Analysis

  • max time kernel
    112s
  • max time network
    109s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-03-2023 13:34

General

  • Target

    5ce9534e26d66344a28ed9229c67db1377218946d37b496b84967b9df5c42a65.exe

  • Size

    960KB

  • MD5

    83127e88d4b54670915f8dd9ca70d89c

  • SHA1

    b393235251a033a7e2a26a0dc292b6ea46c22162

  • SHA256

    5ce9534e26d66344a28ed9229c67db1377218946d37b496b84967b9df5c42a65

  • SHA512

    8552a706708e0896f56e24827a386729f6825e483d5df24edc1b990d3aa2b751cadeead0bda2bdac64ed9eeade7974fd6bb03a15372735472197c1a1a650599c

  • SSDEEP

    24576:hyJd1v6jZ47m9baZC3n51aNyv798l9/gSxqg1:UMiix+CX51aNyml9ou

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

C2

193.233.20.30:4125

Attributes
  • auth_value

    fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ce9534e26d66344a28ed9229c67db1377218946d37b496b84967b9df5c42a65.exe
    "C:\Users\Admin\AppData\Local\Temp\5ce9534e26d66344a28ed9229c67db1377218946d37b496b84967b9df5c42a65.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6520.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6520.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7032.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7032.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6779.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6779.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3844.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3844.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4312
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0529df.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0529df.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1000
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w11kz12.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w11kz12.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJvke16.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJvke16.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3720
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83MT09.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83MT09.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4696
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3368
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:5020
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:3936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4928
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:5068
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:4852
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:596
              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                1⤵
                • Executes dropped EXE
                PID:424

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              3
              T1112

              Disabling Security Tools

              2
              T1089

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83MT09.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83MT09.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6520.exe
                Filesize

                777KB

                MD5

                357184ce81dada065afb303e5d81c24a

                SHA1

                97f4445ad1de133c9f23725a2a6c6ad4a1931fa5

                SHA256

                50cebfcd30a5efa4b51de758804a971e78679eb0e1ff7f59d9f9d12cfdf7944d

                SHA512

                a2b8354a73edee3fecaedd304e76d775ce571b815fc43b9da69ffd3a813ec97ec68b8f7cd594dcd700c1f89000f4d2e7eb70524268a30b42b99f54f6016d377b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6520.exe
                Filesize

                777KB

                MD5

                357184ce81dada065afb303e5d81c24a

                SHA1

                97f4445ad1de133c9f23725a2a6c6ad4a1931fa5

                SHA256

                50cebfcd30a5efa4b51de758804a971e78679eb0e1ff7f59d9f9d12cfdf7944d

                SHA512

                a2b8354a73edee3fecaedd304e76d775ce571b815fc43b9da69ffd3a813ec97ec68b8f7cd594dcd700c1f89000f4d2e7eb70524268a30b42b99f54f6016d377b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJvke16.exe
                Filesize

                175KB

                MD5

                3389637c0d072121bf1b127629736d37

                SHA1

                300e915efdf2479bfd0d3699c0a6bc51260f9655

                SHA256

                2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                SHA512

                a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJvke16.exe
                Filesize

                175KB

                MD5

                3389637c0d072121bf1b127629736d37

                SHA1

                300e915efdf2479bfd0d3699c0a6bc51260f9655

                SHA256

                2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

                SHA512

                a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7032.exe
                Filesize

                634KB

                MD5

                37abbdc6556e7e1424bd8791ee2509ef

                SHA1

                e788f4ae313d4644ddb4b0177406bdd64a2d1d6c

                SHA256

                71aa390b82b1501bf0ebb70480741f1a5553ed28c6dcee479ad7046c45f4293a

                SHA512

                b7a774d4bb0004d7d6032c3e3a1a8c875e5f9e122e309c282c0ece754f7f30b319dba7a7b2ce787066ef4ce5d26d4f74c11b11b49404e183496d7cfa1c7bc4a5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7032.exe
                Filesize

