Analysis

  • max time kernel
    132s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2023 11:40

General

  • Target

    c672619482a03a4442cfd2c193307b176a15ca1d88520c7ec15406382e99e30b.exe

  • Size

    707KB

  • MD5

    77ff6448b5b54928f8ef24326e0191f6

  • SHA1

    316253bac0cc6af065c10b0049014ca3395feda5

  • SHA256

    c672619482a03a4442cfd2c193307b176a15ca1d88520c7ec15406382e99e30b

  • SHA512

    d12b42a62b8b101b1549d5d665be209a4c52f206089f1c44ae1dc4079bbffa3e33596a726d56c9ab9d696b81900ce55ad24e02b458185a76e1ccfc82160289eb

  • SSDEEP

    12288:QMrnqy90B/x8Vf18LjkYv3oJTpFzqmBMCj9m1/v3yxM48jcPqkrPYZ6MsVDKy:qyUjkcKTD2nChu3CMrjcRPYZQGy

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes
  • auth_value

    b9ed10946d21e28d58d0c72c535cde6f

Extracted

Family

amadey

Version

3.70

C2

77.91.124.207/plays/chapter/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c672619482a03a4442cfd2c193307b176a15ca1d88520c7ec15406382e99e30b.exe
    "C:\Users\Admin\AppData\Local\Temp\c672619482a03a4442cfd2c193307b176a15ca1d88520c7ec15406382e99e30b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivR0836.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivR0836.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziBl9123.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziBl9123.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it650930.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it650930.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4804
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr962351.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr962351.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2788
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1664
            5⤵
            • Program crash
            PID:4252
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp806324.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp806324.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr095695.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr095695.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4976
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
          4⤵
          • Loads dropped DLL
          PID:1912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2788 -ip 2788
    1⤵
      PID:4652
    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:1720
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3372
    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:3764

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr095695.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr095695.exe
      Filesize

      229KB

      MD5

      6c07711a17452b855149a95cda6fc830

      SHA1

      5b3252c2567de78f9ae68764d4e30511a509fdcc

      SHA256

      eb7e8334a5323f858f1ea97079e958beeb846651b573edc073b29a481b891e9f

      SHA512

      ade99076fc768feb8e6620fe2fd3d5bbf67254844be60ebebaeeb01a2a239e14ff74dfa74ff6f6cd1389351a6b529c5f5f8491b3382f8b57f8a524b7dd0f35e2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivR0836.exe
      Filesize

      525KB

      MD5

      b8f17f161d0d5d6a29e65db399eb9aa5

      SHA1

      2a30fe79229ab0bb541e398ab3058e3c6942d429

      SHA256

      d1221b32ef4c1bbda0634a1864525771aaddf8fdec6b9a239a825742844a34c6

      SHA512

      1e78b7374be1ed12837a6c0ee015309a64c3980665afa875c98d3c9158145ded417ff51c65515f1e8e2dd00207a36dd7c9fbd110f0e07f638c2657d1ce4ab861

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivR0836.exe
      Filesize

      525KB

      MD5

      b8f17f161d0d5d6a29e65db399eb9aa5

      SHA1

      2a30fe79229ab0bb541e398ab3058e3c6942d429

      SHA256

      d1221b32ef4c1bbda0634a1864525771aaddf8fdec6b9a239a825742844a34c6

      SHA512

      1e78b7374be1ed12837a6c0ee015309a64c3980665afa875c98d3c9158145ded417ff51c65515f1e8e2dd00207a36dd7c9fbd110f0e07f638c2657d1ce4ab861

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp806324.exe
      Filesize

      175KB

      MD5

      b2e599dec0856d70ebb2ab2327ae6442

      SHA1

      300323436b47ddafa78cb7e835deb1ab09f13698

      SHA256

      b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

      SHA512

      c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp806324.exe
      Filesize

      175KB

      MD5

      b2e599dec0856d70ebb2ab2327ae6442

      SHA1

      300323436b47ddafa78cb7e835deb1ab09f13698

      SHA256

      b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

      SHA512

      c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziBl9123.exe
      Filesize

      382KB

      MD5

      529d1930701d62b93e8c768ff81fb9cb

      SHA1

      d14afe2ff95b3ad71cb594542834a71e407d3fc6

      SHA256

      ba4f033b64fcb22c2f94a76cff67594f0133e5c804eb396fbaac4331913d6677

      SHA512

      00e8e3139f9e77b92c646e7c051601477e19960b9209f5a820f97ef81bb76b1ffc498c04207dbc99b3d9e7179a9bb9f1d362c8a371c3e0a4f0e20a8ad5a5c42c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziBl9123.exe
      Filesize

