Analysis

  • max time kernel
    113s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-03-2023 07:11

General

  • Target

    02a28c37fd718954b067cde7574670eb.exe

  • Size

    655KB

  • MD5

    02a28c37fd718954b067cde7574670eb

  • SHA1

    9d332432e700150601ff3afc7f40c99f929b77d2

  • SHA256

    17cd3ca10dac74d91fec42c4ba91f36da04085f6ea6c3a0142a47028dae7750e

  • SHA512

    4da9c28093e9cb05b888cc87d8569b1fb93cd9e0d361625dec4c05b14dbc51b6bacd3292ce560edfda1a4fbf26d0d7ee3c775fab70a231b88e312fd77694abeb

  • SSDEEP

    12288:RMr0y90TuT+wtOTHoBAvVGUhErI+LMzlbOyDMq+EPSD:9ycste18huqD

Malware Config

Extracted

Family

redline

Botnet

lint

C2

193.233.20.28:4125

Attributes
  • auth_value

    0e95262fb78243c67430f3148303e5b7

Extracted

Family

amadey

Version

3.68

C2

62.204.41.87/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02a28c37fd718954b067cde7574670eb.exe
    "C:\Users\Admin\AppData\Local\Temp\02a28c37fd718954b067cde7574670eb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8337.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8337.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8869.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8869.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns3773SK.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns3773SK.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3252
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py65IL51.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py65IL51.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2876
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 1084
            5⤵
            • Program crash
            PID:2220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs4818om.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs4818om.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry83nx03.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry83nx03.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
        "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1868
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:912
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4132
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legenda.exe" /P "Admin:N"
              5⤵
                PID:1320
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "legenda.exe" /P "Admin:R" /E
                5⤵
                  PID:5080
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:3976
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\f22b669919" /P "Admin:N"
                    5⤵
                      PID:3492
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\f22b669919" /P "Admin:R" /E
                      5⤵
                        PID:2112
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2876 -ip 2876
                1⤵
                  PID:3972
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:692
                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  1⤵
                  • Executes dropped EXE
                  PID:916

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                Scheduled Task

                1
                T1053

                Defense Evasion

                Modify Registry

                3
                T1112

                Disabling Security Tools

                2
                T1089

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry83nx03.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry83nx03.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8337.exe
                  Filesize

                  469KB

                  MD5

                  7aba91e93693d082a50f1b0776f9683c

                  SHA1

                  0b4bb2c249354c3e5f51f01357437553bebdd6e7

                  SHA256

                  c24fa9f2e5d9d67a54e800fa74042640dfe5b934b489b0cbd6a12a3fcdef49e0

                  SHA512

                  da0b155c74619088b58140596beb0df8b7d2c59aed1d57fb30bcd98228fb102687bbf05c2669926c9f97fa96782c0af21763d27c1ab374abfa83a51add6219a6

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will8337.exe
                  Filesize

                  469KB

                  MD5

                  7aba91e93693d082a50f1b0776f9683c

                  SHA1

                  0b4bb2c249354c3e5f51f01357437553bebdd6e7

                  SHA256

                  c24fa9f2e5d9d67a54e800fa74042640dfe5b934b489b0cbd6a12a3fcdef49e0

                  SHA512

                  da0b155c74619088b58140596beb0df8b7d2c59aed1d57fb30bcd98228fb102687bbf05c2669926c9f97fa96782c0af21763d27c1ab374abfa83a51add6219a6

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs4818om.exe
                  Filesize

                  175KB

                  MD5

                  0ecc8ab62b7278cc6650517251f1543c

                  SHA1

                  b4273cda193a20d48e83241275ffc34ddad412f2

                  SHA256

                  b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                  SHA512

                  c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs4818om.exe
                  Filesize

                  175KB

                  MD5

                  0ecc8ab62b7278cc6650517251f1543c

                  SHA1

                  b4273cda193a20d48e83241275ffc34ddad412f2

                  SHA256

                  b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

                  SHA512

                  c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8869.exe
                  Filesize

                  324KB

                  MD5

                  d78256ce5d2e99ebeb42d598d603caec

                  SHA1

                  d04d78415edba51c93ea4d8f5810f28558061312

                  SHA256

                  4130126c67edc9185f2a28f75ff6ddb987431510b935930589fe61d02a9cc833

                  SHA512

                  40428fd1172308210cc01aca1d4c73d9f47aac3d3399a1ff5c280364471fc314265ac4525f379c8b440748f109d5bd915bc89d47760a707a6d8e71456ef32646

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will8869.exe
                  Filesize

                  324KB

                  MD5

                  d78256ce5d2e99ebeb42d598d603caec

                  SHA1

                  d04d78415edba51c93ea4d8f5810f28558061312

                  SHA256

                  4130126c67edc9185f2a28f75ff6ddb987431510b935930589fe61d02a9cc833

                  SHA512

                  40428fd1172308210cc01aca1d4c73d9f47aac3d3399a1ff5c280364471fc314265ac4525f379c8b440748f109d5bd915bc89d47760a707a6d8e71456ef32646

