                      239KB

                      MD5

                      3b9ebc8cf697ac2228177a4836d30419

                      SHA1

                      da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                      SHA256

                      63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                      SHA512

                      802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

                    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con2892.exe

                      Filesize

                      239KB

                      MD5

                      3b9ebc8cf697ac2228177a4836d30419

                      SHA1

                      da7cf3d39e43e8508cb8bdd7b9fbd156fdd51f6c

                      SHA256

                      63f029d14dc275ef79453b0b3ec7e7e364b130150da633e6d5964f25d833433c

                      SHA512

                      802d40a3386b4a81a98c2636536e83c58cd888b7d6248b88526683de389439ae2fab2f7a1335c7886cc2cfd5df12cf5d8fc5d2a6b91e40dde2ed40812241013c

                    • memory/952-1126-0x00000000059F0000-0x0000000005A02000-memory.dmp

                      Filesize

                      72KB

                    • memory/952-1134-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-1140-0x00000000082D0000-0x0000000008320000-memory.dmp

                      Filesize

                      320KB

                    • memory/952-1139-0x0000000004590000-0x0000000004606000-memory.dmp

                      Filesize

                      472KB

                    • memory/952-1138-0x00000000068E0000-0x0000000006E0C000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/952-1137-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-1136-0x0000000006700000-0x00000000068C2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/952-1135-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-1133-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-1131-0x0000000005DA0000-0x0000000005E06000-memory.dmp

                      Filesize

                      408KB

                    • memory/952-1130-0x0000000005D00000-0x0000000005D92000-memory.dmp

                      Filesize

                      584KB

                    • memory/952-1128-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-1127-0x0000000005A10000-0x0000000005A4C000-memory.dmp

                      Filesize

                      240KB

                    • memory/952-1125-0x00000000058B0000-0x00000000059BA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/952-1124-0x0000000005230000-0x0000000005848000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/952-646-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-248-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-246-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-244-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-242-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-214-0x0000000000760000-0x00000000007AB000-memory.dmp

                      Filesize

                      300KB

                    • memory/952-215-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-216-0x0000000004B30000-0x0000000004B40000-memory.dmp

                      Filesize

                      64KB

                    • memory/952-218-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-217-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-222-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-220-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-224-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-226-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-228-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-230-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-232-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-234-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-236-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-238-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/952-240-0x0000000004AA0000-0x0000000004ADE000-memory.dmp

                      Filesize

                      248KB

                    • memory/1188-141-0x0000000002250000-0x0000000002344000-memory.dmp

                      Filesize

                      976KB

                    • memory/1188-164-0x0000000000400000-0x00000000005A1000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/1632-1147-0x0000000000620000-0x0000000000652000-memory.dmp

                      Filesize

                      200KB

                    • memory/1632-1148-0x0000000004F80000-0x0000000004F90000-memory.dmp

                      Filesize

                      64KB

                    • memory/3232-163-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

                      Filesize

                      40KB

                    • memory/4988-192-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-184-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-176-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-202-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-200-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-198-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-196-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-194-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-180-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-178-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-190-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-188-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-186-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-204-0x0000000000400000-0x00000000004BB000-memory.dmp

                      Filesize

                      748KB

                    • memory/4988-182-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB

                    • memory/4988-174-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-173-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-205-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-206-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-172-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-171-0x0000000000740000-0x000000000076D000-memory.dmp

                      Filesize

                      180KB

                    • memory/4988-170-0x0000000004C30000-0x00000000051D4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4988-207-0x0000000004C20000-0x0000000004C30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4988-209-0x0000000000400000-0x00000000004BB000-memory.dmp

                      Filesize

                      748KB

                    • memory/4988-175-0x0000000002400000-0x0000000002412000-memory.dmp

                      Filesize

                      72KB