Analysis

  • max time kernel
    133s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-03-2023 18:20

General

  • Target

    5a0278c7c88d093b6ec544802ef01d0d86a51190fd0976450b6d160eaf8c537f.exe

  • Size

    1.3MB

  • MD5

    b7bab3c78ee36eb797a1c0c4036ef1f6

  • SHA1

    f90c247069993ea1d80740738dc461729243bdfb

  • SHA256

    5a0278c7c88d093b6ec544802ef01d0d86a51190fd0976450b6d160eaf8c537f

  • SHA512

    c2a5064b86f5d497ff2f9bf1a5cfab3be83ba5f410de60de82b0a260a5870659f99a2c588165d4ef9d80e5fae2eaea3cd871bb690018f8f041973a283a18ba7a

  • SSDEEP

    24576:XF1nHyFZau43z3+pRsoJXSUMHI1ogR6ghfPfu7z5f3:XY43b+L1gUMHIugMYf2

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

relon

C2

193.233.20.30:4125

Attributes
  • auth_value

    17da69809725577b595e217ba006b869

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a0278c7c88d093b6ec544802ef01d0d86a51190fd0976450b6d160eaf8c537f.exe
    "C:\Users\Admin\AppData\Local\Temp\5a0278c7c88d093b6ec544802ef01d0d86a51190fd0976450b6d160eaf8c537f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7985.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7985.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6664.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6664.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0423.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0423.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2500
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9176.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9176.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4444
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con1402.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con1402.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4172
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBg57s51.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBg57s51.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en733356.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en733356.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4152
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge233872.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge233872.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3460
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5060
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5048
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:5016
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4956
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4932
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4088
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4972
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:4964
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:596
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:652

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              3
              T1112

              Disabling Security Tools

              2
              T1089

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge233872.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge233872.exe
                Filesize

                226KB

                MD5

                8627ebe3777cc777ed2a14b907162224

                SHA1

                06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                SHA256

                319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                SHA512

                9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7985.exe
                Filesize

                907KB

                MD5

                e4b7ec6edf14689783dff6287442a547

                SHA1

                882d0fce692bdbb4f74141ce744952ba277a7a0b

                SHA256

                e8994c49735d3f713801e31ef633b5a697bb819d1e0ea4e351e509f43b8b1e3d

                SHA512

                380786450bf7a68ab48967766248ab48366749fd8dc7f9567b745dcbcac50d73bd79be13d975663f701ef9e162b45650e2996ac94256428660a95f33999b2d28

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino7985.exe
                Filesize

                907KB

                MD5

                e4b7ec6edf14689783dff6287442a547

                SHA1

                882d0fce692bdbb4f74141ce744952ba277a7a0b

                SHA256

                e8994c49735d3f713801e31ef633b5a697bb819d1e0ea4e351e509f43b8b1e3d

                SHA512

                380786450bf7a68ab48967766248ab48366749fd8dc7f9567b745dcbcac50d73bd79be13d975663f701ef9e162b45650e2996ac94256428660a95f33999b2d28

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en733356.exe
                Filesize

                175KB

                MD5

                6fbff2d7c9ba7f0a71f02a5c70df9dfc

                SHA1

                003da0075734cd2d7f201c5b0e4779b8e1f33621

                SHA256

                cb56407367a42f61993842b66bcd24993a30c87116313c26d6af9e37bbb1b6b3

                SHA512

                25842b9df4767b16096f2bfcedc9d368a9696e6c6d9c7b2c75987769a5b338ae04b23b1e89f18eef2244e84f04e4acf6af56643a97abfe5b605f66cba0bac27f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en733356.exe
                Filesize

                175KB

                MD5

                6fbff2d7c9ba7f0a71f02a5c70df9dfc

                SHA1

                003da0075734cd2d7f201c5b0e4779b8e1f33621

                SHA256

                cb56407367a42f61993842b66bcd24993a30c87116313c26d6af9e37bbb1b6b3

                SHA512

                25842b9df4767b16096f2bfcedc9d368a9696e6c6d9c7b2c75987769a5b338ae04b23b1e89f18eef2244e84f04e4acf6af56643a97abfe5b605f66cba0bac27f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6664.exe
                Filesize

