Analysis

  • max time kernel
    135s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 08:33

General

  • Target

    a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe

  • Size

    1011KB

  • MD5

    560e9a6f0e847305865b54f43c367e82

  • SHA1

    aec7a41211f7d42a686949ed2ed3a7e84947dcb3

  • SHA256

    a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c

  • SHA512

    0eca0ffc79b56c704ce0cb445bd454e384f1c3bbc0ac375eb813e40aa280b8fb6f3253e31869f64798f59a1fd65407c177097c0d5c6f7a016359994106673f7b

  • SSDEEP

    24576:dyOhG5f5crFNzYZOmyzMhoHsA8bwLNaEcvyiLcJ:4Ogf5cr8YnMhoMA0+NfWyiI

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

roxi

C2

193.233.20.31:4125

Attributes
  • auth_value

    9d8be78c896acc3cf8b8a6637a221376

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe
    "C:\Users\Admin\AppData\Local\Temp\a91143ca5a0b30c7c3aa035342bc59f3175d60b8d6007cc2756b661aa5e7739c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2212
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:372
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2108
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1076
              6⤵
              • Program crash
              PID:460
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4388
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1356
            5⤵
            • Program crash
            PID:1244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3596
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4872
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:5028
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3260
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:2204
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3344
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2108 -ip 2108
                1⤵
                  PID:4004
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4388 -ip 4388
                  1⤵
                    PID:4644
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:992
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3148

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge304682.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe

                    Filesize

                    828KB

                    MD5

                    41046bd23cc07e4751f2a75caa82a7f3

                    SHA1

                    d791f4d22aec2c0ccdc1faa012b314b8a5537a24

                    SHA256

                    ec7afc5ec7a6e13a63ed8839ad360420ea9550a75d909cad122c1a41e89f5545

                    SHA512

                    7de6330a730adf31aa8c449537d6b8d87f7efa7dd795b49c4b10554724ff9810e7a32d83cebcc9f2ba40ef7aa323c2984d54de159167b453c941a1c882fdf1c4

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino6914.exe

                    Filesize

                    828KB

                    MD5

                    41046bd23cc07e4751f2a75caa82a7f3

                    SHA1

                    d791f4d22aec2c0ccdc1faa012b314b8a5537a24

                    SHA256

                    ec7afc5ec7a6e13a63ed8839ad360420ea9550a75d909cad122c1a41e89f5545

                    SHA512

                    7de6330a730adf31aa8c449537d6b8d87f7efa7dd795b49c4b10554724ff9810e7a32d83cebcc9f2ba40ef7aa323c2984d54de159167b453c941a1c882fdf1c4

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe

                    Filesize

                    175KB

                    MD5

                    30bf410db5f6c05f0dee763f5a0fe5b7

                    SHA1

                    1f4187925e1af163603a12bb116e869f8f137455

                    SHA256

                    d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

                    SHA512

                    5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en176679.exe

                    Filesize

                    175KB

                    MD5

                    30bf410db5f6c05f0dee763f5a0fe5b7

                    SHA1

                    1f4187925e1af163603a12bb116e869f8f137455

                    SHA256

                    d1f5b4b1ee5703bf94f9c1bee60e91463db4c28beeb7510ea7ceba9fab4b1178

                    SHA512

                    5edc65f5e5278af8731174dbdc70a8a5efddf1ee756df1accead04f1490b90eb05b25a1eaaba49d1f274aeff4de0bc02ec79f220ea99bc5383e2890ed4f211de

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe

                    Filesize

                    686KB

                    MD5

                    2dd14057aec1eae0e193c6fbf5199b2a

                    SHA1

                    82c95d596a6eee5c2c4a9f5a5acf0f807b3cbc4b

                    SHA256

                    dbcc8198374d0b076384814cc22b1c5a8d1d823e65c57d994811e32376d91866

                    SHA512

                    f560137c6717b77b2e725dcbcb3280078c515cb2d1d24d05959dcc2a0453ecca09a51581807744402327786b2ba1a307f5be59ded0f891be80dd7d4b012f5b80

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino7018.exe

                    Filesize

                    686KB

                    MD5

                    2dd14057aec1eae0e193c6fbf5199b2a

                    SHA1

                    82c95d596a6eee5c2c4a9f5a5acf0f807b3cbc4b

                    SHA256

                    dbcc8198374d0b076384814cc22b1c5a8d1d823e65c57d994811e32376d91866

                    SHA512

                    f560137c6717b77b2e725dcbcb3280078c515cb2d1d24d05959dcc2a0453ecca09a51581807744402327786b2ba1a307f5be59ded0f891be80dd7d4b012f5b80

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe

                    Filesize

                    355KB

                    MD5

                    68810a912a947f1e81f6dd753a8e735a

                    SHA1

                    33114fe1ded2120993df0ed74d93605ec449c772

                    SHA256

                    b0bfe519bd9d7456867665462e8ebfa9ff93da0bfc2651804a84d6f19f99b37e

                    SHA512

                    0f6027f0d210a807de2222295c78a4a3b92386904e8b1c167ccd450a02c74eff163684a156666e91be4e9384cfe64d3749b9018f289aa9049412b9083b5fcff8

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ddN73s20.exe

                    Filesize

                    355KB

                    MD5

                    68810a912a947f1e81f6dd753a8e735a

                    SHA1

                    33114fe1ded2120993df0ed74d93605ec449c772

                    SHA256

                    b0bfe519bd9d7456867665462e8ebfa9ff93da0bfc2651804a84d6f19f99b37e

                    SHA512

                    0f6027f0d210a807de2222295c78a4a3b92386904e8b1c167ccd450a02c74eff163684a156666e91be4e9384cfe64d3749b9018f289aa9049412b9083b5fcff8

