Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2023 11:31

General

  • Target

    506ad2ec7c9126aea6d7155353a2df5ef5336d1bfe1184a364cc4cf3539fa2f3.exe

  • Size

    764KB

  • MD5

    ee5145a0656b60bffcb80fc5ae6d6336

  • SHA1

    ddfccdfab36136c5c6557d041f11974e3fd501ef

  • SHA256

    506ad2ec7c9126aea6d7155353a2df5ef5336d1bfe1184a364cc4cf3539fa2f3

  • SHA512

    b98e1813cacfa38c00df52c81d322ee5f52551f76e06dbe9f0588cf629442301e38134940be627570b46a04e152705c4e6d07396934c2a19f85f710dba8f78c1

  • SSDEEP

    12288:xMrvy9047KCGMS07aQ9GqSzFLTeAqbXy0D8Uaz2TyT6wso90vtDmp4dX7md8LBvo:Ky17KCTPk5TXLUguwF0vtDa457mdobhc

Malware Config

Extracted

Family

redline

Botnet

disa

C2

83.97.73.122:19062

Attributes
  • auth_value

    93f8c4ca7000e3381dd4b6b86434de05

Extracted

Family

redline

Botnet

goga

C2

83.97.73.122:19062

Attributes
  • auth_value

    6d57dff6d3c42dddb8a76dc276b8467f

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\506ad2ec7c9126aea6d7155353a2df5ef5336d1bfe1184a364cc4cf3539fa2f3.exe
    "C:\Users\Admin\AppData\Local\Temp\506ad2ec7c9126aea6d7155353a2df5ef5336d1bfe1184a364cc4cf3539fa2f3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4335847.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4335847.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6355186.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6355186.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5010041.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5010041.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2994108.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2994108.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1324
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2340
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8577136.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8577136.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3348
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3156
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1372
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3996
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:1044
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:3280
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:N"
                    6⤵
                      PID:2764
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:4664
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:3540
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3704
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1467717.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1467717.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2116
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3040
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4616
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4632
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:756

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Scheduled Task

              1
              T1053

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              2
              T1112

              Disabling Security Tools

              1
              T1089

              Credential Access

              Credentials in Files

              1
              T1081

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              Collection

              Data from Local System

              1
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1467717.exe
                Filesize

                316KB

                MD5

                78f1c4f7839ed0202ab8bb31bca6a69a

                SHA1

                fc3e9edf57add9028fb5544a90068a9330155006

                SHA256

                d47e8bd3a0f6286a8eaa3041ae1c394fcab72b395bec88f2a0413478a8c490db

                SHA512

                5c476c7687357df28bc07dad8a2eff060a49a0e2c0e631dc26223ec4f2bb6e211995873aaa50d7617e1d78e90e94fe6143027185f9db83bbcc15fc6d8d2a5b22

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1467717.exe
                Filesize

                316KB

                MD5

                78f1c4f7839ed0202ab8bb31bca6a69a

                SHA1

                fc3e9edf57add9028fb5544a90068a9330155006

                SHA256

                d47e8bd3a0f6286a8eaa3041ae1c394fcab72b395bec88f2a0413478a8c490db

                SHA512

                5c476c7687357df28bc07dad8a2eff060a49a0e2c0e631dc26223ec4f2bb6e211995873aaa50d7617e1d78e90e94fe6143027185f9db83bbcc15fc6d8d2a5b22

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4335847.exe
                Filesize

                447KB

                MD5

                e22598b8eed2389d87261d85b5b8a1eb

                SHA1

                a426533b6865efe703cd05fb1ad96a6b5bdea31d

                SHA256

                a40e76c3cd1a723a7aab361a9a59b718e5b3f6b02dd477e6409495533af09eb2

                SHA512

                835ba0b453271cd06da839ee028dc22317398858cb4d3ae222f3b4887f3cd5a7c01320e111fb970f89c530f4e0539564b8905f6f619b0e371ba49f27e7f80825

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4335847.exe
                Filesize

                447KB

                MD5

                e22598b8eed2389d87261d85b5b8a1eb

                SHA1

                a426533b6865efe703cd05fb1ad96a6b5bdea31d

                SHA256

                a40e76c3cd1a723a7aab361a9a59b718e5b3f6b02dd477e6409495533af09eb2

                SHA512

                835ba0b453271cd06da839ee028dc22317398858cb4d3ae222f3b4887f3cd5a7c01320e111fb970f89c530f4e0539564b8905f6f619b0e371ba49f27e7f80825

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8577136.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8577136.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6355186.exe
                Filesize

                275KB

                MD5

                1795952cb6974d1abfea425bd7947ed1

                SHA1

                7da7217f13521b4d5b3e34dc68a23281980ab23d

                SHA256

                b56e266188fc389b6245a5e970c3944d62ca1ff2430377720af2ed3dc2515b7d

                SHA512

                f592b2c320be9b726e0ccdb3f6d447e1db18987ea13e5a34de4022da3058b6d2d33e89b5b8846138f36639a8e6991f91d2cf113547f09cb3fda41e376c13993c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6355186.exe
                Filesize