                765KB

                MD5

                4dcf015496920851071f99cd67e1053c

                SHA1

                ebf2067e85543a4ab7a2df7e74a4ba234a8d75b1

                SHA256

                7e724dcb17c49388dacad4e88e27cbd4042eb677387d13879ace46d1469446c5

                SHA512

                acfa3dc769e7384a3f5c869855e4c92c8bd0ad6add8a0a118d1b8bc88a70b9018a40eafa2ef706577c64fa19ea5c25aae196bceac50abc78cbb89f0e453af8cb

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino6664.exe
                Filesize

                765KB

                MD5

                4dcf015496920851071f99cd67e1053c

                SHA1

                ebf2067e85543a4ab7a2df7e74a4ba234a8d75b1

                SHA256

                7e724dcb17c49388dacad4e88e27cbd4042eb677387d13879ace46d1469446c5

                SHA512

                acfa3dc769e7384a3f5c869855e4c92c8bd0ad6add8a0a118d1b8bc88a70b9018a40eafa2ef706577c64fa19ea5c25aae196bceac50abc78cbb89f0e453af8cb

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBg57s51.exe
                Filesize

                456KB

                MD5

                4172a79e2310253855602b96e96c252b

                SHA1

                94ce8faba6e41f22220b69f847d2b73e35ae32d5

                SHA256

                041131fc660785983b9403578f7618419e92d171db1cb4ff1608624d7e410957

                SHA512

                23c2f69b1d868afba1f4dbb169f37a480c812c8e522bdc03265327be0d222a9c1a6168dc858959ce00a1ddc392ecca35f0dc721c1fd59205b0f57b25ff1d39a6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dBg57s51.exe
                Filesize

                456KB

                MD5

                4172a79e2310253855602b96e96c252b

                SHA1

                94ce8faba6e41f22220b69f847d2b73e35ae32d5

                SHA256

                041131fc660785983b9403578f7618419e92d171db1cb4ff1608624d7e410957

                SHA512

                23c2f69b1d868afba1f4dbb169f37a480c812c8e522bdc03265327be0d222a9c1a6168dc858959ce00a1ddc392ecca35f0dc721c1fd59205b0f57b25ff1d39a6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0423.exe
                Filesize

                378KB

                MD5

                fb7a39c258eee32f6f29b93291f7a0a1

                SHA1

                1c03f084ddf03369ae6ce27b336d42adc5e9993a

                SHA256

                2f28e8d79c00f08631f53fc79cbbc954463b42959ac2aa93680a5a7ff15f2c64

                SHA512

                f3289e508a2fd8c0ec6622800f03db869a494d22cdf817f6c16be484a5303499751d34717300337f1a4566da0a2ac99c26fe6de82b64d8fda66d31d65064e8b3

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0423.exe
                Filesize

                378KB

                MD5

                fb7a39c258eee32f6f29b93291f7a0a1

                SHA1

                1c03f084ddf03369ae6ce27b336d42adc5e9993a

                SHA256

                2f28e8d79c00f08631f53fc79cbbc954463b42959ac2aa93680a5a7ff15f2c64

                SHA512

                f3289e508a2fd8c0ec6622800f03db869a494d22cdf817f6c16be484a5303499751d34717300337f1a4566da0a2ac99c26fe6de82b64d8fda66d31d65064e8b3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9176.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9176.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con1402.exe
                Filesize

                398KB

                MD5

                360bee6bf65e2e29df0127bc2bb3e080

                SHA1

                7c4cf3a35b9d2f791c0e97e68a9a614e0a60e252

                SHA256

                0ca7dd45596da456f3dc06f781d08a89e122fbb2f736b4e25cece980e683a94b

                SHA512

                76871012ae247eaabc068aa74376d8b0592ed4cbe1c2220272319ebf365c6fe8f62c8c71a13449dd31567c6d58f4ff143e0b25dc2156306093fb12509c621d98

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con1402.exe
                Filesize

                398KB

                MD5

                360bee6bf65e2e29df0127bc2bb3e080

                SHA1

                7c4cf3a35b9d2f791c0e97e68a9a614e0a60e252

                SHA256

                0ca7dd45596da456f3dc06f781d08a89e122fbb2f736b4e25cece980e683a94b

                SHA512

                76871012ae247eaabc068aa74376d8b0592ed4cbe1c2220272319ebf365c6fe8f62c8c71a13449dd31567c6d58f4ff143e0b25dc2156306093fb12509c621d98