                634KB

                MD5

                37abbdc6556e7e1424bd8791ee2509ef

                SHA1

                e788f4ae313d4644ddb4b0177406bdd64a2d1d6c

                SHA256

                71aa390b82b1501bf0ebb70480741f1a5553ed28c6dcee479ad7046c45f4293a

                SHA512

                b7a774d4bb0004d7d6032c3e3a1a8c875e5f9e122e309c282c0ece754f7f30b319dba7a7b2ce787066ef4ce5d26d4f74c11b11b49404e183496d7cfa1c7bc4a5

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w11kz12.exe
                Filesize

                287KB

                MD5

                3954fecd4000b90b0bd6cded67b3a03f

                SHA1

                41d80aa93300f3de256ecb3ff0c96eb993399a02

                SHA256

                f240be06132fa7085ca91c270ad4c96c5116514de2887b9962c64581538465b4

                SHA512

                96adf9237458e1fb4fea079b6fe0cb7392a4dc99941c5ae257dc3ec67ca76fc8bbe15faa4e750963a84efabe0b5ffac5a4e3a2e4188f5c8808662e0d0a18dfff

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w11kz12.exe
                Filesize

                287KB

                MD5

                3954fecd4000b90b0bd6cded67b3a03f

                SHA1

                41d80aa93300f3de256ecb3ff0c96eb993399a02

                SHA256

                f240be06132fa7085ca91c270ad4c96c5116514de2887b9962c64581538465b4

                SHA512

                96adf9237458e1fb4fea079b6fe0cb7392a4dc99941c5ae257dc3ec67ca76fc8bbe15faa4e750963a84efabe0b5ffac5a4e3a2e4188f5c8808662e0d0a18dfff

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6779.exe
                Filesize

                314KB

                MD5

                f3394e1c428e8c838a60f08b20df90b4

                SHA1

                138f41796b6fe84338a65297f4e1ebb0811a1af5

                SHA256

                fd1d3ed51d7ba9b4291ab3b0459b10ee09e12061da09a14b612842e860807ce1

                SHA512

                36f74fbc1609a41a6845e20f521562d039f6cea3f6fb718834dae5a045bbaab2f942bf39671839f7f488edff49cc4da41af2c3dd250a7013d8d2de43b057d746

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6779.exe
                Filesize

                314KB

                MD5

                f3394e1c428e8c838a60f08b20df90b4

                SHA1

                138f41796b6fe84338a65297f4e1ebb0811a1af5

                SHA256

                fd1d3ed51d7ba9b4291ab3b0459b10ee09e12061da09a14b612842e860807ce1

                SHA512

                36f74fbc1609a41a6845e20f521562d039f6cea3f6fb718834dae5a045bbaab2f942bf39671839f7f488edff49cc4da41af2c3dd250a7013d8d2de43b057d746

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3844.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3844.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0529df.exe
                Filesize

                229KB

                MD5

                bc24116cb88bd4bdecd2f53817db4e30

                SHA1

                e2e9e2d2ea7d06876d36686ea269c153a44d0b66

                SHA256

                d31765751efb8e2af6d9d4f725a7b83ed4c63c4eeea0baae1a6ba4193d9ba4ce

                SHA512

                a48a76b1568722a37910c2662683c9b7886df08e94ddd654b130a6c0529a5a45e5ea3a71a6de7d77a73adec3668d0a1ca867f44459e5aa9a57948771609c291b

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0529df.exe
                Filesize

                229KB

                MD5

                bc24116cb88bd4bdecd2f53817db4e30

                SHA1

                e2e9e2d2ea7d06876d36686ea269c153a44d0b66

                SHA256

                d31765751efb8e2af6d9d4f725a7b83ed4c63c4eeea0baae1a6ba4193d9ba4ce

                SHA512

                a48a76b1568722a37910c2662683c9b7886df08e94ddd654b130a6c0529a5a45e5ea3a71a6de7d77a73adec3668d0a1ca867f44459e5aa9a57948771609c291b

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                Filesize

                223B

                MD5

                94cbeec5d4343918fd0e48760e40539c

                SHA1

                a049266c5c1131f692f306c8710d7e72586ae79d

                SHA256

                48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                SHA512

                4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

              • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • memory/1000-171-0x0000000000830000-0x000000000085D000-memory.dmp
                Filesize

