Analysis

  • max time kernel
    122s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 19:52

General

  • Target

    b56322862ab71792cd494f5f118f5eecaace3cacf54eb66a9d132564c3903bfb.exe

  • Size

    1.0MB

  • MD5

    5e783e5bc18be2c403c793c32b423557

  • SHA1

    d0e3d38d98490f3157bc8811171c99623f197b0d

  • SHA256

    b56322862ab71792cd494f5f118f5eecaace3cacf54eb66a9d132564c3903bfb

  • SHA512

    63cabac97872a2792567d106e25bd725e4b0da45f7ccfe31607888eb9b0c873bca0d6536c6e667d6702fc381c0e79e1032dbefe7530161db0bca5286c4394f74

  • SSDEEP

    24576:2y008AIZNvyhS+hGaNU6drxrV0Q1mhChnHP:Fv8/NaoUa6XV0rYn

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b56322862ab71792cd494f5f118f5eecaace3cacf54eb66a9d132564c3903bfb.exe
    "C:\Users\Admin\AppData\Local\Temp\b56322862ab71792cd494f5f118f5eecaace3cacf54eb66a9d132564c3903bfb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6431.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6431.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8017.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8017.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9363.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9363.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1072
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu484662.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu484662.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:932
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9195.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9195.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1228
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\doL48s01.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\doL48s01.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en778717.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en778717.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2816
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge066947.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge066947.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4320
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3032
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:1488
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:3636
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:4132
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:5064
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3972
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:1808
              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                1⤵
                • Executes dropped EXE
                PID:3444

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge066947.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge066947.exe

                Filesize

                227KB

                MD5

                4e4001936aaecf00b1db37a7974f329e

                SHA1

                5ca5d5a295ffdcdcd07fb4d652bbf3eb5dd60953

                SHA256

                e140ccd13deac5510f4e4dbf17ea38649c9b20ac81efde8816f6c02e6fdf25df

                SHA512

                d3ccc94c8d8a8d9468ea974c4a9efa26f614e8494c9d9b5c4004588d76a3c368d2c82ca43b4339fac8916fdfa745888ab3a5ab0ebbd710ac07daa38d56c9791e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6431.exe

                Filesize

                857KB

                MD5

                0cc72157894734d43a50488590573a85

                SHA1

                a0b9034b240b5270b6e95a86cdcea64d3ebab401

                SHA256

                85d1224c8ffe23d53d788f986d51feb29414e8886d0e3b2a491b17deba6bcaed

                SHA512

                716706a133c9497a260ca1a95c60bd36fef02f9049f3fa3310b386e4607af22ede8a89276ca17825c82f2fda0ebe727427f4c234ec2af833fff32b13216ba84f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6431.exe

                Filesize

                857KB

                MD5

                0cc72157894734d43a50488590573a85

                SHA1

                a0b9034b240b5270b6e95a86cdcea64d3ebab401

                SHA256

                85d1224c8ffe23d53d788f986d51feb29414e8886d0e3b2a491b17deba6bcaed

                SHA512

                716706a133c9497a260ca1a95c60bd36fef02f9049f3fa3310b386e4607af22ede8a89276ca17825c82f2fda0ebe727427f4c234ec2af833fff32b13216ba84f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en778717.exe

                Filesize

                175KB

                MD5

                4b1397cb7db3c52586f64f55fc320b99

                SHA1

                a3bab5ca6877294f917ec3ec865d2076400227f5

                SHA256

                16688414a17c0466963d377fde54df6c55c6c134a94a98d4d81ae5a98d6843ad

                SHA512

                efb7ffc5c971613e21655d1b825e4114de4b433ed8858bb57eeae2e28a48d857b3a80467a7aaff255b2818ca1105c0d01a2a012e5ef63ad5eb84daef5aba0c82

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en778717.exe

                Filesize

                175KB

                MD5

                4b1397cb7db3c52586f64f55fc320b99

                SHA1

                a3bab5ca6877294f917ec3ec865d2076400227f5

                SHA256

                16688414a17c0466963d377fde54df6c55c6c134a94a98d4d81ae5a98d6843ad

                SHA512

                efb7ffc5c971613e21655d1b825e4114de4b433ed8858bb57eeae2e28a48d857b3a80467a7aaff255b2818ca1105c0d01a2a012e5ef63ad5eb84daef5aba0c82

