Analysis

  • max time kernel
    131s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-03-2023 21:18

General

  • Target

    f92fde30deb4bfb0054a5f368001a578a8962690e437477ea4ea924b934daa9b.exe

  • Size

    1021KB

  • MD5

    8bed88ff6065569ce96c61ea1e1fa8d6

  • SHA1

    863a3feb966773078a8151675bc06fd8e5593492

  • SHA256

    f92fde30deb4bfb0054a5f368001a578a8962690e437477ea4ea924b934daa9b

  • SHA512

    780798465bbc500752bf4fdf91fcd4191c3514ee364b75e539c5a6fc9b796b1e14bc25f89238beb9aa4fa43d348bdb1c1eece6e447f7c33459646e961978eb77

  • SSDEEP

    24576:Dy296USjYPoVxxaeIss5WT9Dh5njaYMEq803f7Vzpdm:W2AUGaeIfWTdhxmYY73f7V

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

C2

193.233.20.31:4125

Attributes
  • auth_value

    4cf836e062bcdc2a4fdbf410f5747ec7

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f92fde30deb4bfb0054a5f368001a578a8962690e437477ea4ea924b934daa9b.exe
    "C:\Users\Admin\AppData\Local\Temp\f92fde30deb4bfb0054a5f368001a578a8962690e437477ea4ea924b934daa9b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7285.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7285.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2021.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2021.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9864.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9864.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5052.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5052.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4916
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3347YH.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3347YH.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3112
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w04Zz94.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w04Zz94.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfqcC05.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfqcC05.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3696
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52AT25.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52AT25.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4352
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3092
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4328
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:4336
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:4940
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4956
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:712
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:3852
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:608
              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                1⤵
                • Executes dropped EXE
                PID:4824
              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                1⤵
                • Executes dropped EXE
                PID:656

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              3
              T1112

              Disabling Security Tools

              2
              T1089

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52AT25.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y52AT25.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7285.exe
                Filesize

                837KB

                MD5

                4813a3b5d9c15f9a641da29735850671

                SHA1

                5fb132aafc171bdf4842f1d1001199a1c73f6cdb

                SHA256

                de9b1d783cfe75c11ba4b31b7813d57ba96be826b2d573a5aa51e01cbe2e41c2

                SHA512

                16b3c5ab3031396d925b6c4c1303c9bb9dac549f2608a290ac1ab34f5bec20b0d087aacd135f5ad8b6d71345556b0de75497d98da05dc431d45018d2baaf5f6e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7285.exe
                Filesize

                837KB

                MD5

                4813a3b5d9c15f9a641da29735850671

                SHA1

                5fb132aafc171bdf4842f1d1001199a1c73f6cdb

                SHA256

                de9b1d783cfe75c11ba4b31b7813d57ba96be826b2d573a5aa51e01cbe2e41c2

                SHA512

                16b3c5ab3031396d925b6c4c1303c9bb9dac549f2608a290ac1ab34f5bec20b0d087aacd135f5ad8b6d71345556b0de75497d98da05dc431d45018d2baaf5f6e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfqcC05.exe
                Filesize

                175KB

                MD5

                50809fe16d7c482c1f4a2ea19fdcbc0a

                SHA1

                11b6f69c06a724da15183b16039c5cbc86016158

                SHA256

                09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

                SHA512

                c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xfqcC05.exe
                Filesize

                175KB

                MD5

                50809fe16d7c482c1f4a2ea19fdcbc0a

                SHA1

                11b6f69c06a724da15183b16039c5cbc86016158

                SHA256

                09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

                SHA512

                c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2021.exe
                Filesize

                695KB

                MD5

                108cd346bb79f3cbf4ae361e771bc06e

                SHA1

                e39699bbff6632c84b8f5591f8a5542e6fe46a47

                SHA256

                8ea933494e02a0907fb5a7557a46031407d665ae8f0d8761cf7fa245539949ea

                SHA512

                2b363667d77e3d5a5d78dceb9a25efdd44569e92364226a7e70cab3c0791808c1c0cec3a4c46619b37132a85cd7b6c19f942046bfbffe5a743c2094d4c3326e9

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2021.exe
                Filesize

