Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-04-2023 11:21

General

  • Target

    d292a2f91b4232e3a5afccd99e8657fcdd49803a4eeec064b85d0d1a5009decc.exe

  • Size

    982KB

  • MD5

    1e675b00bf270b6157f467dcab6c07e4

  • SHA1

    d3e12580e4e705a36ab371313b90bb92167b29bc

  • SHA256

    d292a2f91b4232e3a5afccd99e8657fcdd49803a4eeec064b85d0d1a5009decc

  • SHA512

    fcc1c0c0c136cbc809a0a3a665889ab74f39d7d58f3ebff23c9fa3f7e43e3d36348ae79f2fa766971badef466b56604775c94ff5c8428ba6a62c6ffb9e6461cc

  • SSDEEP

    24576:Cyh4pdIK9Mybv1KMR85w4z7AmEJ2p9GYMzn7sTajnZPXZWU:pSpWFNkm+MmSajnZPs

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Extracted

Family

redline

Botnet

nord

C2

176.113.115.145:4125

Attributes
  • auth_value

    ebb7d38cdbd7c83cf6363ef3feb3a530

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 22 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d292a2f91b4232e3a5afccd99e8657fcdd49803a4eeec064b85d0d1a5009decc.exe
    "C:\Users\Admin\AppData\Local\Temp\d292a2f91b4232e3a5afccd99e8657fcdd49803a4eeec064b85d0d1a5009decc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1565.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1565.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8942.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8942.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1548
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5454.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5454.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az099321.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az099321.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu095548.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu095548.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2708
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8200.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8200.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dqM13s26.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dqM13s26.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
          "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3136
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4432
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
            5⤵
            • Loads dropped DLL
            PID:5044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge450477.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge450477.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:796
  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:5028
  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge450477.exe
    Filesize

    175KB

    MD5

    47b52e7049909e34f093a814f4d0a4aa

    SHA1

    af61fcd6bba0cba8fd43d5082cadd754a58db5c1

    SHA256

    ab6ea41c93266c2e20a168fdc19f03efb8d2296e268868b2898704023318e02d

    SHA512

    4a6315154352c8b16a2fecc70db4ad5a48e6ed9bbc16d7e030c2bb87a9a7314e6c131fb232066267fcb8122c96b8fbb3c639569438c75fb42268c02a199ded43

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge450477.exe
    Filesize

    175KB

    MD5

    47b52e7049909e34f093a814f4d0a4aa

    SHA1

    af61fcd6bba0cba8fd43d5082cadd754a58db5c1

    SHA256

    ab6ea41c93266c2e20a168fdc19f03efb8d2296e268868b2898704023318e02d

    SHA512

    4a6315154352c8b16a2fecc70db4ad5a48e6ed9bbc16d7e030c2bb87a9a7314e6c131fb232066267fcb8122c96b8fbb3c639569438c75fb42268c02a199ded43

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1565.exe
    Filesize

    839KB

    MD5

    e9203c17084a70adc65e7b13174a00d3

    SHA1

    fba434a94b0ec92cb0d27e926640e4bb5d858409

    SHA256

    2132562966c304e8127352a545a99eae6a96cfbd652b41ad2e5fbfdf952c7684

    SHA512

    c6ed9d9bc6d945bd59da1ce8cdf9eb37936834cee0cd7e2d92803feaa735ad7d7f85fcfa3b921e7dd207e974fe3962906f04df75da987073f0e0474a84fa4954

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1565.exe
    Filesize

    839KB

    MD5

    e9203c17084a70adc65e7b13174a00d3

    SHA1

    fba434a94b0ec92cb0d27e926640e4bb5d858409

    SHA256

    2132562966c304e8127352a545a99eae6a96cfbd652b41ad2e5fbfdf952c7684

    SHA512

    c6ed9d9bc6d945bd59da1ce8cdf9eb37936834cee0cd7e2d92803feaa735ad7d7f85fcfa3b921e7dd207e974fe3962906f04df75da987073f0e0474a84fa4954

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dqM13s26.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dqM13s26.exe
    Filesize

