Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-03-2023 12:21

General

  • Target

    501f9a140db000b24c0be1f9854033cb30dc6f90f3f15dacd2888e1d0ebcdf96.exe

  • Size

    960KB

  • MD5

    e6ecd337ea46c5d4f92102fe8ffd66cf

  • SHA1

    d7f2d639286f2fe4c0919f1c311a1e5e467e267d

  • SHA256

    501f9a140db000b24c0be1f9854033cb30dc6f90f3f15dacd2888e1d0ebcdf96

  • SHA512

    98e323e9702e6d9cfd9296ca79b944460a7a56e24c711c13a5d97d7afd7d90806cdf6b5681768e49a7291689df53b2b90267da10c482e3ddc86540e824c1f492

  • SSDEEP

    24576:oywmVdKOY0CS+SD9uEKmNzIg1cyr2M3nI37NYguk9eT:vOAD9uEKmNcEciz3n+RY5

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

C2

193.233.20.30:4125

Attributes
  • auth_value

    fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 22 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\501f9a140db000b24c0be1f9854033cb30dc6f90f3f15dacd2888e1d0ebcdf96.exe
    "C:\Users\Admin\AppData\Local\Temp\501f9a140db000b24c0be1f9854033cb30dc6f90f3f15dacd2888e1d0ebcdf96.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1902.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1902.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7776.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7776.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1054.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1054.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4016
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6135QU.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6135QU.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2356
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98kp78.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98kp78.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHucg78.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHucg78.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4724
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y59pf68.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y59pf68.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4824
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4860
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:604
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:508
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:3928
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3352
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:5052
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:668
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:752
              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                1⤵
                • Executes dropped EXE
                PID:5036
              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                1⤵
                • Executes dropped EXE
                PID:1756

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              3
              T1112

              Disabling Security Tools

              2
              T1089

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y59pf68.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y59pf68.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1902.exe
                Filesize

                777KB

                MD5

                cdcdf02461452e0ca2da4498f84734a9

                SHA1

                72e81a8cb455b3a54ed8df25164fbe8526b06b58

                SHA256

                2e54b2f3ea3067d9600559e95a04b49c34a24bc5d117f06f8ed05b3d8929a43b

                SHA512

                0d1bf0a057ad6ada3126613e9f841a3e57edb154ff8337a1312ae3e7c53f32d086be0e9c3843d4c6266e8ad118974ae267dec456078ff7461a477c7658fd2917

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1902.exe
                Filesize

                777KB

                MD5

                cdcdf02461452e0ca2da4498f84734a9

                SHA1

                72e81a8cb455b3a54ed8df25164fbe8526b06b58

                SHA256

                2e54b2f3ea3067d9600559e95a04b49c34a24bc5d117f06f8ed05b3d8929a43b

                SHA512

                0d1bf0a057ad6ada3126613e9f841a3e57edb154ff8337a1312ae3e7c53f32d086be0e9c3843d4c6266e8ad118974ae267dec456078ff7461a477c7658fd2917

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHucg78.exe
                Filesize

                175KB

                MD5

                3389637c0d072121bf1b127629736d37

                SHA1

                300e915efdf2479bfd0d3699c0a6bc51260f9655

                SHA256

                2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                SHA512

                a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHucg78.exe
                Filesize

                175KB

                MD5

                3389637c0d072121bf1b127629736d37

                SHA1

                300e915efdf2479bfd0d3699c0a6bc51260f9655

                SHA256

                2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                SHA512

                a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
                Filesize

                635KB

                MD5

                36861e77d8b4d9afb7de95866a4beebb

                SHA1

                d8f9300805bae687625b5e279ab1fd51fb06a4cf

                SHA256

                20034e5d8168fd2623d940eb18a6f22d8d0dd6cf73b0a169219cda4320838f43

                SHA512

                65813c358dea5efd6bc39a7411f9dad938e1a08ab51c501661488db9d7cab518097364d873748b2fb86fae96942c8b11bbd2f1b3ca51badc881892c20526640b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
                Filesize

