Analysis

  • max time kernel
    142s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/05/2023, 23:16

General

  • Target

    db3c6ed18cd2935f26d783a0b5c48f375e911762fdd92e86f326db21f2be2936.exe

  • Size

    770KB

  • MD5

    44b775aa2dbabc3f6d273c165550c35d

  • SHA1

    61c8eb74706f3d113a847fd1a478b1a024839853

  • SHA256

    db3c6ed18cd2935f26d783a0b5c48f375e911762fdd92e86f326db21f2be2936

  • SHA512

    424db8ffe5dbb8bf1449ab27aeabb67bae49f71d18faa41dd68d4c50723b7d5defc94f58476fbd9ecad1bb8310b633aa5c3965b84a33dde14b0560325afa3472

  • SSDEEP

    12288:8Mrwy90ZP3MqDG7dX1MJ+RBNHWReur0vy95akM+LCWbEiUkxaozMzg8TdAtTcWUX:8y2967e+RbkebS54+LGkxaPzCKWcGi

Malware Config

Extracted

Family

redline

Botnet

dura

C2

83.97.73.127:19062

Attributes
  • auth_value

    44b7d6fb9572dea0d64d018139c3d208

Extracted

Family

redline

Botnet

heroy

C2

83.97.73.127:19062

Attributes
  • auth_value

    b2879468e50d2d36e66f1a067d4a8bb3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db3c6ed18cd2935f26d783a0b5c48f375e911762fdd92e86f326db21f2be2936.exe
    "C:\Users\Admin\AppData\Local\Temp\db3c6ed18cd2935f26d783a0b5c48f375e911762fdd92e86f326db21f2be2936.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9815520.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9815520.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4722690.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4722690.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8569645.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8569645.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4256
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8228227.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8228227.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4480
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1404
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3421035.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3421035.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2740
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4656
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4516
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:3832
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:1924
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:N"
                    6⤵
                      PID:4404
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:3308
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:3296
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:2844
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7097651.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7097651.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3648
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3272
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1200
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1332
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:3264

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                957779c42144282d8cd83192b8fbc7cf

                SHA1

                de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

                SHA256

                0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

                SHA512

                f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7097651.exe

                Filesize

                327KB

                MD5

                1ce09c713f4952d4400e4cccf4e2d301

                SHA1

                a364f6ffbdd0778275a0996f93a39cf5f8ca4d85

                SHA256

                4708164a4de53fe29652a8125f01ca42368fec55ec7c8d2545e8ac8810461db6

                SHA512

                6c08c4acf152e2ba14a8a688be657f1dc3a24242d97db28664ff0612287ac1e03809c22eea49bf2358266ac8aa75b2d266ccdf43c6472ac1e6789de8ca8d9222

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7097651.exe

                Filesize

                327KB

                MD5

                1ce09c713f4952d4400e4cccf4e2d301

                SHA1

                a364f6ffbdd0778275a0996f93a39cf5f8ca4d85

                SHA256

                4708164a4de53fe29652a8125f01ca42368fec55ec7c8d2545e8ac8810461db6

                SHA512

                6c08c4acf152e2ba14a8a688be657f1dc3a24242d97db28664ff0612287ac1e03809c22eea49bf2358266ac8aa75b2d266ccdf43c6472ac1e6789de8ca8d9222

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9815520.exe

                Filesize

                451KB

                MD5

                2af2c534cbf94d970d571930324f499e

                SHA1

                2d28c6f5b5340e966e249601e82b53930bd7dc99

                SHA256

                881f2e3f9b3b173f1e4f384f89b25973ea59c7ea3a4a21bf56df5ab998756d45

                SHA512

                c878883f46262078f722b40ab555ca577062a0bc535e6410a12cf7e76f669833adf55fb93a4afd5c0a83fe1e0555d0677a3070125c7176fb1749f11a659dfa34

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9815520.exe

                Filesize

                451KB

                MD5

                2af2c534cbf94d970d571930324f499e

                SHA1

                2d28c6f5b5340e966e249601e82b53930bd7dc99

                SHA256

                881f2e3f9b3b173f1e4f384f89b25973ea59c7ea3a4a21bf56df5ab998756d45

                SHA512

                c878883f46262078f722b40ab555ca577062a0bc535e6410a12cf7e76f669833adf55fb93a4afd5c0a83fe1e0555d0677a3070125c7176fb1749f11a659dfa34

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3421035.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h3421035.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4722690.exe

                Filesize

                279KB

                MD5

                6f44d9ac577609266069338e91635a37

                SHA1

                e1e7ed64d121ef52b7106944c0f43b5661f5c183

                SHA256

                4103f9d9a36759b11981c37c9b49f298a7981e114c72c1c5b03bc950b480e434

                SHA512

                5d62fb0f25d8e1c9150ac76e77eb84f0a239fc29db0fcf0d9ddd6d1f3dcca9df3c0065116c56a4d7bf00d05d2e0a95aab5e42a817a353497f6512ca46febb2be

