Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-03-2023 03:21

General

  • Target

    setup.exe

  • Size

    656KB

  • MD5

    127500698928db1935273dde6395ed4c

  • SHA1

    aba93472bbcb38cdaa450f017ccb78abc648ff51

  • SHA256

    b6d2705e905238bb509c107378f5c3e1ec13b6a207cc445ed1320f83ea9e3b1b

  • SHA512

    945afffcbed0eb488333e16d4957073f57525034bbd14ae81342d8fbac04da31807567ffba98a2677754333ed701d470f34e530d2c839cf6e2c7ae68885745db

  • SSDEEP

    12288:bMrcy90Nb64dO31H6b4EaZXVeyHGt9DB+Gtk0iy7xjbH/J7myNID1:fyo24GH6jumnDB3tk0iy7xjbH/VmyNQ1

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will6713.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will6713.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will9336.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will9336.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6601XQ.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6601XQ.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2484
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py41SQ02.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py41SQ02.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 1080
            5⤵
            • Program crash
            PID:2472
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3913Kq.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3913Kq.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry33XK40.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry33XK40.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:476
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:3480
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:3620
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:4344
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2256
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:560
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:2000
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1164
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1820 -ip 1820
                1⤵
                  PID:4744
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1996
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2232

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                Scheduled Task

                1
                T1053

                Defense Evasion

                Modify Registry

                3
                T1112

                Disabling Security Tools

                2
                T1089

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry33XK40.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry33XK40.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will6713.exe
                  Filesize

                  469KB

                  MD5

                  14e4356bac021b1609ccb8803dc579c0

                  SHA1

                  7dfdb5878c35f7c2d7e134a8cdcffa63a341596e

                  SHA256

                  159af1c7dbffb4e5a13646484d4ebf5565d4bba8a55ad8f0b2c2d23ab03c34a6

                  SHA512

                  d5210a9b1cc1b0ea525d4c9b7fd47fa4369f8166bafb4392425ee05f83d856d794195ab47f36f94c45d428cf1c53f40810911e1ac665a66f27981c74a3650321

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will6713.exe
                  Filesize

                  469KB

                  MD5

                  14e4356bac021b1609ccb8803dc579c0

                  SHA1

                  7dfdb5878c35f7c2d7e134a8cdcffa63a341596e

                  SHA256

                  159af1c7dbffb4e5a13646484d4ebf5565d4bba8a55ad8f0b2c2d23ab03c34a6

                  SHA512

                  d5210a9b1cc1b0ea525d4c9b7fd47fa4369f8166bafb4392425ee05f83d856d794195ab47f36f94c45d428cf1c53f40810911e1ac665a66f27981c74a3650321

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3913Kq.exe
                  Filesize

                  175KB

                  MD5

                  0ecc8ab62b7278cc6650517251f1543c

                  SHA1

                  b4273cda193a20d48e83241275ffc34ddad412f2

                  SHA256

                  b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                  SHA512

                  c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs3913Kq.exe
                  Filesize

                  175KB

                  MD5

                  0ecc8ab62b7278cc6650517251f1543c

                  SHA1

                  b4273cda193a20d48e83241275ffc34ddad412f2

                  SHA256

                  b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                  SHA512

                  c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will9336.exe
                  Filesize

                  324KB

                  MD5

                  076ba479399fdc8ccc2d328d06b013e9

                  SHA1

                  cba3b969cc0087ff11fe528fc89c324bc7f3d76d

                  SHA256

                  cf7ca1d2caeedb766e14ba6ba23a7c141da7f3b9050058ed7da1aa7558464423

                  SHA512

                  3a010f4640040d6de1002a580677d2f909002e99c1259d4e953d9c7d9d8ed1de471d5261dfa1fed1f8493684ac4489f1d7cc08f2bc9de26416c5a0cd5abf2733

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will9336.exe
                  Filesize

                  324KB

                  MD5

                  076ba479399fdc8ccc2d328d06b013e9

                  SHA1

                  cba3b969cc0087ff11fe528fc89c324bc7f3d76d

                  SHA256

                  cf7ca1d2caeedb766e14ba6ba23a7c141da7f3b9050058ed7da1aa7558464423

                  SHA512

                  3a010f4640040d6de1002a580677d2f909002e99c1259d4e953d9c7d9d8ed1de471d5261dfa1fed1f8493684ac4489f1d7cc08f2bc9de26416c5a0cd5abf2733

