Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 20:01

General

  • Target

    17dc8eb75b6c476ba5d85428da9e6eba8ea3380b54cb01a74730f88d7be21ce8.exe

  • Size

    1.0MB

  • MD5

    bfb21c9f6ad936ddea19cf16e8d00f65

  • SHA1

    a8945d3908fabccf5e3ca2eab01eff390ed91657

  • SHA256

    17dc8eb75b6c476ba5d85428da9e6eba8ea3380b54cb01a74730f88d7be21ce8

  • SHA512

    fd57017f3aee54a018aed41933c203b50896ccdacd436045f0c519e1f868bb24b3769d574b3433f1e35cad6158cec78a7657f8635abc7c2e1008696eb67c32e9

  • SSDEEP

    24576:Ky1zoh+QEf0nhkNpHFqz4SSaROPFlLUM4InGx5D:RFohLEf0n2L84aCF+MjI5

Malware Config

Extracted

Family

amadey

Version

3.70

Botnet

b50502

C2

http://77.91.124.207

Attributes
  • install_dir

    595f021478

  • install_file

    oneetx.exe

  • strings_key

    6e3d32d239380a49b6f83128fe71ea01

  • url_paths

    /plays/chapter/index.php

rc4.plain

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 30 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17dc8eb75b6c476ba5d85428da9e6eba8ea3380b54cb01a74730f88d7be21ce8.exe
    "C:\Users\Admin\AppData\Local\Temp\17dc8eb75b6c476ba5d85428da9e6eba8ea3380b54cb01a74730f88d7be21ce8.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1326.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1326.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7995.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7995.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az651152.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az651152.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1728
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu840181.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu840181.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 696
            5⤵
            • Program crash
            PID:2504
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 776
            5⤵
            • Program crash
            PID:2680
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 856
            5⤵
            • Program crash
            PID:1148
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 952
            5⤵
            • Program crash
            PID:4796
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 972
            5⤵
            • Program crash
            PID:4496
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 992
            5⤵
            • Program crash
            PID:2252
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1216
            5⤵
            • Program crash
            PID:1596
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1208
            5⤵
            • Program crash
            PID:3268
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1316
            5⤵
            • Program crash
            PID:2500
          • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 692
              6⤵
              • Program crash
              PID:2288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1004
              6⤵
              • Program crash
              PID:4676
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1012
              6⤵
              • Program crash
              PID:4728
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1092
              6⤵
              • Program crash
              PID:320
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1116
              6⤵
              • Program crash
              PID:2276
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1084
              6⤵
              • Program crash
              PID:2024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1080
              6⤵
              • Program crash
              PID:3884
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1328
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 996
              6⤵
              • Program crash
              PID:4456
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 772
              6⤵
              • Program crash
              PID:2844
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 888
              6⤵
              • Program crash
              PID:4144
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 776
              6⤵
              • Program crash
              PID:5096
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1444
              6⤵
              • Program crash
              PID:1356
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1068
              6⤵
              • Program crash
              PID:1384
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1420
              6⤵
              • Program crash
              PID:5172
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1408
              6⤵
              • Program crash
              PID:5608
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1592
              6⤵
              • Program crash
              PID:5880
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 1428
            5⤵
            • Program crash
            PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor8375.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor8375.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 1084
          4⤵
          • Program crash
          PID:2156
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dcd16s40.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dcd16s40.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\Temp\1.exe
        "C:\Windows\Temp\1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 1384
        3⤵
        • Program crash
        PID:5964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2732 -ip 2732
    1⤵
      PID:832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2732 -ip 2732
      1⤵
        PID:4968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2732 -ip 2732
        1⤵
          PID:1188
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2732 -ip 2732
          1⤵
            PID:4132
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2732 -ip 2732
            1⤵
              PID:5044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2732 -ip 2732
              1⤵
                PID:2124
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2732 -ip 2732
                1⤵
                  PID:1680
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2732 -ip 2732
                  1⤵
                    PID:1080
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2732 -ip 2732
                    1⤵
                      PID:3324
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2732 -ip 2732
                      1⤵
                        PID:4716
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1856 -ip 1856
                        1⤵
                          PID:2956
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1856 -ip 1856
                          1⤵
                            PID:4300
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1856 -ip 1856
                            1⤵
                              PID:5088
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1856 -ip 1856
                              1⤵
                                PID:628
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1856 -ip 1856
                                1⤵
                                  PID:3860
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1856 -ip 1856
                                  1⤵
                                    PID:3892
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1856 -ip 1856
                                    1⤵
                                      PID:4780
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1856 -ip 1856
                                      1⤵
                                        PID:2456
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1856 -ip 1856
                                        1⤵
                                          PID:540
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1856 -ip 1856
                                          1⤵
                                            PID:848
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1856 -ip 1856
                                            1⤵
                                              PID:4360
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1856 -ip 1856
                                              1⤵
                                                PID:4452
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3496 -ip 3496
                                                1⤵
                                                  PID:1784
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1464 -ip 1464
                                                  1⤵
                                                    PID:5876
                                                  • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                    C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:1116
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 192
                                                      2⤵
                                                      • Program crash
                                                      PID:812
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1116 -ip 1116
                                                    1⤵
                                                      PID:4808
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1856 -ip 1856
                                                      1⤵
                                                        PID:1572
                                                      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                        C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:5432
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 320
                                                          2⤵
                                                          • Program crash
                                                          PID:5560
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5432 -ip 5432
                                                        1⤵
                                                          PID:5520
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1856 -ip 1856
                                                          1⤵
                                                            PID:1492
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1856 -ip 1856
                                                            1⤵
                                                              PID:5280
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1856 -ip 1856
                                                              1⤵
                                                                PID:5784

