Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 01:13

General

  • Target

    18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd.exe

  • Size

    1.0MB

  • MD5

    2af8eaa48a29c8f797e235ef1fa8f6b6

  • SHA1

    ed47aca3c4336827a1142412e98bb6eb6a210de3

  • SHA256

    18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd

  • SHA512

    e725ed99bc0b36bc2d11c3c9f0d8bf4ffa043bf77c65ccd036f27aca65440088c7774ad6d843815b709bc8a1358621053c227a2787033f3616e8abf67b580377

  • SSDEEP

    24576:HyYIZh1Ln374SWDoClOJP8lZT6AirPdt0Rv3URr/T:SL1DMSIBDTB6QR/U5

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

reiv

C2

193.233.20.33:4125

Attributes
  • auth_value

    5e0113277ad2cf97a9b7e175007f1c55

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd.exe
    "C:\Users\Admin\AppData\Local\Temp\18dba3322b369137fa5b4ad91a7ee6b2e420f08914c51dd27eceaeb39d7cb6cd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5079.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5079.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4643.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4643.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5053.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5053.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu241986.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu241986.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2092
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1089.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1089.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2176
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1076
              6⤵
              • Program crash
              PID:4912
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxn77s84.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxn77s84.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 1580
            5⤵
            • Program crash
            PID:1364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en603550.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en603550.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge505032.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge505032.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4764
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4296
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:1676
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:3532
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:1228
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1776
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:4644
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:1372
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2176 -ip 2176
                1⤵
                  PID:3296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1340 -ip 1340
                  1⤵
                    PID:4988
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:732
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4932

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge505032.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge505032.exe

                    Filesize

                    227KB

                    MD5

                    8f9938a43d3de68431a1fd847718c529

                    SHA1

                    329ce2e641a3beb0268fe37676b1ccfe76d926a2

                    SHA256

                    2ccf091b4507fccf594d1daf5cde229c34a2b4039e023237b13bd9d2a8069b75

                    SHA512

                    ee81c9583936b0c9fb3dc79c144d4b0f0af6dcb123ad60534840635dd7b89a039c886ac86caca7752624c9a5786560f523f5f9a9a83a6caeddb17553d2754d13

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5079.exe

                    Filesize

                    850KB

                    MD5

                    c9a167b362149c58579e4a7f66003d1f

                    SHA1

                    5a049d1d2279748881304dd1ef098cd45fe757fc

                    SHA256

                    23eb70fd68fd5d418fafaf8592188a20b28c8fec94628930814b08b5a7b47e5c

                    SHA512

                    a3f8e92430550bbab32f81223ecd09f1fd606fbcda9d56712773260da32eee46b61c36b6ac3a1c6d5274d70fd7601678e1084a47f5548635739f3b8bfc965876

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina5079.exe

                    Filesize

                    850KB

                    MD5

                    c9a167b362149c58579e4a7f66003d1f

                    SHA1

                    5a049d1d2279748881304dd1ef098cd45fe757fc

                    SHA256

                    23eb70fd68fd5d418fafaf8592188a20b28c8fec94628930814b08b5a7b47e5c

                    SHA512

                    a3f8e92430550bbab32f81223ecd09f1fd606fbcda9d56712773260da32eee46b61c36b6ac3a1c6d5274d70fd7601678e1084a47f5548635739f3b8bfc965876

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en603550.exe

                    Filesize

                    175KB

                    MD5

                    b1fadf3d18e8e4195e8c0a02e109cd28

                    SHA1

                    e59571e24a5de4b0fe297e7379ad0a348401e00e

                    SHA256

                    2d4975e56a353557d78289555d716e6ff1a26fd79a2964848003e1d4728f012a

                    SHA512

                    381430ffa0429eb5d38465c9ad139aa394852e55897604f0ffba1203482731905b2d02dc0872eb5200ce57e539059c730f5e6bed63139d1316b7f341ac89ffd2

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en603550.exe

                    Filesize

                    175KB

                    MD5

                    b1fadf3d18e8e4195e8c0a02e109cd28

                    SHA1

                    e59571e24a5de4b0fe297e7379ad0a348401e00e

                    SHA256

                    2d4975e56a353557d78289555d716e6ff1a26fd79a2964848003e1d4728f012a

                    SHA512

                    381430ffa0429eb5d38465c9ad139aa394852e55897604f0ffba1203482731905b2d02dc0872eb5200ce57e539059c730f5e6bed63139d1316b7f341ac89ffd2