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8017.exe

                Filesize

                715KB

                MD5

                c6411bf212003051033aa73927a01b1b

                SHA1

                d40a5877a875322f0ff68ebb5b108bb3d2e246a3

                SHA256

                64fbc2c193288fc4d15d22c7db76a66b49e88ea14e89f30c6478d4655c969d5b

                SHA512

                8df66ad84bf873584f7407622127ea67673a47cd9bd57ffc20ceeceadbdf457475bbfc4fccef8b73f7e7a5a5112265423d3079ccd291f022228b9fd92a154fff

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8017.exe

                Filesize

                715KB

                MD5

                c6411bf212003051033aa73927a01b1b

                SHA1

                d40a5877a875322f0ff68ebb5b108bb3d2e246a3

                SHA256

                64fbc2c193288fc4d15d22c7db76a66b49e88ea14e89f30c6478d4655c969d5b

                SHA512

                8df66ad84bf873584f7407622127ea67673a47cd9bd57ffc20ceeceadbdf457475bbfc4fccef8b73f7e7a5a5112265423d3079ccd291f022228b9fd92a154fff

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\doL48s01.exe

                Filesize

                366KB

                MD5

                00a80e203ebea71d3693f3a02be2b884

                SHA1

                5e6c2678690da795659d5558bc4543e8996e9339

                SHA256

                7f2c6ea020ef75db2c1e047f80e1190610b03bd09848867a5a3bbd2e9a6ba51d

                SHA512

                41dab4bfa0fb1c95155a2a0a69d6f974bbf07dd4211780a0c1d117014e0778eb84ed3cd3c2a397c555f6d56b2f7d9a760a3fce2c7b6f55655a15c0a3616d8808

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\doL48s01.exe

                Filesize

                366KB

                MD5

                00a80e203ebea71d3693f3a02be2b884

                SHA1

                5e6c2678690da795659d5558bc4543e8996e9339

                SHA256

                7f2c6ea020ef75db2c1e047f80e1190610b03bd09848867a5a3bbd2e9a6ba51d

                SHA512

                41dab4bfa0fb1c95155a2a0a69d6f974bbf07dd4211780a0c1d117014e0778eb84ed3cd3c2a397c555f6d56b2f7d9a760a3fce2c7b6f55655a15c0a3616d8808

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9363.exe

                Filesize

                354KB

                MD5

                eca93f40774b61b34779740d63d24789

                SHA1

                884a0c954754056607be67282865b351a009f645

                SHA256

                ebf7884e457dfaa30a096f46588228739fabab3be0723f37418670a31767e073

                SHA512

                3bb847dd3c0866d33bcb3708876ed246e91f0d24c070eba020f96d5eda8316b1df7db6a9b315a280f0b6437f72cbc6086c128fc8ac7abaacf106d497c5f0984c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9363.exe

                Filesize

                354KB

                MD5

                eca93f40774b61b34779740d63d24789

                SHA1

                884a0c954754056607be67282865b351a009f645

                SHA256

                ebf7884e457dfaa30a096f46588228739fabab3be0723f37418670a31767e073

                SHA512

                3bb847dd3c0866d33bcb3708876ed246e91f0d24c070eba020f96d5eda8316b1df7db6a9b315a280f0b6437f72cbc6086c128fc8ac7abaacf106d497c5f0984c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu484662.exe

                Filesize

                13KB

                MD5

                df0ed6d203ce3998984e7fdb5271da92

                SHA1

                7788e4938f02b0ae39f90200e31b2ac8974f57c4

                SHA256

                1b1ef90ab32f95c82c3f3f0e2a04a4dacec4f5c1c22b96788fe24c761fbaea97

                SHA512

                6a9bace30c460b8d2855ac79e643578dba9aa1a311b3fbddf6130c76a35d1efbab04fbbe165545eac103e41d044d113c16b8f659c818e7e7f425f7df215e08ae

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu484662.exe

                Filesize

                13KB

                MD5

                df0ed6d203ce3998984e7fdb5271da92

                SHA1

                7788e4938f02b0ae39f90200e31b2ac8974f57c4

                SHA256

                1b1ef90ab32f95c82c3f3f0e2a04a4dacec4f5c1c22b96788fe24c761fbaea97

                SHA512

                6a9bace30c460b8d2855ac79e643578dba9aa1a311b3fbddf6130c76a35d1efbab04fbbe165545eac103e41d044d113c16b8f659c818e7e7f425f7df215e08ae

