Analysis

  • max time kernel
    131s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 23:41

General

  • Target

    34570af15eb16642bca9f6b085ca83ff.exe

  • Size

    1.0MB

  • MD5

    34570af15eb16642bca9f6b085ca83ff

  • SHA1

    e60f037fbde591c0547f79ecb65bc8a583b98da4

  • SHA256

    75264f0bd3fd86b38e9d586e46c33fd3067c0c67b7a4f67a475a5a3f0c230941

  • SHA512

    d8db2a35f1a4d3e473ccf3038a33ec1a6d822c60918600a0a008c4f8d5b53fbb686884cdde74a11c816bd314c26a269ba568a68a545724da9210d4b1c30cd726

  • SSDEEP

    24576:by/dsg8gtbQ0OLXCwroDdUw1ZePmKEWhEj:O/btbQbrCNDuzmKEWhE

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34570af15eb16642bca9f6b085ca83ff.exe
    "C:\Users\Admin\AppData\Local\Temp\34570af15eb16642bca9f6b085ca83ff.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2518.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2518.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9782.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9782.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7881.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7881.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu575877.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu575877.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2916
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7082.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7082.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3340
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1076
              6⤵
              • Program crash
              PID:1580
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvW03s16.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvW03s16.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4600
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1888
            5⤵
            • Program crash
            PID:4260
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en527793.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en527793.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge205405.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge205405.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3100
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4108
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3592
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3172
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:3320
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1040
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3340 -ip 3340
                1⤵
                  PID:3676
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4600 -ip 4600
                  1⤵
                    PID:4968
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:5040
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3544

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge205405.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge205405.exe

                    Filesize

                    227KB

                    MD5

                    99bda9fddad9de0371bec554d9a6bd19

                    SHA1

                    b355d9525fd36517ec1b38a585db013d41cbb0a4

                    SHA256

                    de23ab8871d6caa18473b18728e2145fba51ff7d6e822f09ac76d809633390f9

                    SHA512

                    206a4f02d63133e3c9f4b606a217e830c2ea1a3bc73e79d1a0f975a4755eea856d3b72d4e55e78a2384b907e569764f2bb758a56ce3c03a5262c8492bff8e279

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2518.exe

                    Filesize

                    857KB

                    MD5

                    416aa52755c5507708efb83148507a3e

                    SHA1

                    3bc10c3556b8210315739ebb1b014698de59e4f0

                    SHA256

                    6c093a02657a927e73fba70edc5875eb896db8336e009ad06292afbeec941aa9

                    SHA512

                    113309a14a11c4a66bec82ee21422d92ee99d0502ec37bac63b0ceed588f1a4101c0cd67560e2b56a4c4fb0d392bde665321c113a9686b8f0dfb627e78b47f6c

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2518.exe

                    Filesize

                    857KB

                    MD5

                    416aa52755c5507708efb83148507a3e

                    SHA1

                    3bc10c3556b8210315739ebb1b014698de59e4f0

                    SHA256

                    6c093a02657a927e73fba70edc5875eb896db8336e009ad06292afbeec941aa9

                    SHA512

                    113309a14a11c4a66bec82ee21422d92ee99d0502ec37bac63b0ceed588f1a4101c0cd67560e2b56a4c4fb0d392bde665321c113a9686b8f0dfb627e78b47f6c

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en527793.exe

                    Filesize

                    175KB

                    MD5

                    a6a1c185aa7efe6ea8f6316a46cc4e9c

                    SHA1

                    d61f5c6a31a1ae5e5e910ad9249c8b4a4a245dd7

                    SHA256

                    db7160bbd4cae9363828d0697287caff0be088af07e24250094bd137f2b6fab9

                    SHA512

                    f776d2725555963a19cb03b9e3f6ec965aa6c1df2f745a3154c5dce6a4f3c5bcfac154012b98514d9d3334838312b369cc8769682fa79b5fbe914a26117bf96f

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en527793.exe

                    Filesize

                    175KB

                    MD5

                    a6a1c185aa7efe6ea8f6316a46cc4e9c

                    SHA1

                    d61f5c6a31a1ae5e5e910ad9249c8b4a4a245dd7

                    SHA256

                    db7160bbd4cae9363828d0697287caff0be088af07e24250094bd137f2b6fab9

                    SHA512

                    f776d2725555963a19cb03b9e3f6ec965aa6c1df2f745a3154c5dce6a4f3c5bcfac154012b98514d9d3334838312b369cc8769682fa79b5fbe914a26117bf96f