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns3773SK.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns3773SK.exe
                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py65IL51.exe
                  Filesize

                  226KB

                  MD5

                  a1736c573cae61d83f13969e7854ab10

                  SHA1

                  0b319a7d6ce6c9c3083778e70b9169d2a8af4ac3

                  SHA256

                  eee0f8c75413f40fc8e990f5abd1568e64b29d663dea1563073e9ed40c7b4687

                  SHA512

                  ab83015503372d2c88b560c4e61b2b50c3dc0c606480770e89a61d2aa7df198fab21954b61c619555b63d3b8c99d606215710bcd9ddfc3e6827d4a9d4a35dfc2

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py65IL51.exe
                  Filesize

                  226KB

                  MD5

                  a1736c573cae61d83f13969e7854ab10

                  SHA1

                  0b319a7d6ce6c9c3083778e70b9169d2a8af4ac3

                  SHA256

                  eee0f8c75413f40fc8e990f5abd1568e64b29d663dea1563073e9ed40c7b4687

                  SHA512

                  ab83015503372d2c88b560c4e61b2b50c3dc0c606480770e89a61d2aa7df198fab21954b61c619555b63d3b8c99d606215710bcd9ddfc3e6827d4a9d4a35dfc2

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
                  Filesize

                  235KB

                  MD5

                  5086db99de54fca268169a1c6cf26122

                  SHA1

                  003f768ffcc99bda5cda1fb966fda8625a8fdc3e

                  SHA256

                  42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

                  SHA512

                  90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                  Filesize

                  89KB

                  MD5

                  16cf28ebb6d37dbaba93f18320c6086e

                  SHA1

                  eae7d4b7a9636329065877aabe8d4f721a26ab25

                  SHA256

                  c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

                  SHA512

                  f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                  Filesize

                  223B

                  MD5

                  94cbeec5d4343918fd0e48760e40539c

                  SHA1

                  a049266c5c1131f692f306c8710d7e72586ae79d

                  SHA256

                  48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

                  SHA512

                  4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

                • memory/1416-210-0x0000000006730000-0x00000000068F2000-memory.dmp
                  Filesize

                  1.8MB

                • memory/1416-212-0x0000000005100000-0x0000000005110000-memory.dmp
                  Filesize

                  64KB

                • memory/1416-211-0x0000000006E30000-0x000000000735C000-memory.dmp
                  Filesize

                  5.2MB

                • memory/1416-213-0x0000000006980000-0x00000000069F6000-memory.dmp
                  Filesize

                  472KB

                • memory/1416-209-0x0000000005A00000-0x0000000005A66000-memory.dmp
                  Filesize

                  408KB

                • memory/1416-208-0x0000000005960000-0x00000000059F2000-memory.dmp
                  Filesize

                  584KB

                • memory/1416-207-0x0000000005100000-0x0000000005110000-memory.dmp
                  Filesize

                  64KB

                • memory/1416-206-0x0000000004E50000-0x0000000004E8C000-memory.dmp
                  Filesize

                  240KB

                • memory/1416-205-0x0000000004DF0000-0x0000000004E02000-memory.dmp
                  Filesize

                  72KB

                • memory/1416-204-0x0000000004EC0000-0x0000000004FCA000-memory.dmp
                  Filesize

                  1.0MB

                • memory/1416-203-0x0000000005340000-0x0000000005958000-memory.dmp
                  Filesize

                  6.1MB

                • memory/1416-202-0x0000000000410000-0x0000000000442000-memory.dmp
                  Filesize

                  200KB

                • memory/1416-214-0x0000000006A00000-0x0000000006A50000-memory.dmp
                  Filesize

                  320KB

                • memory/2876-169-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-198-0x0000000000400000-0x00000000004B8000-memory.dmp
                  Filesize

                  736KB

                • memory/2876-197-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-196-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-195-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-193-0x0000000000400000-0x00000000004B8000-memory.dmp
                  Filesize

                  736KB

                • memory/2876-192-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-191-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-190-0x0000000004C90000-0x0000000004CA0000-memory.dmp
                  Filesize

                  64KB

                • memory/2876-189-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-187-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-183-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-185-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-181-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-179-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-177-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-175-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-173-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-171-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-167-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-163-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-165-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-162-0x0000000002680000-0x0000000002692000-memory.dmp
                  Filesize

                  72KB

                • memory/2876-161-0x0000000004CA0000-0x0000000005244000-memory.dmp
                  Filesize

                  5.6MB

                • memory/2876-160-0x00000000005F0000-0x000000000061D000-memory.dmp
                  Filesize

                  180KB

                • memory/3252-154-0x0000000000830000-0x000000000083A000-memory.dmp
                  Filesize

                  40KB