Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/05/2023, 10:55

General

  • Target

    1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae.exe

  • Size

    1.2MB

  • MD5

    b5c53933515d31bb4472657f98ae0734

  • SHA1

    ba62f5bafcfd60bdf9e5c4f8fa9fde6f83db1679

  • SHA256

    1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae

  • SHA512

    088b9a8698973e2fa7959c4cd540b3a4d4651c73dbcb07028217d11c62fec749d7cc4b27811a9268135fb20c7f7e8c4a7340faecd392b4cbfa889ae4a01dc72a

  • SSDEEP

    24576:cyl5VtwSB4lS+TsNg3CB0HZotdT8rgKNJJ9Xpj56cn31TAzCoQLgTup6:LPgQ4vTseSBVar9NJTZj5b+JEgap

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

217.196.96.56:4138

Attributes
  • auth_value

    fcb02fce9bc10c56a9841d56974bd7b8

Extracted

Family

redline

Botnet

boom

C2

217.196.96.56:4138

Attributes
  • auth_value

    1ce6aebe15bac07a7bc88b114bc49335

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae.exe
    "C:\Users\Admin\AppData\Local\Temp\1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4428841.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4428841.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9496916.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9496916.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9148087.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9148087.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n6100698.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n6100698.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2144
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o9284925.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o9284925.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3756
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3906591.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3906591.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4977520.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4977520.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1986567.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1986567.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4372
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:3852
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:4232
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:4888
  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
    1⤵
    • Executes dropped EXE
    PID:4228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1986567.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1986567.exe

    Filesize

    229KB

    MD5

    411e5b68ea40e4a5c1e2ceeb9668f073

    SHA1

    839d219ce42c3fb10ba24476dfdccb3261288195

    SHA256

    f34c05538c6fdfce9fc6dbc56dbbb7943aa5e097e10eccc953d015b5a03fce6a

    SHA512

    52ea66342ca2411131694ed9a8046e41b0173e6b3043eecee676e5fabd8e85d31c512610d8a72764a6fb7ecc49ee6b343cbc9b134256e244cb2bd967b8a95b7c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4428841.exe

    Filesize

    1.0MB

    MD5

    6312ad471324eb88623bb10494434866

    SHA1

    b1d058efc56457280f93e2ce47bf83c0c7266436

    SHA256

    7d9ea8b36596a553ab2bea3f7eec8d748cda1686c6977f4731b953097ff0d1db

    SHA512

    ce6ca4d05a12762ae71115b469cb15a3e62a323363f77a81898aa6f57029cbcbb312a8d459c7e47ab17b9ac974c7df2d9c9aba8b6280d9afa3f29d7190412524

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4428841.exe

    Filesize

    1.0MB

    MD5

    6312ad471324eb88623bb10494434866

    SHA1

    b1d058efc56457280f93e2ce47bf83c0c7266436

    SHA256

    7d9ea8b36596a553ab2bea3f7eec8d748cda1686c6977f4731b953097ff0d1db

    SHA512

    ce6ca4d05a12762ae71115b469cb15a3e62a323363f77a81898aa6f57029cbcbb312a8d459c7e47ab17b9ac974c7df2d9c9aba8b6280d9afa3f29d7190412524

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4977520.exe

    Filesize

    177KB

    MD5

    91f119f9e76d1dec03dffd7cc1b93bda

    SHA1

    817ac28d4c70cbbd815f4baca91bf4a2eaba98fb

    SHA256

    83597c1ff739140be12b4f9f87d533e51384944fa57a7defc4179a40e3f586ee

    SHA512

    d8b52457d3e6674a1805dc4cc6a4be54cce21d2d6182ad71f34f5199bcc880a72880439abb44e012f721bd7562d0025fa49326b67708f3ef481e3ce8d7af98a6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4977520.exe

    Filesize

    177KB

    MD5

    91f119f9e76d1dec03dffd7cc1b93bda

    SHA1

    817ac28d4c70cbbd815f4baca91bf4a2eaba98fb

    SHA256

    83597c1ff739140be12b4f9f87d533e51384944fa57a7defc4179a40e3f586ee

    SHA512

    d8b52457d3e6674a1805dc4cc6a4be54cce21d2d6182ad71f34f5199bcc880a72880439abb44e012f721bd7562d0025fa49326b67708f3ef481e3ce8d7af98a6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9496916.exe

    Filesize

    847KB

    MD5

    2ec2f337c8e740c29e4ed961c5820abd

    SHA1

    4c67e82e18c78e4ae0db2ece30e2a75670dac2a3

    SHA256

    7593cdb2a4f34106f2ca7121fe620b9e49ffd6301c4510a5cf91326a35f266a2

    SHA512

    861e7c546ea1715f51217d24809c64caf28de58de07a515ef122bbb0d380aa2bfc9b8f8328e34ba4303f8b95b2d2362f7d149a2ff35bd3b168febe028e6567f7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9496916.exe