                695KB

                MD5

                108cd346bb79f3cbf4ae361e771bc06e

                SHA1

                e39699bbff6632c84b8f5591f8a5542e6fe46a47

                SHA256

                8ea933494e02a0907fb5a7557a46031407d665ae8f0d8761cf7fa245539949ea

                SHA512

                2b363667d77e3d5a5d78dceb9a25efdd44569e92364226a7e70cab3c0791808c1c0cec3a4c46619b37132a85cd7b6c19f942046bfbffe5a743c2094d4c3326e9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w04Zz94.exe
                Filesize

                349KB

                MD5

                a38e25768d82a3eba14ded9ec3240eb6

                SHA1

                ec014a12ab451badc325e7b7c6cefda4261e5a50

                SHA256

                dc8ff49859d1efa75a2ed78c14941fc771ee0b685bf7d08656b8bd33341bfae6

                SHA512

                822ec704038ee6ae97c41a394fa6fd40b21a841341893d7ca95aae1cc69931db0e3259f3d50126c8118113903cd567c812d7d70725780d5289d1b3fce15ba518

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w04Zz94.exe
                Filesize

                349KB

                MD5

                a38e25768d82a3eba14ded9ec3240eb6

                SHA1

                ec014a12ab451badc325e7b7c6cefda4261e5a50

                SHA256

                dc8ff49859d1efa75a2ed78c14941fc771ee0b685bf7d08656b8bd33341bfae6

                SHA512

                822ec704038ee6ae97c41a394fa6fd40b21a841341893d7ca95aae1cc69931db0e3259f3d50126c8118113903cd567c812d7d70725780d5289d1b3fce15ba518

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9864.exe
                Filesize

                344KB

                MD5

                23b3b011b9139759257b1ca311aff085

                SHA1

                1b08ce0231d73d41595efc0bf7a11449715b9fd6

                SHA256

                e8efe76de494f22f0ac731e9abbb39093204e3fea44c3a5c79d8868875f8ade0

                SHA512

                a7f3f7114563be62e03fd8ad2ad3d7dc898e13f5751015ef7668a6e6523995b78a0c4825014d6e7026e0924516b2f2ee7e50c76abd2dd5136b25d76c216d4683

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9864.exe
                Filesize

                344KB

                MD5

                23b3b011b9139759257b1ca311aff085

                SHA1

                1b08ce0231d73d41595efc0bf7a11449715b9fd6

                SHA256

                e8efe76de494f22f0ac731e9abbb39093204e3fea44c3a5c79d8868875f8ade0

                SHA512

                a7f3f7114563be62e03fd8ad2ad3d7dc898e13f5751015ef7668a6e6523995b78a0c4825014d6e7026e0924516b2f2ee7e50c76abd2dd5136b25d76c216d4683

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5052.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5052.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3347YH.exe
                Filesize

                291KB

                MD5

                3f5344816f6a425c038c97559a325dfb

                SHA1

                a4f4b733f685234c3c3929ac87ca267deb6468d4

                SHA256

                38ec3e25efeb3c6b688766ad4f48a28a0b2ea35d6ca1e8ac4c8e3053bc0e6662

                SHA512

                0c3297fb5eac1a7d35519bce98c3fbad0a30dbad6591eea128b2dfd8161caf8328e1ac87f94458c90e78db1aa6a5a2fb06cd83df2a5df219753d815614fe9fa2

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3347YH.exe
                Filesize

                291KB

                MD5

                3f5344816f6a425c038c97559a325dfb

                SHA1

                a4f4b733f685234c3c3929ac87ca267deb6468d4

                SHA256

                38ec3e25efeb3c6b688766ad4f48a28a0b2ea35d6ca1e8ac4c8e3053bc0e6662

                SHA512

                0c3297fb5eac1a7d35519bce98c3fbad0a30dbad6591eea128b2dfd8161caf8328e1ac87f94458c90e78db1aa6a5a2fb06cd83df2a5df219753d815614fe9fa2