      382KB

      MD5

      529d1930701d62b93e8c768ff81fb9cb

      SHA1

      d14afe2ff95b3ad71cb594542834a71e407d3fc6

      SHA256

      ba4f033b64fcb22c2f94a76cff67594f0133e5c804eb396fbaac4331913d6677

      SHA512

      00e8e3139f9e77b92c646e7c051601477e19960b9209f5a820f97ef81bb76b1ffc498c04207dbc99b3d9e7179a9bb9f1d362c8a371c3e0a4f0e20a8ad5a5c42c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it650930.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it650930.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr962351.exe
      Filesize

      299KB

      MD5

      5958fe80e36e77a409e5d72f73f070e2

      SHA1

      53d0413cee20efc9843eae3e3f79ab24eb355da9

      SHA256

      b599208f745f41c35e05869569d28d1e967928fa639f04c86348bbab0f6fd0c8

      SHA512

      c428982907414f75711798b0aebc860d6f0ec574958428eea13394e9f4fc8609f71d1752179795c9392429688ecbf17dcfab01255460ebb16d3b20598854db92

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr962351.exe
      Filesize

      299KB

      MD5

      5958fe80e36e77a409e5d72f73f070e2

      SHA1

      53d0413cee20efc9843eae3e3f79ab24eb355da9

      SHA256

      b599208f745f41c35e05869569d28d1e967928fa639f04c86348bbab0f6fd0c8

      SHA512

      c428982907414f75711798b0aebc860d6f0ec574958428eea13394e9f4fc8609f71d1752179795c9392429688ecbf17dcfab01255460ebb16d3b20598854db92

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
      Filesize

      89KB

      MD5

      4061d8dd5006b99d06fa208c0063dfcf

      SHA1

      38e7df8d8e631f3e9b227df3b9326d187e18cce5

      SHA256

      b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

      SHA512

      71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
      Filesize

      89KB

      MD5

      4061d8dd5006b99d06fa208c0063dfcf

      SHA1

      38e7df8d8e631f3e9b227df3b9326d187e18cce5

      SHA256

      b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

      SHA512

      71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
      Filesize

      89KB

      MD5

      4061d8dd5006b99d06fa208c0063dfcf

      SHA1

      38e7df8d8e631f3e9b227df3b9326d187e18cce5

      SHA256

      b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

      SHA512

      71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

    • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
      Filesize

      162B

      MD5

      1b7c22a214949975556626d7217e9a39

      SHA1

      d01c97e2944166ed23e47e4a62ff471ab8fa031f

      SHA256

      340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

      SHA512

      ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

    • memory/2788-206-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-226-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-179-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-181-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-183-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-185-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-186-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-187-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-189-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-190-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-192-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-194-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-196-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-198-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-200-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-202-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-204-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-175-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-208-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-210-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-212-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-214-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-218-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-216-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-220-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-222-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-224-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-177-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-228-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-1071-0x0000000005340000-0x0000000005958000-memory.dmp
      Filesize

      6.1MB

    • memory/2788-1072-0x0000000004B90000-0x0000000004C9A000-memory.dmp
      Filesize

      1.0MB

    • memory/2788-1073-0x0000000004CC0000-0x0000000004CD2000-memory.dmp
      Filesize

      72KB

    • memory/2788-1074-0x0000000004CE0000-0x0000000004D1C000-memory.dmp
      Filesize

      240KB

    • memory/2788-1075-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-1077-0x0000000005BB0000-0x0000000005C42000-memory.dmp
      Filesize

      584KB

    • memory/2788-1078-0x0000000005C50000-0x0000000005CB6000-memory.dmp
      Filesize

      408KB

    • memory/2788-1079-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-1080-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-1081-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-1082-0x00000000065B0000-0x0000000006772000-memory.dmp
      Filesize

      1.8MB

    • memory/2788-1083-0x0000000006790000-0x0000000006CBC000-memory.dmp
      Filesize

      5.2MB

    • memory/2788-1084-0x0000000006DE0000-0x0000000006E56000-memory.dmp
      Filesize

      472KB

    • memory/2788-1085-0x0000000006E80000-0x0000000006ED0000-memory.dmp
      Filesize

      320KB

    • memory/2788-1086-0x0000000004D80000-0x0000000004D90000-memory.dmp
      Filesize

      64KB

    • memory/2788-173-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-171-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-169-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-167-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-163-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-165-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-162-0x0000000002660000-0x000000000269F000-memory.dmp
      Filesize

      252KB

    • memory/2788-161-0x0000000004D90000-0x0000000005334000-memory.dmp
      Filesize

      5.6MB

    • memory/2788-160-0x00000000020F0000-0x000000000213B000-memory.dmp
      Filesize

      300KB

    • memory/3240-1092-0x0000000000100000-0x0000000000132000-memory.dmp
      Filesize

      200KB

    • memory/3240-1093-0x0000000004CA0000-0x0000000004CB0000-memory.dmp
      Filesize

      64KB

    • memory/4804-154-0x0000000000C30000-0x0000000000C3A000-memory.dmp
      Filesize

      40KB