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9195.exe

                Filesize

                308KB

                MD5

                9ced2f85d38c37a6d19360871f26b647

                SHA1

                5ac7d14424cabd57bdd9a42e3628b48896f29756

                SHA256

                1b97af99ae2accd69e349d476869ad67f42faa58371290296aa340da5e6b9715

                SHA512

                9e0ef8ed5fcc423e45071d1120d544c0d70395e067aa483c109426bb97af2c8f0f25ad2dcb78b82000e7a59d94e18d97f13eeacbb27502ba3d6d82d2881440c5

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor9195.exe

                Filesize

                308KB

                MD5

                9ced2f85d38c37a6d19360871f26b647

                SHA1

                5ac7d14424cabd57bdd9a42e3628b48896f29756

                SHA256

                1b97af99ae2accd69e349d476869ad67f42faa58371290296aa340da5e6b9715

                SHA512

                9e0ef8ed5fcc423e45071d1120d544c0d70395e067aa483c109426bb97af2c8f0f25ad2dcb78b82000e7a59d94e18d97f13eeacbb27502ba3d6d82d2881440c5

              • memory/932-161-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

                Filesize

                40KB

              • memory/1228-178-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-198-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/1228-182-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-184-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-186-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-188-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-190-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-192-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-194-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-196-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-197-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/1228-180-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-199-0x0000000004F70000-0x0000000004F80000-memory.dmp

                Filesize

                64KB

              • memory/1228-200-0x0000000000400000-0x000000000070F000-memory.dmp

                Filesize

                3.1MB

              • memory/1228-202-0x0000000000400000-0x000000000070F000-memory.dmp

                Filesize

                3.1MB

              • memory/1228-167-0x0000000000710000-0x000000000073D000-memory.dmp

                Filesize

                180KB

              • memory/1228-176-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-174-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-172-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-169-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-170-0x00000000024F0000-0x0000000002502000-memory.dmp

                Filesize

                72KB

              • memory/1228-168-0x0000000004F80000-0x0000000005524000-memory.dmp

                Filesize

                5.6MB

              • memory/2816-1136-0x0000000000A20000-0x0000000000A52000-memory.dmp

                Filesize

                200KB

              • memory/2816-1137-0x00000000055A0000-0x00000000055B0000-memory.dmp

                Filesize

                64KB

              • memory/4300-212-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-226-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-228-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-230-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-232-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-234-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-236-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-238-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-240-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-398-0x0000000000720000-0x000000000076B000-memory.dmp

                Filesize

                300KB

              • memory/4300-400-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-402-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-1116-0x00000000054C0000-0x0000000005AD8000-memory.dmp

                Filesize

                6.1MB

              • memory/4300-1117-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

                Filesize

                1.0MB

              • memory/4300-1118-0x00000000027C0000-0x00000000027D2000-memory.dmp

                Filesize

                72KB

              • memory/4300-1119-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-1120-0x0000000004E50000-0x0000000004E8C000-memory.dmp

                Filesize

                240KB

              • memory/4300-1121-0x0000000005E10000-0x0000000005E76000-memory.dmp

                Filesize

                408KB

              • memory/4300-1122-0x00000000064D0000-0x0000000006562000-memory.dmp

                Filesize

                584KB

              • memory/4300-1123-0x00000000066B0000-0x0000000006726000-memory.dmp

                Filesize

                472KB

              • memory/4300-1125-0x0000000006740000-0x0000000006790000-memory.dmp

                Filesize

                320KB

              • memory/4300-1126-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-1127-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-1128-0x0000000004F00000-0x0000000004F10000-memory.dmp

                Filesize

                64KB

              • memory/4300-224-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-222-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-220-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-218-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-216-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-214-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-210-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-208-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-207-0x0000000002570000-0x00000000025AF000-memory.dmp

                Filesize

                252KB

              • memory/4300-1129-0x0000000006930000-0x0000000006AF2000-memory.dmp

                Filesize

                1.8MB

              • memory/4300-1130-0x0000000006B00000-0x000000000702C000-memory.dmp

                Filesize

                5.2MB