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4643.exe

                    Filesize

                    708KB

                    MD5

                    dafb863c426809b52936a4b0f69c9fb6

                    SHA1

                    de73392b768e33e8bf5e35291fe3b0344d030cda

                    SHA256

                    65f14e624bbf5618ccd4fc815ef8adb18bdcda9779da839ce7740b2483b80bf1

                    SHA512

                    c459065964c1b174b0c5d680dbcedf0ea80bd7a747e68c8a9759f39a1ec8fd76dc172b33ef42a799215589148820aaf71399e14ca193d63b1f540184cc5b1548

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4643.exe

                    Filesize

                    708KB

                    MD5

                    dafb863c426809b52936a4b0f69c9fb6

                    SHA1

                    de73392b768e33e8bf5e35291fe3b0344d030cda

                    SHA256

                    65f14e624bbf5618ccd4fc815ef8adb18bdcda9779da839ce7740b2483b80bf1

                    SHA512

                    c459065964c1b174b0c5d680dbcedf0ea80bd7a747e68c8a9759f39a1ec8fd76dc172b33ef42a799215589148820aaf71399e14ca193d63b1f540184cc5b1548

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxn77s84.exe

                    Filesize

                    384KB

                    MD5

                    440060affbbe59ce2091c162744fed08

                    SHA1

                    d742e9d515acad51009ab0fd2d89496803e822ce

                    SHA256

                    1c634a1ea741dcb72cc985ca38dfc9c17037c8e1c320cad225c6a6e34664ba68

                    SHA512

                    2c4acef69173df23c9244916826cb4aeca62880a3a9fd481b46af28e5038bb2de566d6b6e2411db54e6e44981629efc24ad1853dcf477ca2e96084383564ac27

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxn77s84.exe

                    Filesize

                    384KB

                    MD5

                    440060affbbe59ce2091c162744fed08

                    SHA1

                    d742e9d515acad51009ab0fd2d89496803e822ce

                    SHA256

                    1c634a1ea741dcb72cc985ca38dfc9c17037c8e1c320cad225c6a6e34664ba68

                    SHA512

                    2c4acef69173df23c9244916826cb4aeca62880a3a9fd481b46af28e5038bb2de566d6b6e2411db54e6e44981629efc24ad1853dcf477ca2e96084383564ac27

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5053.exe

                    Filesize

                    351KB

                    MD5

                    d921f25bd2b42774122ff7658c9edbad

                    SHA1

                    80b38a3d4ef95c917a65a0fbb601e652fa37f574

                    SHA256

                    6306723b9e63cc60070f3a0a8e7c7ea5de1fbbe8226c2eec97cb185fc6c7786f

                    SHA512

                    f58fde9fc152c28a5910cac1519c620861e3b98fcef9b675e979fa50b6a05860e56e74e02f6c91b6fa6e7b4842039cae584a84d443a47fe546c35dafd3ffa65a

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5053.exe

                    Filesize

                    351KB

                    MD5

                    d921f25bd2b42774122ff7658c9edbad

                    SHA1

                    80b38a3d4ef95c917a65a0fbb601e652fa37f574

                    SHA256

                    6306723b9e63cc60070f3a0a8e7c7ea5de1fbbe8226c2eec97cb185fc6c7786f

                    SHA512

                    f58fde9fc152c28a5910cac1519c620861e3b98fcef9b675e979fa50b6a05860e56e74e02f6c91b6fa6e7b4842039cae584a84d443a47fe546c35dafd3ffa65a

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu241986.exe

                    Filesize

                    12KB

                    MD5

                    30ab1fbd2c7c68db00c314a5d6eade3f

                    SHA1

                    a57f0acdbea0138ed430da5a4dbd58ebd78726fc

                    SHA256

                    e7983d84dad34767c572944f8141706692c81d2d0d0e247bdf2936bbeb810595

                    SHA512

                    689717eaa7162a42da5c11588c4cba01e2fd0431150e13a7114da17eb50a2a3b466fb1391a423aee1122346a5e89054ff103d1c91ebda575704a649f0b092183

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu241986.exe

                    Filesize

                    12KB

                    MD5

                    30ab1fbd2c7c68db00c314a5d6eade3f

                    SHA1

                    a57f0acdbea0138ed430da5a4dbd58ebd78726fc

                    SHA256

                    e7983d84dad34767c572944f8141706692c81d2d0d0e247bdf2936bbeb810595

                    SHA512

                    689717eaa7162a42da5c11588c4cba01e2fd0431150e13a7114da17eb50a2a3b466fb1391a423aee1122346a5e89054ff103d1c91ebda575704a649f0b092183