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe

                    Filesize

                    340KB

                    MD5

                    1eecfe60fe6687954a7b81d72a1b2cff

                    SHA1

                    5c47ed2f67a141bfd89c4061dfa690ebd53f0da9

                    SHA256

                    db8dd9b7398a889bdfc2312830958ce2ddef346175da6c7f0bde3e301a6a739e

                    SHA512

                    2141557254663430561929efa53511de839bed01e595ddc02b30fd0cad190e6d02985d8fa78313966e5cba985b365999e6b2e18eea06db5448ce12c0d4065dd2

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino0573.exe

                    Filesize

                    340KB

                    MD5

                    1eecfe60fe6687954a7b81d72a1b2cff

                    SHA1

                    5c47ed2f67a141bfd89c4061dfa690ebd53f0da9

                    SHA256

                    db8dd9b7398a889bdfc2312830958ce2ddef346175da6c7f0bde3e301a6a739e

                    SHA512

                    2141557254663430561929efa53511de839bed01e595ddc02b30fd0cad190e6d02985d8fa78313966e5cba985b365999e6b2e18eea06db5448ce12c0d4065dd2

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus7347.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe

                    Filesize

                    298KB

                    MD5

                    09dafa76e70e412e88c563c06fe7e601

                    SHA1

                    c324c9dd8042fd64b3d97514727cf0fb3a938901

                    SHA256

                    bf1be2437ac9e95f41383aedb7858f8484e709116192fae7ac259a28feb2e96d

                    SHA512

                    ac566b737a7afb772b9af586a317221e242157b14e462e342578c1afca36f7219fb035cd809f70d050164902951924af9146547714ede5cbdcdec255d4809da2

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor4886.exe

                    Filesize

                    298KB

                    MD5

                    09dafa76e70e412e88c563c06fe7e601

                    SHA1

                    c324c9dd8042fd64b3d97514727cf0fb3a938901

                    SHA256

                    bf1be2437ac9e95f41383aedb7858f8484e709116192fae7ac259a28feb2e96d

                    SHA512

                    ac566b737a7afb772b9af586a317221e242157b14e462e342578c1afca36f7219fb035cd809f70d050164902951924af9146547714ede5cbdcdec255d4809da2

                  • memory/372-161-0x00000000001B0000-0x00000000001BA000-memory.dmp

                    Filesize

                    40KB

                  • memory/2108-176-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-198-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-180-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-182-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-184-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-186-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-188-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-190-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-192-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-194-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-196-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-178-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-199-0x0000000000400000-0x0000000002B79000-memory.dmp

                    Filesize

                    39.5MB

                  • memory/2108-200-0x0000000007250000-0x0000000007260000-memory.dmp

                    Filesize

                    64KB

                  • memory/2108-201-0x0000000007250000-0x0000000007260000-memory.dmp

                    Filesize

                    64KB

                  • memory/2108-203-0x0000000007250000-0x0000000007260000-memory.dmp

                    Filesize

                    64KB

                  • memory/2108-204-0x0000000000400000-0x0000000002B79000-memory.dmp

                    Filesize

                    39.5MB

                  • memory/2108-174-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-172-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-171-0x0000000007110000-0x0000000007122000-memory.dmp

                    Filesize

                    72KB

                  • memory/2108-170-0x0000000007250000-0x0000000007260000-memory.dmp

                    Filesize

                    64KB

                  • memory/2108-169-0x0000000007250000-0x0000000007260000-memory.dmp

                    Filesize

                    64KB

                  • memory/2108-168-0x0000000002C80000-0x0000000002CAD000-memory.dmp

                    Filesize

                    180KB

                  • memory/2108-167-0x0000000007260000-0x0000000007804000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4388-217-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-1123-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-222-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-224-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-226-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-228-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-230-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-232-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-234-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-236-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-238-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-240-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-242-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-244-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-246-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-1119-0x0000000007920000-0x0000000007F38000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4388-1120-0x0000000007F70000-0x000000000807A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4388-1121-0x00000000080B0000-0x00000000080C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/4388-1122-0x00000000080D0000-0x000000000810C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4388-220-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-1125-0x00000000083C0000-0x0000000008452000-memory.dmp

                    Filesize

                    584KB

                  • memory/4388-1126-0x0000000008460000-0x00000000084C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/4388-1127-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-1128-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-1129-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-1130-0x0000000008DC0000-0x0000000008F82000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4388-1131-0x0000000008F90000-0x00000000094BC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4388-1132-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-1133-0x000000000A8F0000-0x000000000A966000-memory.dmp

                    Filesize

                    472KB

                  • memory/4388-1134-0x000000000A970000-0x000000000A9C0000-memory.dmp

                    Filesize

                    320KB

                  • memory/4388-209-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-210-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-219-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-216-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-213-0x0000000004C70000-0x0000000004CAE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4388-214-0x0000000004B40000-0x0000000004B50000-memory.dmp

                    Filesize

                    64KB

                  • memory/4388-212-0x0000000002CB0000-0x0000000002CFB000-memory.dmp

                    Filesize

                    300KB

                  • memory/4792-1141-0x00000000055C0000-0x00000000055D0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4792-1140-0x0000000000A20000-0x0000000000A52000-memory.dmp

                    Filesize

                    200KB