                275KB

                MD5

                1795952cb6974d1abfea425bd7947ed1

                SHA1

                7da7217f13521b4d5b3e34dc68a23281980ab23d

                SHA256

                b56e266188fc389b6245a5e970c3944d62ca1ff2430377720af2ed3dc2515b7d

                SHA512

                f592b2c320be9b726e0ccdb3f6d447e1db18987ea13e5a34de4022da3058b6d2d33e89b5b8846138f36639a8e6991f91d2cf113547f09cb3fda41e376c13993c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5010041.exe
                Filesize

                145KB

                MD5

                641ba1fb0ddcf9beed3445cf319256cb

                SHA1

                3d5e9d1135c7600fe7addc050c81f9cbb842a398

                SHA256

                fe655448f743995c79343f8796ba98271903622f91b2365f1c994e5b1739217d

                SHA512

                86659932336c8b3a7c933b077598960b8ff98b39ed1feeed9bbea6704b11d4b537abbf2da68095e16e1acd7a9d46b6f52d35e4530d8641039abc429136869c3f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5010041.exe
                Filesize

                145KB

                MD5

                641ba1fb0ddcf9beed3445cf319256cb

                SHA1

                3d5e9d1135c7600fe7addc050c81f9cbb842a398

                SHA256

                fe655448f743995c79343f8796ba98271903622f91b2365f1c994e5b1739217d

                SHA512

                86659932336c8b3a7c933b077598960b8ff98b39ed1feeed9bbea6704b11d4b537abbf2da68095e16e1acd7a9d46b6f52d35e4530d8641039abc429136869c3f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2994108.exe
                Filesize

                181KB

                MD5

                a8f9461d1117ab77ccd7f7fe34410ac2

                SHA1

                39bdd79b603a49e7b80f58c1fe6069836c6f6ef9

                SHA256

                cefd610b7f8ebef940303039b895ac35a3b119727a52ca662704e60566ca7f9b

                SHA512

                2b98efcd1e377970669cc2c69f6361c09f5f3564492c8d5cb78b497ad98d73834fea228e6ed2b0249983fdb7b824f21057930cf21eeb9fb98524045b25be020a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2994108.exe
                Filesize

                181KB

                MD5

                a8f9461d1117ab77ccd7f7fe34410ac2

                SHA1

                39bdd79b603a49e7b80f58c1fe6069836c6f6ef9

                SHA256

                cefd610b7f8ebef940303039b895ac35a3b119727a52ca662704e60566ca7f9b

                SHA512

                2b98efcd1e377970669cc2c69f6361c09f5f3564492c8d5cb78b497ad98d73834fea228e6ed2b0249983fdb7b824f21057930cf21eeb9fb98524045b25be020a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                Filesize

                206KB

                MD5

                422257d8919cc513585293875133491a

                SHA1

                280fab6b0d16a1d9dcf8da6f95458f4c9cd91631

                SHA256

                31ec903f41bbe3675f155bae992c8f3aa3001148ea76a63cb18935f16a9fd9a1

                SHA512

                7b2b1a1868d01a9d6b86a2c27ba5a3e71d7b8b2da9145d459c87ddaad4661bb5f74a7d4f4af8e152f57bd70b97b2140dcf7d7a44e62a77f0277a3651db3e250f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/2340-173-0x0000000000400000-0x000000000040A000-memory.dmp
                Filesize

                40KB

              • memory/3040-195-0x0000000000400000-0x000000000042A000-memory.dmp
                Filesize

                168KB

              • memory/3040-200-0x0000000005870000-0x0000000005880000-memory.dmp
                Filesize

                64KB

              • memory/4452-164-0x0000000005CC0000-0x0000000005D10000-memory.dmp
                Filesize

                320KB

              • memory/4452-160-0x0000000005D30000-0x00000000062D4000-memory.dmp
                Filesize

                5.6MB

              • memory/4452-167-0x0000000006CB0000-0x00000000071DC000-memory.dmp
                Filesize

                5.2MB

              • memory/4452-163-0x0000000005C40000-0x0000000005CB6000-memory.dmp
                Filesize

                472KB

              • memory/4452-162-0x00000000050D0000-0x0000000005136000-memory.dmp
                Filesize

                408KB

              • memory/4452-166-0x00000000065B0000-0x0000000006772000-memory.dmp
                Filesize

                1.8MB

              • memory/4452-161-0x0000000005780000-0x0000000005812000-memory.dmp
                Filesize

                584KB

              • memory/4452-165-0x0000000004F20000-0x0000000004F30000-memory.dmp
                Filesize

                64KB

              • memory/4452-159-0x0000000004C70000-0x0000000004CAC000-memory.dmp
                Filesize

                240KB

              • memory/4452-158-0x0000000004F20000-0x0000000004F30000-memory.dmp
                Filesize

                64KB

              • memory/4452-157-0x0000000004C10000-0x0000000004C22000-memory.dmp
                Filesize

                72KB

              • memory/4452-156-0x0000000004CE0000-0x0000000004DEA000-memory.dmp
                Filesize

                1.0MB

              • memory/4452-155-0x0000000005160000-0x0000000005778000-memory.dmp
                Filesize

                6.1MB

              • memory/4452-154-0x0000000000240000-0x000000000026A000-memory.dmp
                Filesize

                168KB