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6601XQ.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6601XQ.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py41SQ02.exe
                  Filesize

                  226KB

                  MD5

                  08a130f1b3bd64ebff9cbab460002d2e

                  SHA1

                  c32a2cf552162a8f7772100880864dff71fcac97

                  SHA256

                  929a16f06a67cced5637d0836de1a5872a4d4ef5c4df4be6ea984e4ab8cbae68

                  SHA512

                  6641db84a36c89a3bea3dbfe722ce59e0533f459998564fd628a3bb23250e8bd8a1abed2b642af2ab599a27969332cd80119b154bc37d27d2cab16d22fc8a14d

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py41SQ02.exe
                  Filesize

                  226KB

                  MD5

                  08a130f1b3bd64ebff9cbab460002d2e

                  SHA1

                  c32a2cf552162a8f7772100880864dff71fcac97

                  SHA256

                  929a16f06a67cced5637d0836de1a5872a4d4ef5c4df4be6ea984e4ab8cbae68

                  SHA512

                  6641db84a36c89a3bea3dbfe722ce59e0533f459998564fd628a3bb23250e8bd8a1abed2b642af2ab599a27969332cd80119b154bc37d27d2cab16d22fc8a14d

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                  Filesize

                  223B

                  MD5

                  94cbeec5d4343918fd0e48760e40539c

                  SHA1

                  a049266c5c1131f692f306c8710d7e72586ae79d

                  SHA256

                  48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                  SHA512

                  4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                • memory/1820-192-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-174-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-180-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-182-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-184-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-186-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-188-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-190-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-191-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-176-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-193-0x0000000000400000-0x00000000004B8000-memory.dmp
                  Filesize

                  736KB

                • memory/1820-194-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-196-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-197-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-198-0x0000000000400000-0x00000000004B8000-memory.dmp
                  Filesize

                  736KB

                • memory/1820-160-0x0000000000740000-0x000000000076D000-memory.dmp
                  Filesize

                  180KB

                • memory/1820-161-0x00000000024A0000-0x00000000024B0000-memory.dmp
                  Filesize

                  64KB

                • memory/1820-162-0x0000000004AD0000-0x0000000005074000-memory.dmp
                  Filesize

                  5.6MB

                • memory/1820-163-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-164-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-166-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-168-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-170-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-172-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/1820-178-0x0000000002430000-0x0000000002442000-memory.dmp
                  Filesize

                  72KB

                • memory/2484-154-0x0000000000270000-0x000000000027A000-memory.dmp
                  Filesize

                  40KB

                • memory/4368-207-0x0000000004D50000-0x0000000004D60000-memory.dmp
                  Filesize

                  64KB

                • memory/4368-213-0x00000000068E0000-0x0000000006930000-memory.dmp
                  Filesize

                  320KB

                • memory/4368-210-0x0000000006590000-0x0000000006752000-memory.dmp
                  Filesize

                  1.8MB

                • memory/4368-209-0x0000000005130000-0x0000000005196000-memory.dmp
                  Filesize

                  408KB

                • memory/4368-208-0x0000000005090000-0x0000000005122000-memory.dmp
                  Filesize

                  584KB

                • memory/4368-211-0x0000000006C90000-0x00000000071BC000-memory.dmp
                  Filesize

                  5.2MB

                • memory/4368-206-0x0000000004D60000-0x0000000004D9C000-memory.dmp
                  Filesize

                  240KB

                • memory/4368-205-0x0000000004CF0000-0x0000000004D02000-memory.dmp
                  Filesize

                  72KB

                • memory/4368-204-0x0000000004DC0000-0x0000000004ECA000-memory.dmp
                  Filesize

                  1.0MB

                • memory/4368-203-0x0000000005240000-0x0000000005858000-memory.dmp
                  Filesize

                  6.1MB

                • memory/4368-202-0x0000000000310000-0x0000000000342000-memory.dmp
                  Filesize

                  200KB

                • memory/4368-212-0x0000000006860000-0x00000000068D6000-memory.dmp
                  Filesize

                  472KB

                • memory/4368-214-0x0000000004D50000-0x0000000004D60000-memory.dmp
                  Filesize

                  64KB