    Filesize

    847KB

    MD5

    2ec2f337c8e740c29e4ed961c5820abd

    SHA1

    4c67e82e18c78e4ae0db2ece30e2a75670dac2a3

    SHA256

    7593cdb2a4f34106f2ca7121fe620b9e49ffd6301c4510a5cf91326a35f266a2

    SHA512

    861e7c546ea1715f51217d24809c64caf28de58de07a515ef122bbb0d380aa2bfc9b8f8328e34ba4303f8b95b2d2362f7d149a2ff35bd3b168febe028e6567f7

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3906591.exe

    Filesize

    469KB

    MD5

    3dcfc829f8717ebe0d3c94ff9a2894b4

    SHA1

    ab627b837e675d5ae79d51774eef04f37ac0b4e4

    SHA256

    b182cf1f16d906e0500ffab00336de1424f5c07244403a26110b4a1c3a660077

    SHA512

    f7a867ba5ec5f8b0524c2487a02a555f0eeb9ae1227dc1b9f8677d34cd331757cfa2f13e4b6fd9a32048c77b0870e22d0bfe42af6fa1afb30b28311aa7a09053

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p3906591.exe

    Filesize

    469KB

    MD5

    3dcfc829f8717ebe0d3c94ff9a2894b4

    SHA1

    ab627b837e675d5ae79d51774eef04f37ac0b4e4

    SHA256

    b182cf1f16d906e0500ffab00336de1424f5c07244403a26110b4a1c3a660077

    SHA512

    f7a867ba5ec5f8b0524c2487a02a555f0eeb9ae1227dc1b9f8677d34cd331757cfa2f13e4b6fd9a32048c77b0870e22d0bfe42af6fa1afb30b28311aa7a09053

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9148087.exe

    Filesize

    383KB

    MD5

    721ac780939facd4b06b5c8060ffb38a

    SHA1

    559e5d2fe296b310b50f01b980957013431cdd30

    SHA256

    067f52a424789f36550f514aa0f3885014d4b21fbf01e5e133ff77f5235ecc3b

    SHA512

    c3020182d5ed992650a4cd2315c22e1a9af3e6470d6b885dc7a37d3c3b5c94994de3d96292fda84a29b9d622ac4ea80df06cc3185de4d77f869202f8a06ff1fb

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9148087.exe

    Filesize

    383KB

    MD5

    721ac780939facd4b06b5c8060ffb38a

    SHA1

    559e5d2fe296b310b50f01b980957013431cdd30

    SHA256

    067f52a424789f36550f514aa0f3885014d4b21fbf01e5e133ff77f5235ecc3b

    SHA512

    c3020182d5ed992650a4cd2315c22e1a9af3e6470d6b885dc7a37d3c3b5c94994de3d96292fda84a29b9d622ac4ea80df06cc3185de4d77f869202f8a06ff1fb

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n6100698.exe

    Filesize

    284KB

    MD5

    c1a214971e7568cf20851bb1cf6b5004

    SHA1

    92869f4bbf3240df64d9558e1d661d275a28783f

    SHA256

    f808027ec0e9634ac621960ad56acf5137b46e49492c4dbe62837d357643d47c

    SHA512

    e7b3c56274724637990f38e9b32c8b1505177ac62797638c58f7d9068f4c9a77db2036e58c9e3f8817e73b5aa9acfb62a97522005787d3f733d7f530fc82e59e

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n6100698.exe

    Filesize

    284KB

    MD5

    c1a214971e7568cf20851bb1cf6b5004

    SHA1

    92869f4bbf3240df64d9558e1d661d275a28783f

    SHA256

    f808027ec0e9634ac621960ad56acf5137b46e49492c4dbe62837d357643d47c

    SHA512

    e7b3c56274724637990f38e9b32c8b1505177ac62797638c58f7d9068f4c9a77db2036e58c9e3f8817e73b5aa9acfb62a97522005787d3f733d7f530fc82e59e

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o9284925.exe

    Filesize

    169KB

    MD5

    fa359cb241cc7639472b208246ad90a7

    SHA1

    8b862e49686665984b8aad41a905c72015a4da8c

    SHA256

    5298df2a9f2dcfece74cbceeee0ac50ece38692ce4e68b7e28c765b401172f63

    SHA512

    664784619821e89ea29583f949668ed89e7890e46dd6f9e7ae35eb68906b395536d692d95acb99eb2af767c109625ff490fc2c2dd13c2fb6f561366683f85f35

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o9284925.exe

    Filesize

    169KB

    MD5

    fa359cb241cc7639472b208246ad90a7

    SHA1

    8b862e49686665984b8aad41a905c72015a4da8c

    SHA256

    5298df2a9f2dcfece74cbceeee0ac50ece38692ce4e68b7e28c765b401172f63

    SHA512

    664784619821e89ea29583f949668ed89e7890e46dd6f9e7ae35eb68906b395536d692d95acb99eb2af767c109625ff490fc2c2dd13c2fb6f561366683f85f35

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    162B

    MD5

    1b7c22a214949975556626d7217e9a39

    SHA1

    d01c97e2944166ed23e47e4a62ff471ab8fa031f

    SHA256

    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

    SHA512

    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    7070d754b720fe5162742116d8683a49