                635KB

                MD5

                36861e77d8b4d9afb7de95866a4beebb

                SHA1

                d8f9300805bae687625b5e279ab1fd51fb06a4cf

                SHA256

                20034e5d8168fd2623d940eb18a6f22d8d0dd6cf73b0a169219cda4320838f43

                SHA512

                65813c358dea5efd6bc39a7411f9dad938e1a08ab51c501661488db9d7cab518097364d873748b2fb86fae96942c8b11bbd2f1b3ca51badc881892c20526640b

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98kp78.exe
                Filesize

                287KB

                MD5

                ab9674b5543eb75e1a3010b02d045bb5

                SHA1

                db7a02bf88cd5df46ea2e908106e41c139c43dda

                SHA256

                2cc30a34bb1163dfa1eef6111b15361a1dbb7679f346b09a2bc686557754e417

                SHA512

                f69747ada31f3466bb17abdaa36494da3b20a55c034af5c2051b7a469ac40c9f38edffc7c39c704c4c1f8ab081bcd2023900b9a3aa4272588fc0701c3a83d219

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98kp78.exe
                Filesize

                287KB

                MD5

                ab9674b5543eb75e1a3010b02d045bb5

                SHA1

                db7a02bf88cd5df46ea2e908106e41c139c43dda

                SHA256

                2cc30a34bb1163dfa1eef6111b15361a1dbb7679f346b09a2bc686557754e417

                SHA512

                f69747ada31f3466bb17abdaa36494da3b20a55c034af5c2051b7a469ac40c9f38edffc7c39c704c4c1f8ab081bcd2023900b9a3aa4272588fc0701c3a83d219

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7776.exe
                Filesize

                314KB

                MD5

                924f62e2b0c11c4f681e250ffe2ebe02

                SHA1

                5acce821cdf0feff24181fee1524ce54c02f1742

                SHA256

                98b37b4e5bf13738f5b7a15d56e37269c993e039bd345d41c0785daed77c3273

                SHA512

                6113acc871ab9c988d49cb3a5d6454eb5145ebeea3b23db1738da742504fd87a5d3a5f862e69ad4eca6da792b4f93a1431ca5d3a2f38356b4ee65237cfbab432

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7776.exe
                Filesize

                314KB

                MD5

                924f62e2b0c11c4f681e250ffe2ebe02

                SHA1

                5acce821cdf0feff24181fee1524ce54c02f1742

                SHA256

                98b37b4e5bf13738f5b7a15d56e37269c993e039bd345d41c0785daed77c3273

                SHA512

                6113acc871ab9c988d49cb3a5d6454eb5145ebeea3b23db1738da742504fd87a5d3a5f862e69ad4eca6da792b4f93a1431ca5d3a2f38356b4ee65237cfbab432

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1054.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1054.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6135QU.exe
                Filesize

                229KB

                MD5

                31945d76ba734e8de778c0bf70b74a24

                SHA1

                250c20df69436203acb770132b413fa7bc552179

                SHA256

                f0daa39e30834694f6ac7e0448a13d6be254c71177970b84ab0171fc4ca4862c

                SHA512

                ca8c749e9c0380344af41df85d783bea65bcae89d29d63d1d5e37a7aa0b499dabfea94d38c852622ab9d0159785ea540d804bdfe9fc65523b83842ded88f915c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6135QU.exe
                Filesize

                229KB

                MD5

                31945d76ba734e8de778c0bf70b74a24

                SHA1

                250c20df69436203acb770132b413fa7bc552179

                SHA256

                f0daa39e30834694f6ac7e0448a13d6be254c71177970b84ab0171fc4ca4862c

                SHA512

                ca8c749e9c0380344af41df85d783bea65bcae89d29d63d1d5e37a7aa0b499dabfea94d38c852622ab9d0159785ea540d804bdfe9fc65523b83842ded88f915c

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                Filesize

                223B

                MD5

                94cbeec5d4343918fd0e48760e40539c

                SHA1

                a049266c5c1131f692f306c8710d7e72586ae79d

                SHA256

                48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                SHA512

                4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

              • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • memory/1068-1116-0x0000000006190000-0x0000000006222000-memory.dmp
                Filesize