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1089.exe

                    Filesize

                    325KB

                    MD5

                    cd10e86e4536bbfbd6bc932f4edca0c7

                    SHA1

                    6eba61a641455e62bdef66e84261eb4c11b0d81e

                    SHA256

                    46dbe61625300d6965de4d83185d12df0be588abf108f6559829dbda4ee64dc5

                    SHA512

                    15b6c1577241716f36bb4e3e0d29bf6fe670088c27cd9848f8ecd67f94ba16d11a5b8ba9a98094a403718b87e337ff56affff01aa65061897fe68c4640069787

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor1089.exe

                    Filesize

                    325KB

                    MD5

                    cd10e86e4536bbfbd6bc932f4edca0c7

                    SHA1

                    6eba61a641455e62bdef66e84261eb4c11b0d81e

                    SHA256

                    46dbe61625300d6965de4d83185d12df0be588abf108f6559829dbda4ee64dc5

                    SHA512

                    15b6c1577241716f36bb4e3e0d29bf6fe670088c27cd9848f8ecd67f94ba16d11a5b8ba9a98094a403718b87e337ff56affff01aa65061897fe68c4640069787

                  • memory/1340-1120-0x00000000080B0000-0x00000000080C2000-memory.dmp

                    Filesize

                    72KB

                  • memory/1340-236-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-1133-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-1131-0x00000000097D0000-0x0000000009820000-memory.dmp

                    Filesize

                    320KB

                  • memory/1340-1130-0x0000000009740000-0x00000000097B6000-memory.dmp

                    Filesize

                    472KB

                  • memory/1340-1129-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-1128-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-1127-0x0000000008EA0000-0x00000000093CC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/1340-1126-0x0000000008CC0000-0x0000000008E82000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/1340-1125-0x0000000008460000-0x00000000084C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/1340-1124-0x00000000083C0000-0x0000000008452000-memory.dmp

                    Filesize

                    584KB

                  • memory/1340-1122-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-1121-0x00000000080D0000-0x000000000810C000-memory.dmp

                    Filesize

                    240KB

                  • memory/1340-1119-0x0000000007F70000-0x000000000807A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/1340-1118-0x00000000078E0000-0x0000000007EF8000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/1340-208-0x0000000002DF0000-0x0000000002E3B000-memory.dmp

                    Filesize

                    300KB

                  • memory/1340-209-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-210-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-211-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-214-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-212-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-216-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-218-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-220-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-222-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-224-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-226-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-228-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-230-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-232-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-234-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-289-0x00000000071E0000-0x00000000071F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1340-238-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-240-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-242-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/1340-244-0x0000000007140000-0x000000000717E000-memory.dmp

                    Filesize

                    248KB

                  • memory/2092-161-0x00000000008D0000-0x00000000008DA000-memory.dmp

                    Filesize

                    40KB

                  • memory/2176-190-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-201-0x0000000007260000-0x0000000007270000-memory.dmp

                    Filesize

                    64KB

                  • memory/2176-188-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-203-0x0000000000400000-0x0000000002B7F000-memory.dmp

                    Filesize

                    39.5MB

                  • memory/2176-186-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-200-0x0000000007260000-0x0000000007270000-memory.dmp

                    Filesize

                    64KB

                  • memory/2176-199-0x0000000000400000-0x0000000002B7F000-memory.dmp

                    Filesize

                    39.5MB

                  • memory/2176-176-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-196-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-194-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-192-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-184-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-178-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-182-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-198-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-174-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-180-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-167-0x0000000007270000-0x0000000007814000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/2176-172-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-171-0x00000000049C0000-0x00000000049D2000-memory.dmp

                    Filesize

                    72KB

                  • memory/2176-170-0x0000000007260000-0x0000000007270000-memory.dmp

                    Filesize

                    64KB

                  • memory/2176-169-0x0000000007260000-0x0000000007270000-memory.dmp

                    Filesize

                    64KB

                  • memory/2176-168-0x0000000002C60000-0x0000000002C8D000-memory.dmp

                    Filesize

                    180KB

                  • memory/3240-1139-0x0000000005210000-0x0000000005220000-memory.dmp

                    Filesize

                    64KB

                  • memory/3240-1138-0x00000000008F0000-0x0000000000922000-memory.dmp

                    Filesize

                    200KB