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dcd16s40.exe

                                                                      Filesize

                                                                      426KB

                                                                      MD5

                                                                      4e1d6f1d4a3c4617d1fd91fa6db6061d

                                                                      SHA1

                                                                      e46bfdf39d02111bcd9bf5adbe83e555eea15997

                                                                      SHA256

                                                                      20e5c69aba3f0e916cb8744f028993caad9a2f047676d8bb0a681b668a224445

                                                                      SHA512

                                                                      3e6f7cad0e249d29a3cc94ea46b8bb261e72703046f05f81d55b16f85386eabd03f6c9e31df1e99a0ab704b6c27c8d87ffdd1dcab7b15dd4fd16437cadf924cb

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1326.exe

                                                                      Filesize

                                                                      588KB

                                                                      MD5

                                                                      a55b2d155d6eab23f8100ea0d4a14b7a

                                                                      SHA1

                                                                      5f18b79cac54a51c8dfb2797d9f1c2b154b9ec42

                                                                      SHA256

                                                                      fc5737e2516612677739771f3b921932ada24a54f64f8eb1bdec87a3f2935f95

                                                                      SHA512

                                                                      e9bd6c3a881b98e992730da429b51c674dc0de839e4a9377c447d5205851e88b61087517323dd7f526c42cc5c3f30f01d5bfbc933c4983dc79a0f3d2f1a6829f

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor8375.exe

                                                                      Filesize

                                                                      243KB

                                                                      MD5

                                                                      8175c1ae4576aaba6af1dda39e35c21b

                                                                      SHA1

                                                                      e516d58f4603f78e1e3a4c7edf2206f224fcc738

                                                                      SHA256

                                                                      0f4f6ae2a0b37494fc8daf1ca1244ed42cc639486a9c303e9113a18d489c2b97

                                                                      SHA512

                                                                      3776c581bebe90cd7ee86afb4392e8e042f0421683fbce773a341bd1d70221a75710d9c43d4dab209d890cc14ceef0d46c5f6df2e0fd68f21cf0e2b3b6137187

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina7995.exe

                                                                      Filesize

                                                                      316KB

                                                                      MD5

                                                                      764e7fff6c7e4e3ae650e5c350b4b832

                                                                      SHA1

                                                                      69ab26de1a94734c0c33056c53fbc50200ce75e9

                                                                      SHA256

                                                                      3dfc67b4049001d9f5159adaeef516e2490e6f11af7a45b9cdd81cc46a30e98a

                                                                      SHA512

                                                                      3596888cb9901bebab1a6274ff3cb412830f225d19a96ab2b5ba93e1a35195683aa7fbbd2f85223015b5ec7c2a2e94b5b323d811dab400e17543f6807b39d6ad