    229KB

    MD5

    6c07711a17452b855149a95cda6fc830

    SHA1

    5b3252c2567de78f9ae68764d4e30511a509fdcc

    SHA256

    eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

    SHA512

    ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8942.exe
    Filesize

    656KB

    MD5

    5f934634fd2f130e4d1ed353f66a1f69

    SHA1

    7f5a173dd8ace282a6b5521386c638d6f7f73ce9

    SHA256

    2748e7f94e1f99a1afdd65917f820a737f78b38d374662705cad5c9c856bfa78

    SHA512

    f7fa90cf8c2d8b1a87a27ad8ea19b4285af2ae7c6f581cc38c0f17e306e1cfbb305389b31469753de9ec7d5f1016beaded1add897b60cd7aebd5e393e34ec1f5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8942.exe
    Filesize

    656KB

    MD5

    5f934634fd2f130e4d1ed353f66a1f69

    SHA1

    7f5a173dd8ace282a6b5521386c638d6f7f73ce9

    SHA256

    2748e7f94e1f99a1afdd65917f820a737f78b38d374662705cad5c9c856bfa78

    SHA512

    f7fa90cf8c2d8b1a87a27ad8ea19b4285af2ae7c6f581cc38c0f17e306e1cfbb305389b31469753de9ec7d5f1016beaded1add897b60cd7aebd5e393e34ec1f5

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8200.exe
    Filesize

    299KB

    MD5

    20afce2df710f658a9e568e6d1bbcca8

    SHA1

    f357fcd55bab4420bae80cf4586c666d6126294e

    SHA256

    086b09fd55931cd780a1ae73b4fc9c4ac66ddad6adcd98bb6b29c897d6f95ab2

    SHA512

    5c9d859435378d730298256a7c28ef25363628400a5805e8157b97096e158333ed5a4e0ac69c9eec170e790e83da8fe35a3f85e858f8d9b558461625cefc6475

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8200.exe
    Filesize

    299KB

    MD5

    20afce2df710f658a9e568e6d1bbcca8

    SHA1

    f357fcd55bab4420bae80cf4586c666d6126294e

    SHA256

    086b09fd55931cd780a1ae73b4fc9c4ac66ddad6adcd98bb6b29c897d6f95ab2

    SHA512

    5c9d859435378d730298256a7c28ef25363628400a5805e8157b97096e158333ed5a4e0ac69c9eec170e790e83da8fe35a3f85e858f8d9b558461625cefc6475

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5454.exe
    Filesize

    325KB

    MD5

    4425b499957cb14127d65e055491c33e

    SHA1

    56a7a6a0f91f3690a38a4fb84113eacf812e5d98

    SHA256

    ba7227f76025f1a0928995d24d04d84640f9280b78900f6d02fe3373c542f62c

    SHA512

    98884b76cefd3df75c017892389d15316991d5b4f6f336f36b98dd99233a9c41dc70d6132804755292294acf32f49e8b667134f84dac6bcbdd4439040eaab99a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5454.exe
    Filesize

    325KB

    MD5

    4425b499957cb14127d65e055491c33e

    SHA1

    56a7a6a0f91f3690a38a4fb84113eacf812e5d98

    SHA256

    ba7227f76025f1a0928995d24d04d84640f9280b78900f6d02fe3373c542f62c

    SHA512

    98884b76cefd3df75c017892389d15316991d5b4f6f336f36b98dd99233a9c41dc70d6132804755292294acf32f49e8b667134f84dac6bcbdd4439040eaab99a

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az099321.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az099321.exe
    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu095548.exe
    Filesize

    239KB

    MD5

    bcc8f7205e5cd8aa9377fc07acba37ce

    SHA1

    2a14b6ee0e4f8de4960d67c27c24b65bc25b292c

    SHA256

    2f9f076f0eb2f192a095588a87dd38d3daa29fed7fdc4d447e2d4fc96e95c5f7

    SHA512

    dc0a634a060b7ff986a92472e98ec269bc49843e9605fab6777aff5b84798efd9010a9b6253ac882ae536313fd5418b2da042a7a62a29f8fee977a4f272fe582

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu095548.exe
    Filesize

    239KB

    MD5

    bcc8f7205e5cd8aa9377fc07acba37ce

    SHA1

    2a14b6ee0e4f8de4960d67c27c24b65bc25b292c

    SHA256

    2f9f076f0eb2f192a095588a87dd38d3daa29fed7fdc4d447e2d4fc96e95c5f7

    SHA512

    dc0a634a060b7ff986a92472e98ec269bc49843e9605fab6777aff5b84798efd9010a9b6253ac882ae536313fd5418b2da042a7a62a29f8fee977a4f272fe582