    SHA1

    e1e928cacf55633f30125dcf2e7aa6a0e6f4172e

    SHA256

    5eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2

    SHA512

    cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    7070d754b720fe5162742116d8683a49

    SHA1

    e1e928cacf55633f30125dcf2e7aa6a0e6f4172e

    SHA256

    5eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2

    SHA512

    cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

    Filesize

    89KB

    MD5

    73df88d68a4f5e066784d462788cf695

    SHA1

    e4bfed336848d0b622fa464d40cf4bd9222aab3f

    SHA256

    f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f

    SHA512

    64c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817

  • memory/2144-175-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-159-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-184-0x0000000000400000-0x00000000006C7000-memory.dmp

    Filesize

    2.8MB

  • memory/2144-181-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-179-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-149-0x00000000025B0000-0x00000000025CA000-memory.dmp

    Filesize

    104KB

  • memory/2144-150-0x00000000007A0000-0x00000000007CD000-memory.dmp

    Filesize

    180KB

  • memory/2144-151-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

    Filesize

    64KB

  • memory/2144-152-0x0000000004CF0000-0x00000000051EE000-memory.dmp

    Filesize

    5.0MB

  • memory/2144-153-0x0000000004BF0000-0x0000000004C08000-memory.dmp

    Filesize

    96KB

  • memory/2144-155-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-154-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-157-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-171-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-161-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-163-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-169-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-167-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-182-0x0000000000400000-0x00000000006C7000-memory.dmp

    Filesize

    2.8MB

  • memory/2144-165-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-177-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/2144-173-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/3752-2397-0x00000000030C0000-0x00000000030C6000-memory.dmp

    Filesize

    24KB

  • memory/3752-2402-0x000000000AC80000-0x000000000ACCB000-memory.dmp

    Filesize

    300KB

  • memory/3752-2430-0x00000000057B0000-0x00000000057C0000-memory.dmp

    Filesize

    64KB

  • memory/3752-2393-0x0000000000EB0000-0x0000000000EDE000-memory.dmp

    Filesize

    184KB

  • memory/3756-201-0x0000000008340000-0x000000000886C000-memory.dmp

    Filesize

    5.2MB

  • memory/3756-195-0x0000000004C10000-0x0000000004C5B000-memory.dmp

    Filesize

    300KB

  • memory/3756-188-0x00000000000F0000-0x000000000011E000-memory.dmp

    Filesize

    184KB

  • memory/3756-189-0x00000000008C0000-0x00000000008C6000-memory.dmp

    Filesize

    24KB

  • memory/3756-190-0x00000000051A0000-0x00000000057A6000-memory.dmp

    Filesize

    6.0MB

  • memory/3756-191-0x0000000004CA0000-0x0000000004DAA000-memory.dmp

    Filesize

    1.0MB

  • memory/3756-192-0x00000000022F0000-0x0000000002302000-memory.dmp

    Filesize

    72KB

  • memory/3756-193-0x00000000008B0000-0x00000000008C0000-memory.dmp

    Filesize

    64KB

  • memory/3756-194-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

    Filesize

    248KB

  • memory/3756-202-0x00000000008B0000-0x00000000008C0000-memory.dmp

    Filesize

    64KB

  • memory/3756-196-0x0000000004EC0000-0x0000000004F36000-memory.dmp

    Filesize

    472KB

  • memory/3756-197-0x0000000004FE0000-0x0000000005072000-memory.dmp

    Filesize

    584KB

  • memory/3756-198-0x0000000005080000-0x00000000050E6000-memory.dmp

    Filesize

    408KB

  • memory/3756-199-0x0000000005900000-0x0000000005950000-memory.dmp

    Filesize

    320KB

  • memory/3756-200-0x0000000006790000-0x0000000006952000-memory.dmp

    Filesize

    1.8MB

  • memory/4000-2427-0x00000000048C0000-0x00000000048D0000-memory.dmp

    Filesize

    64KB

  • memory/4000-2428-0x00000000048C0000-0x00000000048D0000-memory.dmp

    Filesize

    64KB

  • memory/4000-2429-0x00000000048C0000-0x00000000048D0000-memory.dmp

    Filesize

    64KB

  • memory/5064-231-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-237-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-2384-0x0000000005500000-0x0000000005532000-memory.dmp

    Filesize

    200KB

  • memory/5064-2387-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/5064-213-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-211-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-210-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-209-0x00000000052F0000-0x0000000005356000-memory.dmp

    Filesize

    408KB

  • memory/5064-208-0x0000000004D20000-0x0000000004D88000-memory.dmp

    Filesize

    416KB

  • memory/5064-245-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-243-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-241-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-239-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-247-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-235-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-233-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-215-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-229-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-227-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/5064-226-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-225-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/5064-221-0x00000000007D0000-0x000000000082C000-memory.dmp

    Filesize

    368KB

  • memory/5064-222-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-223-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

    Filesize

    64KB

  • memory/5064-219-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB

  • memory/5064-217-0x00000000052F0000-0x0000000005351000-memory.dmp

    Filesize

    388KB