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9782.exe

                    Filesize

                    715KB

                    MD5

                    30597965ed550a011d4333a0af33625f

                    SHA1

                    8a0869508a90aabdabc8b037f3a9246e05ca6e27

                    SHA256

                    5b0901c3d53a9ac051a3e6e5e1fb0a6cafbe0b62be9ee1e784776f099f9e444d

                    SHA512

                    6c40bbbc09e45a7e107b0d7316e126a1b5de9d825c5b04726dda5d072fa30e57d87cd68fa7e5faa6180588d544fdb122b5d4a2148a89d1b4c0c3adf178e1f54b

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9782.exe

                    Filesize

                    715KB

                    MD5

                    30597965ed550a011d4333a0af33625f

                    SHA1

                    8a0869508a90aabdabc8b037f3a9246e05ca6e27

                    SHA256

                    5b0901c3d53a9ac051a3e6e5e1fb0a6cafbe0b62be9ee1e784776f099f9e444d

                    SHA512

                    6c40bbbc09e45a7e107b0d7316e126a1b5de9d825c5b04726dda5d072fa30e57d87cd68fa7e5faa6180588d544fdb122b5d4a2148a89d1b4c0c3adf178e1f54b

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvW03s16.exe

                    Filesize

                    365KB

                    MD5

                    99806f3631e1ecf99c9dd6d6f9786b1b

                    SHA1

                    a316905c3e2e314084d13fdf469780ee7f09bb12

                    SHA256

                    d9d98fec38198e15937bec361481a692ee865e4832bc4fef4825eedeb0caa996

                    SHA512

                    af88f26b181e989d5294fad9b49f59e25effbb4982c7daeb46d01ce50c94042a66a3f6fd8636a71da91c48c2ca7c742bf1bb9c2167426eb617aa821e1558d0d4

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvW03s16.exe

                    Filesize

                    365KB

                    MD5

                    99806f3631e1ecf99c9dd6d6f9786b1b

                    SHA1

                    a316905c3e2e314084d13fdf469780ee7f09bb12

                    SHA256

                    d9d98fec38198e15937bec361481a692ee865e4832bc4fef4825eedeb0caa996

                    SHA512

                    af88f26b181e989d5294fad9b49f59e25effbb4982c7daeb46d01ce50c94042a66a3f6fd8636a71da91c48c2ca7c742bf1bb9c2167426eb617aa821e1558d0d4

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7881.exe

                    Filesize

                    354KB

                    MD5

                    9d245928f04dc867654bfc5bdafedc05

                    SHA1

                    2fa36941b8eea1fa1d5749c3e9b09bee2355dc1f

                    SHA256

                    f814c2577265082e2222f98af8f7058048cf5cb748b8d6d78992944ea692a973

                    SHA512

                    2ca6913d38133d83f8955c1314aa5d176da4a04c274a884175be45d51303bfd3753f68cdffaebeb3a8cb0a68437df3de8707ca805b454d7ce30ae4f287395549

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7881.exe

                    Filesize

                    354KB

                    MD5

                    9d245928f04dc867654bfc5bdafedc05

                    SHA1

                    2fa36941b8eea1fa1d5749c3e9b09bee2355dc1f

                    SHA256

                    f814c2577265082e2222f98af8f7058048cf5cb748b8d6d78992944ea692a973

                    SHA512

                    2ca6913d38133d83f8955c1314aa5d176da4a04c274a884175be45d51303bfd3753f68cdffaebeb3a8cb0a68437df3de8707ca805b454d7ce30ae4f287395549

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu575877.exe

                    Filesize

                    11KB

                    MD5

                    46b1f6c0f0168db69c26c598aa213d78

                    SHA1

                    e84b4a84ed44b92bf25290dd89a5a8a44ed89ea6

                    SHA256

                    a03fde10b298c4197f98fabd2dc25eac677c1d505a7267cd9672717cb41ae1c1

                    SHA512

                    93b2a634e8ef170f94d131e4b883d370a7e03727e0fb7a1ee978681eafd08cd63842a7738a7dad6a222edbf729344560d1611aa10c982bc7fe82f13548633f13