  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
    Filesize

    89KB

    MD5

    4061d8dd5006b99d06fa208c0063dfcf

    SHA1

    38e7df8d8e631f3e9b227df3b9326d187e18cce5

    SHA256

    b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

    SHA512

    71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
    Filesize

    89KB

    MD5

    4061d8dd5006b99d06fa208c0063dfcf

    SHA1

    38e7df8d8e631f3e9b227df3b9326d187e18cce5

    SHA256

    b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

    SHA512

    71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

  • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
    Filesize

    89KB

    MD5

    4061d8dd5006b99d06fa208c0063dfcf

    SHA1

    38e7df8d8e631f3e9b227df3b9326d187e18cce5

    SHA256

    b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

    SHA512

    71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

  • memory/796-1144-0x0000000000B00000-0x0000000000B32000-memory.dmp
    Filesize

    200KB

  • memory/796-1145-0x0000000005380000-0x00000000053CB000-memory.dmp
    Filesize

    300KB

  • memory/796-1146-0x00000000053D0000-0x00000000053E0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1121-0x0000000006200000-0x0000000006276000-memory.dmp
    Filesize

    472KB

  • memory/1480-360-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1128-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1127-0x0000000006750000-0x0000000006C7C000-memory.dmp
    Filesize

    5.2MB

  • memory/1480-1126-0x0000000006580000-0x0000000006742000-memory.dmp
    Filesize

    1.8MB

  • memory/1480-1125-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1124-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1123-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1122-0x00000000062A0000-0x00000000062F0000-memory.dmp
    Filesize

    320KB

  • memory/1480-1120-0x0000000006160000-0x00000000061F2000-memory.dmp
    Filesize

    584KB

  • memory/1480-1118-0x0000000005AA0000-0x0000000005B06000-memory.dmp
    Filesize

    408KB

  • memory/1480-1117-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-200-0x0000000002280000-0x00000000022C6000-memory.dmp
    Filesize

    280KB

  • memory/1480-201-0x0000000004A40000-0x0000000004A84000-memory.dmp
    Filesize

    272KB

  • memory/1480-202-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-203-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-205-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-209-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-217-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-219-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-221-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-223-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-225-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-227-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-229-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-231-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-233-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-235-0x0000000004A40000-0x0000000004A7F000-memory.dmp
    Filesize

    252KB

  • memory/1480-356-0x0000000000590000-0x00000000005DB000-memory.dmp
    Filesize

    300KB

  • memory/1480-1116-0x0000000005910000-0x000000000595B000-memory.dmp
    Filesize

    300KB

  • memory/1480-357-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-361-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
    Filesize

    64KB

  • memory/1480-1112-0x00000000050E0000-0x00000000056E6000-memory.dmp
    Filesize

    6.0MB

  • memory/1480-1113-0x00000000056F0000-0x00000000057FA000-memory.dmp
    Filesize

    1.0MB

  • memory/1480-1114-0x0000000004B70000-0x0000000004B82000-memory.dmp
    Filesize

    72KB

  • memory/1480-1115-0x0000000004B90000-0x0000000004BCE000-memory.dmp
    Filesize

    248KB

  • memory/2624-149-0x00000000000A0000-0x00000000000AA000-memory.dmp
    Filesize

    40KB

  • memory/2708-171-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-179-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-173-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-177-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-193-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-192-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-191-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-190-0x0000000000400000-0x00000000004AA000-memory.dmp
    Filesize

    680KB

  • memory/2708-189-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-187-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-185-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-175-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-195-0x0000000000400000-0x00000000004AA000-memory.dmp
    Filesize

    680KB

  • memory/2708-181-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-160-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-167-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-165-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-163-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-162-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-161-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-159-0x0000000002480000-0x0000000002498000-memory.dmp
    Filesize

    96KB

  • memory/2708-169-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB

  • memory/2708-157-0x0000000000580000-0x00000000005AD000-memory.dmp
    Filesize

    180KB

  • memory/2708-158-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
    Filesize

    64KB

  • memory/2708-156-0x0000000004BF0000-0x00000000050EE000-memory.dmp
    Filesize

    5.0MB

  • memory/2708-155-0x00000000022E0000-0x00000000022FA000-memory.dmp
    Filesize

    104KB

  • memory/2708-183-0x0000000002480000-0x0000000002492000-memory.dmp
    Filesize

    72KB