                584KB

              • memory/1068-229-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-1124-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-1123-0x0000000006760000-0x0000000006C8C000-memory.dmp
                Filesize

                5.2MB

              • memory/1068-1122-0x0000000006590000-0x0000000006752000-memory.dmp
                Filesize

                1.8MB

              • memory/1068-1121-0x0000000006520000-0x0000000006570000-memory.dmp
                Filesize

                320KB

              • memory/1068-1120-0x00000000064A0000-0x0000000006516000-memory.dmp
                Filesize

                472KB

              • memory/1068-1119-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-1118-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-1117-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-1114-0x0000000005BF0000-0x0000000005C56000-memory.dmp
                Filesize

                408KB

              • memory/1068-1113-0x0000000005A70000-0x0000000005ABB000-memory.dmp
                Filesize

                300KB

              • memory/1068-1112-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-196-0x00000000008A0000-0x00000000008E6000-memory.dmp
                Filesize

                280KB

              • memory/1068-197-0x0000000002220000-0x0000000002264000-memory.dmp
                Filesize

                272KB

              • memory/1068-198-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-199-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-201-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-203-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-205-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-207-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-209-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-211-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-213-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-215-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-217-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-219-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-221-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-223-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-225-0x00000000004D0000-0x000000000051B000-memory.dmp
                Filesize

                300KB

              • memory/1068-227-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-226-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-230-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-232-0x0000000004C40000-0x0000000004C50000-memory.dmp
                Filesize

                64KB

              • memory/1068-233-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-1111-0x00000000026A0000-0x00000000026DE000-memory.dmp
                Filesize

                248KB

              • memory/1068-235-0x0000000002220000-0x000000000225E000-memory.dmp
                Filesize

                248KB

              • memory/1068-1108-0x0000000005250000-0x0000000005856000-memory.dmp
                Filesize

                6.0MB

              • memory/1068-1109-0x0000000005860000-0x000000000596A000-memory.dmp
                Filesize

                1.0MB

              • memory/1068-1110-0x0000000002460000-0x0000000002472000-memory.dmp
                Filesize

                72KB

              • memory/2356-167-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-171-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-177-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-191-0x0000000000400000-0x00000000004BA000-memory.dmp
                Filesize

                744KB

              • memory/2356-153-0x0000000000860000-0x000000000087A000-memory.dmp
                Filesize

                104KB

              • memory/2356-189-0x0000000004B90000-0x0000000004BA0000-memory.dmp
                Filesize

                64KB

              • memory/2356-188-0x0000000000400000-0x00000000004BA000-memory.dmp
                Filesize

                744KB

              • memory/2356-187-0x0000000004B90000-0x0000000004BA0000-memory.dmp
                Filesize

                64KB

              • memory/2356-186-0x0000000004B90000-0x0000000004BA0000-memory.dmp
                Filesize

                64KB

              • memory/2356-185-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-183-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-154-0x00000000004C0000-0x00000000004ED000-memory.dmp
                Filesize

                180KB

              • memory/2356-179-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-169-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-175-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-173-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-181-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-155-0x0000000004B90000-0x0000000004BA0000-memory.dmp
                Filesize

                64KB

              • memory/2356-165-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-163-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-161-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-159-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-158-0x00000000021D0000-0x00000000021E2000-memory.dmp
                Filesize

                72KB

              • memory/2356-157-0x00000000021D0000-0x00000000021E8000-memory.dmp
                Filesize

                96KB

              • memory/2356-156-0x0000000004BA0000-0x000000000509E000-memory.dmp
                Filesize

                5.0MB

              • memory/4016-147-0x0000000000FE0000-0x0000000000FEA000-memory.dmp
                Filesize

                40KB

              • memory/4724-1132-0x0000000005850000-0x0000000005860000-memory.dmp
                Filesize

                64KB

              • memory/4724-1131-0x0000000005670000-0x00000000056BB000-memory.dmp
                Filesize

                300KB

              • memory/4724-1130-0x0000000000C30000-0x0000000000C62000-memory.dmp
                Filesize

                200KB