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\az651152.exe

                                                                      Filesize

                                                                      15KB

                                                                      MD5

                                                                      ccaf2e840d23fb4f73ab759d4824286c

                                                                      SHA1

                                                                      d715c19cf9b8e4841a3f492035ed3c115a735421

                                                                      SHA256

                                                                      14d12c22da5f30a8fd0a6b7d2ae6197d8e72abcc8466f1316c50ba9063450a5e

                                                                      SHA512

                                                                      fb780594a961222bc99c5f4f41f14adcc827df1750dcb5e88ee204c9523b0920165258ea3f287df9644e78b64768014d526ef2542bfb22a0c7b34c8f417b41c0

                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bu840181.exe

                                                                      Filesize

                                                                      235KB

                                                                      MD5

                                                                      23c4f3a369a1223672c417b7cd5fdfc1

                                                                      SHA1

                                                                      31efc44ce096a0291f131b54709f4828aca285ee

                                                                      SHA256

                                                                      3ec53a554baf9d1daace9eb38a49a67733678b153e1f4f8e78ecbb642430f0eb

                                                                      SHA512

                                                                      f30f775a510419b58219a7b851ffe2e2d044f79b20b2aaf334feb5a3665ce5504eaa59e3180e63212934cfb9d91dec0c1891fed1fa467b9a0c4a2fc8574a65d7

                                                                    • C:\Windows\Temp\1.exe

                                                                      Filesize

                                                                      168KB

                                                                      MD5

                                                                      1073b2e7f778788852d3f7bb79929882

                                                                      SHA1

                                                                      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

                                                                      SHA256

                                                                      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

                                                                      SHA512

                                                                      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

                                                                    • memory/1464-94-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-106-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-2169-0x0000000005400000-0x0000000005432000-memory.dmp

                                                                      Filesize

                                                                      200KB

                                                                    • memory/1464-89-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-112-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-90-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-92-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-87-0x0000000004BA0000-0x0000000004C06000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                    • memory/1464-98-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-100-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-102-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-88-0x0000000005200000-0x0000000005266000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                    • memory/1464-108-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-110-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-114-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-116-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-118-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-120-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-104-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1464-96-0x0000000005200000-0x000000000525F000-memory.dmp

                                                                      Filesize

                                                                      380KB

                                                                    • memory/1728-22-0x0000000000660000-0x000000000066A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                    • memory/1728-23-0x00007FFE30163000-0x00007FFE30165000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1728-21-0x00007FFE30163000-0x00007FFE30165000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1856-79-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                      Filesize

                                                                      672KB

                                                                    • memory/2732-43-0x0000000000400000-0x00000000004A8000-memory.dmp

                                                                      Filesize

                                                                      672KB

                                                                    • memory/3496-72-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-68-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-54-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-56-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-58-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-60-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-62-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-64-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-66-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-76-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-70-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-81-0x0000000000400000-0x00000000004AA000-memory.dmp

                                                                      Filesize

                                                                      680KB

                                                                    • memory/3496-52-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-74-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-51-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/3496-50-0x0000000002560000-0x0000000002578000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                    • memory/3496-49-0x0000000004AA0000-0x0000000005044000-memory.dmp

                                                                      Filesize

                                                                      5.6MB

                                                                    • memory/3496-48-0x00000000021D0000-0x00000000021EA000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                    • memory/3496-78-0x0000000002560000-0x0000000002572000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/4952-2185-0x0000000005520000-0x000000000562A000-memory.dmp

                                                                      Filesize

                                                                      1.0MB

                                                                    • memory/4952-2183-0x0000000001300000-0x0000000001306000-memory.dmp

                                                                      Filesize

                                                                      24KB

                                                                    • memory/4952-2184-0x0000000005A30000-0x0000000006048000-memory.dmp

                                                                      Filesize

                                                                      6.1MB

                                                                    • memory/4952-2182-0x00000000009C0000-0x00000000009F0000-memory.dmp

                                                                      Filesize

                                                                      192KB

                                                                    • memory/4952-2186-0x0000000005240000-0x0000000005252000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/4952-2188-0x0000000005260000-0x000000000529C000-memory.dmp

                                                                      Filesize

                                                                      240KB

                                                                    • memory/4952-2189-0x0000000005410000-0x000000000545C000-memory.dmp

                                                                      Filesize

                                                                      304KB