                180KB

              • memory/1000-172-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-169-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-173-0x0000000004B40000-0x0000000004B50000-memory.dmp
                Filesize

                64KB

              • memory/1000-176-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-175-0x0000000004B40000-0x0000000004B50000-memory.dmp
                Filesize

                64KB

              • memory/1000-178-0x0000000004B40000-0x0000000004B50000-memory.dmp
                Filesize

                64KB

              • memory/1000-179-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-181-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-183-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-185-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-187-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-188-0x0000000000400000-0x00000000004BA000-memory.dmp
                Filesize

                744KB

              • memory/1000-190-0x0000000000400000-0x00000000004BA000-memory.dmp
                Filesize

                744KB

              • memory/1000-167-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-165-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-163-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-161-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-159-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-157-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-156-0x0000000004B20000-0x0000000004B32000-memory.dmp
                Filesize

                72KB

              • memory/1000-155-0x0000000004B20000-0x0000000004B38000-memory.dmp
                Filesize

                96KB

              • memory/1000-154-0x0000000004B50000-0x000000000504E000-memory.dmp
                Filesize

                5.0MB

              • memory/1000-153-0x0000000004AA0000-0x0000000004ABA000-memory.dmp
                Filesize

                104KB

              • memory/2240-206-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-1115-0x0000000006050000-0x00000000060E2000-memory.dmp
                Filesize

                584KB

              • memory/2240-212-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-214-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-216-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-218-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-220-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-222-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-224-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-226-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-228-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-230-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-232-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-234-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-1107-0x0000000005160000-0x0000000005766000-memory.dmp
                Filesize

                6.0MB

              • memory/2240-1108-0x0000000005770000-0x000000000587A000-memory.dmp
                Filesize

                1.0MB

              • memory/2240-1109-0x0000000004B80000-0x0000000004B92000-memory.dmp
                Filesize

                72KB

              • memory/2240-1110-0x0000000004BA0000-0x0000000004BDE000-memory.dmp
                Filesize

                248KB

              • memory/2240-1111-0x0000000004BF0000-0x0000000004C3B000-memory.dmp
                Filesize

                300KB

              • memory/2240-1112-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-1113-0x0000000005AB0000-0x0000000005B16000-memory.dmp
                Filesize

                408KB

              • memory/2240-210-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-1116-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-1117-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-1118-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-1119-0x0000000006360000-0x00000000063D6000-memory.dmp
                Filesize

                472KB

              • memory/2240-1120-0x00000000063E0000-0x0000000006430000-memory.dmp
                Filesize

                320KB

              • memory/2240-1121-0x0000000006450000-0x0000000006612000-memory.dmp
                Filesize

                1.8MB

              • memory/2240-1122-0x0000000006620000-0x0000000006B4C000-memory.dmp
                Filesize

                5.2MB

              • memory/2240-195-0x0000000002490000-0x00000000024D6000-memory.dmp
                Filesize

                280KB

              • memory/2240-197-0x00000000005F0000-0x000000000063B000-memory.dmp
                Filesize

                300KB

              • memory/2240-196-0x0000000004A80000-0x0000000004AC4000-memory.dmp
                Filesize

                272KB

              • memory/2240-199-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-208-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-202-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-204-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-198-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/2240-201-0x0000000004A80000-0x0000000004ABE000-memory.dmp
                Filesize

                248KB

              • memory/2240-200-0x0000000004C50000-0x0000000004C60000-memory.dmp
                Filesize

                64KB

              • memory/3720-1131-0x00000000059E0000-0x00000000059F0000-memory.dmp
                Filesize

                64KB

              • memory/3720-1130-0x00000000059E0000-0x00000000059F0000-memory.dmp
                Filesize

                64KB

              • memory/3720-1129-0x0000000005740000-0x000000000578B000-memory.dmp
                Filesize

                300KB

              • memory/3720-1128-0x0000000000E40000-0x0000000000E72000-memory.dmp
                Filesize

                200KB

              • memory/4312-147-0x0000000000F90000-0x0000000000F9A000-memory.dmp
                Filesize

                40KB