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                Filesize

                235KB

                MD5

                5086db99de54fca268169a1c6cf26122

                SHA1

                003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                SHA256

                42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                SHA512

                90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                Filesize

                223B

                MD5

                94cbeec5d4343918fd0e48760e40539c

                SHA1

                a049266c5c1131f692f306c8710d7e72586ae79d

                SHA256

                48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                SHA512

                4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

              • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                Filesize

                89KB

                MD5

                16cf28ebb6d37dbaba93f18320c6086e

                SHA1

                eae7d4b7a9636329065877aabe8d4f721a26ab25

                SHA256

                c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                SHA512

                f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

              • memory/2804-1113-0x00000000065D0000-0x0000000006646000-memory.dmp
                Filesize

                472KB

              • memory/2804-271-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1120-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1119-0x00000000069F0000-0x0000000006F1C000-memory.dmp
                Filesize

                5.2MB

              • memory/2804-1118-0x0000000006820000-0x00000000069E2000-memory.dmp
                Filesize

                1.8MB

              • memory/2804-1117-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1116-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1115-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1114-0x0000000006650000-0x00000000066A0000-memory.dmp
                Filesize

                320KB

              • memory/2804-1111-0x0000000006530000-0x00000000065C2000-memory.dmp
                Filesize

                584KB

              • memory/2804-1110-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                Filesize

                408KB

              • memory/2804-1109-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-192-0x0000000002590000-0x00000000025D6000-memory.dmp
                Filesize

                280KB

              • memory/2804-193-0x00000000051B0000-0x00000000051F4000-memory.dmp
                Filesize

                272KB

              • memory/2804-195-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-197-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-194-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-199-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-201-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-203-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-205-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-207-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-209-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-211-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-213-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-215-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-217-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-219-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-221-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-223-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-225-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-227-0x00000000051B0000-0x00000000051EE000-memory.dmp
                Filesize

                248KB

              • memory/2804-270-0x00000000007F0000-0x000000000083B000-memory.dmp
                Filesize

                300KB

              • memory/2804-1108-0x0000000005CB0000-0x0000000005CFB000-memory.dmp
                Filesize

                300KB

              • memory/2804-274-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-275-0x00000000023A0000-0x00000000023B0000-memory.dmp
                Filesize

                64KB

              • memory/2804-1104-0x0000000005370000-0x0000000005976000-memory.dmp
                Filesize

                6.0MB

              • memory/2804-1105-0x0000000005A00000-0x0000000005B0A000-memory.dmp
                Filesize

                1.0MB

              • memory/2804-1106-0x0000000005B40000-0x0000000005B52000-memory.dmp
                Filesize

                72KB

              • memory/2804-1107-0x0000000005B60000-0x0000000005B9E000-memory.dmp
                Filesize

                248KB

              • memory/3112-155-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-151-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
                Filesize

                64KB

              • memory/3112-172-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-187-0x0000000000400000-0x000000000070C000-memory.dmp
                Filesize

                3.0MB

              • memory/3112-168-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-185-0x0000000000400000-0x000000000070C000-memory.dmp
                Filesize

                3.0MB

              • memory/3112-184-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
                Filesize

                64KB

              • memory/3112-183-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
                Filesize

                64KB

              • memory/3112-182-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-180-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-178-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-176-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-166-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-170-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-160-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-150-0x00000000001D0000-0x00000000001FD000-memory.dmp
                Filesize

                180KB

              • memory/3112-164-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-162-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-152-0x0000000000940000-0x000000000095A000-memory.dmp
                Filesize

                104KB

              • memory/3112-158-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-156-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-174-0x0000000002450000-0x0000000002462000-memory.dmp
                Filesize

                72KB

              • memory/3112-154-0x0000000002450000-0x0000000002468000-memory.dmp
                Filesize

                96KB

              • memory/3112-153-0x0000000004DF0000-0x00000000052EE000-memory.dmp
                Filesize

                5.0MB

              • memory/3696-1126-0x00000000006F0000-0x0000000000722000-memory.dmp
                Filesize

                200KB

              • memory/3696-1128-0x0000000005130000-0x000000000517B000-memory.dmp
                Filesize

                300KB

              • memory/3696-1127-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
                Filesize

                64KB

              • memory/4916-144-0x0000000000A50000-0x0000000000A5A000-memory.dmp
                Filesize

                40KB