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu575877.exe

                    Filesize

                    11KB

                    MD5

                    46b1f6c0f0168db69c26c598aa213d78

                    SHA1

                    e84b4a84ed44b92bf25290dd89a5a8a44ed89ea6

                    SHA256

                    a03fde10b298c4197f98fabd2dc25eac677c1d505a7267cd9672717cb41ae1c1

                    SHA512

                    93b2a634e8ef170f94d131e4b883d370a7e03727e0fb7a1ee978681eafd08cd63842a7738a7dad6a222edbf729344560d1611aa10c982bc7fe82f13548633f13

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7082.exe

                    Filesize

                    307KB

                    MD5

                    eb72b456a2797065d2dcd93d8d898cef

                    SHA1

                    e618ab77b9141d86cc83c16f07b98fec7cac2552

                    SHA256

                    3c31551fcf9501782ff2163544a8fd6032183656286cee1aa6a609566cc87646

                    SHA512

                    3e073a79d8b1e4c0690f49f904ed7f15df842c93e5095b248274787ffe5b3a02676d3493186239684f32bd6c581130e876f653063db8a7482fe01b793a52d625

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor7082.exe

                    Filesize

                    307KB

                    MD5

                    eb72b456a2797065d2dcd93d8d898cef

                    SHA1

                    e618ab77b9141d86cc83c16f07b98fec7cac2552

                    SHA256

                    3c31551fcf9501782ff2163544a8fd6032183656286cee1aa6a609566cc87646

                    SHA512

                    3e073a79d8b1e4c0690f49f904ed7f15df842c93e5095b248274787ffe5b3a02676d3493186239684f32bd6c581130e876f653063db8a7482fe01b793a52d625

                  • memory/2280-1142-0x0000000005300000-0x0000000005310000-memory.dmp

                    Filesize

                    64KB

                  • memory/2280-1141-0x00000000009B0000-0x00000000009E2000-memory.dmp

                    Filesize

                    200KB

                  • memory/2916-161-0x0000000000920000-0x000000000092A000-memory.dmp

                    Filesize

                    40KB

                  • memory/3340-183-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-205-0x0000000000400000-0x000000000070F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/3340-187-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-189-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-191-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-193-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-195-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-197-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-199-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-200-0x0000000000400000-0x000000000070F000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/3340-201-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-202-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-203-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-185-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-181-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-179-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-177-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-175-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-173-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-172-0x0000000002670000-0x0000000002682000-memory.dmp

                    Filesize

                    72KB

                  • memory/3340-171-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-169-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-170-0x00000000024E0000-0x00000000024F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/3340-168-0x0000000000710000-0x000000000073D000-memory.dmp

                    Filesize

                    180KB

                  • memory/3340-167-0x0000000004DC0000-0x0000000005364000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4600-217-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-233-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-235-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-237-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-239-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-241-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-243-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-246-0x00000000007F0000-0x000000000083B000-memory.dmp

                    Filesize

                    300KB

                  • memory/4600-247-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-250-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-252-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-1120-0x00000000054C0000-0x0000000005AD8000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4600-1121-0x0000000005B20000-0x0000000005C2A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4600-1123-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-1122-0x0000000005C40000-0x0000000005C52000-memory.dmp

                    Filesize

                    72KB

                  • memory/4600-1124-0x0000000005C60000-0x0000000005C9C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4600-1125-0x0000000005F50000-0x0000000005FE2000-memory.dmp

                    Filesize

                    584KB

                  • memory/4600-1126-0x0000000005FF0000-0x0000000006056000-memory.dmp

                    Filesize

                    408KB

                  • memory/4600-1128-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-1129-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-1130-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-1131-0x00000000066F0000-0x0000000006766000-memory.dmp

                    Filesize

                    472KB

                  • memory/4600-1132-0x0000000006780000-0x00000000067D0000-memory.dmp

                    Filesize

                    320KB

                  • memory/4600-1133-0x0000000006900000-0x0000000006AC2000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4600-1134-0x0000000006B10000-0x000000000703C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4600-1135-0x0000000004E00000-0x0000000004E10000-memory.dmp

                    Filesize

                    64KB

                  • memory/4600-231-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-229-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-227-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-225-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-223-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-221-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-219-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-215-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-213-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-211-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB

                  • memory/4600-210-0x0000000002920000-0x000000000295F000-memory.dmp

                    Filesize

                    252KB