              • memory/1700-149-0x0000000000400000-0x0000000000811000-memory.dmp
                Filesize

                4.1MB

              • memory/1700-126-0x0000000004790000-0x00000000048A2000-memory.dmp
                Filesize

                1.1MB

              • memory/4152-1135-0x0000000005420000-0x0000000005430000-memory.dmp
                Filesize

                64KB

              • memory/4152-1134-0x0000000005430000-0x000000000547B000-memory.dmp
                Filesize

                300KB

              • memory/4152-1133-0x0000000000AE0000-0x0000000000B12000-memory.dmp
                Filesize

                200KB

              • memory/4172-172-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-174-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-180-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-182-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-184-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-186-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-187-0x0000000004F80000-0x0000000004F90000-memory.dmp
                Filesize

                64KB

              • memory/4172-188-0x0000000004F80000-0x0000000004F90000-memory.dmp
                Filesize

                64KB

              • memory/4172-189-0x0000000004F80000-0x0000000004F90000-memory.dmp
                Filesize

                64KB

              • memory/4172-191-0x0000000000400000-0x0000000000726000-memory.dmp
                Filesize

                3.1MB

              • memory/4172-176-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-193-0x0000000000400000-0x0000000000726000-memory.dmp
                Filesize

                3.1MB

              • memory/4172-155-0x00000000001D0000-0x00000000001FD000-memory.dmp
                Filesize

                180KB

              • memory/4172-178-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-170-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-168-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-166-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-164-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-162-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-160-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-159-0x00000000025E0000-0x00000000025F2000-memory.dmp
                Filesize

                72KB

              • memory/4172-158-0x00000000025E0000-0x00000000025F8000-memory.dmp
                Filesize

                96KB

              • memory/4172-157-0x0000000004F90000-0x000000000548E000-memory.dmp
                Filesize

                5.0MB

              • memory/4172-156-0x0000000002430000-0x000000000244A000-memory.dmp
                Filesize

                104KB

              • memory/4444-148-0x00000000001F0000-0x00000000001FA000-memory.dmp
                Filesize

                40KB

              • memory/4752-205-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-221-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-223-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-225-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-227-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-229-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-231-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-360-0x0000000000740000-0x000000000078B000-memory.dmp
                Filesize

                300KB

              • memory/4752-362-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-363-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-365-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1110-0x0000000005870000-0x0000000005E76000-memory.dmp
                Filesize

                6.0MB

              • memory/4752-1111-0x00000000052D0000-0x00000000053DA000-memory.dmp
                Filesize

                1.0MB

              • memory/4752-1112-0x0000000005410000-0x0000000005422000-memory.dmp
                Filesize

                72KB

              • memory/4752-1113-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1114-0x0000000005430000-0x000000000546E000-memory.dmp
                Filesize

                248KB

              • memory/4752-1115-0x0000000005580000-0x00000000055CB000-memory.dmp
                Filesize

                300KB

              • memory/4752-1117-0x0000000005710000-0x0000000005776000-memory.dmp
                Filesize

                408KB

              • memory/4752-1118-0x0000000006400000-0x0000000006492000-memory.dmp
                Filesize

                584KB

              • memory/4752-1119-0x00000000064E0000-0x00000000066A2000-memory.dmp
                Filesize

                1.8MB

              • memory/4752-1120-0x00000000066B0000-0x0000000006BDC000-memory.dmp
                Filesize

                5.2MB

              • memory/4752-1122-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1123-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1124-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1125-0x0000000004D10000-0x0000000004D20000-memory.dmp
                Filesize

                64KB

              • memory/4752-1126-0x0000000007070000-0x00000000070E6000-memory.dmp
                Filesize

                472KB

              • memory/4752-1127-0x0000000007100000-0x0000000007150000-memory.dmp
                Filesize

                320KB

              • memory/4752-219-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-217-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-215-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-213-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-211-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-209-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-207-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-203-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-201-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-200-0x0000000005220000-0x000000000525E000-memory.dmp
                Filesize

                248KB

              • memory/4752-199-0x0000000005220000-0x0000000005264000-memory.dmp
                Filesize

                272KB

              • memory/4752-198-0x00000000026E0000-0x0000000002726000-memory.dmp
                Filesize

                280KB