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4722690.exe

                Filesize

                279KB

                MD5

                6f44d9ac577609266069338e91635a37

                SHA1

                e1e7ed64d121ef52b7106944c0f43b5661f5c183

                SHA256

                4103f9d9a36759b11981c37c9b49f298a7981e114c72c1c5b03bc950b480e434

                SHA512

                5d62fb0f25d8e1c9150ac76e77eb84f0a239fc29db0fcf0d9ddd6d1f3dcca9df3c0065116c56a4d7bf00d05d2e0a95aab5e42a817a353497f6512ca46febb2be

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8569645.exe

                Filesize

                145KB

                MD5

                6ef47bc9f8b5d865b705ff405d660fc0

                SHA1

                5204550fad600a6870b535f7c95c791d10d9d6b9

                SHA256

                b6b0a183dfecc5d990241f618f3684f240fa7752e9cc7180e01235f327a2ecb0

                SHA512

                d0a65b1c9ecb9c8958c73c2b73153409c8623cf5e086c3bdb4d230dffbbb1dbebd2d0ddea6738fb5065d43d5f07b434960f1e0821672f449e38757965eb5a204

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f8569645.exe

                Filesize

                145KB

                MD5

                6ef47bc9f8b5d865b705ff405d660fc0

                SHA1

                5204550fad600a6870b535f7c95c791d10d9d6b9

                SHA256

                b6b0a183dfecc5d990241f618f3684f240fa7752e9cc7180e01235f327a2ecb0

                SHA512

                d0a65b1c9ecb9c8958c73c2b73153409c8623cf5e086c3bdb4d230dffbbb1dbebd2d0ddea6738fb5065d43d5f07b434960f1e0821672f449e38757965eb5a204

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8228227.exe

                Filesize

                192KB

                MD5

                8d7fe73c252239fab2a4b30f2f8a4a91

                SHA1

                3d0b4077e27e7dea8f0e68b28fed24ddcd260c6b

                SHA256

                fe7561a9956a2d12c268b1bd50a35751f46f7f21163f9677c8fea7721a67d50c

                SHA512

                94fc0f86bfc5e0d3cb50a205bb11cd5825711bd65e9ee1ea645c20d6b75cd6e87305bc15b517b059327f23b3c2db3a6a013e6b1848f0a1545ae5ac356a5caf28

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8228227.exe

                Filesize

                192KB

                MD5

                8d7fe73c252239fab2a4b30f2f8a4a91

                SHA1

                3d0b4077e27e7dea8f0e68b28fed24ddcd260c6b

                SHA256

                fe7561a9956a2d12c268b1bd50a35751f46f7f21163f9677c8fea7721a67d50c

                SHA512

                94fc0f86bfc5e0d3cb50a205bb11cd5825711bd65e9ee1ea645c20d6b75cd6e87305bc15b517b059327f23b3c2db3a6a013e6b1848f0a1545ae5ac356a5caf28

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                207KB

                MD5

                fa25612a22a7a6f9fd38a33bc4c05142

                SHA1

                3e78d196ed392ba467abff5bb89c1b7590e1fe77

                SHA256

                ec6fe996ea8f5ab117211e2ec86e01bd4c666904324ea1288dff92a52490d69f

                SHA512

                2a14fab638a7fd40cbcffb5010d5c702a99ce72c551505bd48bd8184c0dae64aef747018e9ed2a84f095445efabcd45d5e5d064393aec01ce03d75737c655df0

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • memory/1404-161-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB

              • memory/3272-183-0x0000000000400000-0x000000000042A000-memory.dmp

                Filesize

                168KB

              • memory/3272-191-0x0000000006820000-0x000000000686B000-memory.dmp

                Filesize

                300KB

              • memory/3272-200-0x0000000008FC0000-0x0000000008FD0000-memory.dmp

                Filesize

                64KB

              • memory/4256-145-0x0000000005710000-0x000000000574E000-memory.dmp

                Filesize

                248KB

              • memory/4256-155-0x0000000005700000-0x0000000005710000-memory.dmp

                Filesize

                64KB

              • memory/4256-154-0x0000000007070000-0x00000000070C0000-memory.dmp

                Filesize

                320KB

              • memory/4256-153-0x0000000006E00000-0x0000000006E76000-memory.dmp

                Filesize

                472KB

              • memory/4256-152-0x00000000075A0000-0x0000000007ACC000-memory.dmp

                Filesize

                5.2MB

              • memory/4256-151-0x0000000006EA0000-0x0000000007062000-memory.dmp

                Filesize

                1.8MB

              • memory/4256-150-0x0000000005AD0000-0x0000000005B36000-memory.dmp

                Filesize

                408KB

              • memory/4256-149-0x00000000066D0000-0x0000000006BCE000-memory.dmp

                Filesize

                5.0MB

              • memory/4256-148-0x0000000005A30000-0x0000000005AC2000-memory.dmp

                Filesize

                584KB

              • memory/4256-147-0x0000000005700000-0x0000000005710000-memory.dmp

                Filesize

                64KB

              • memory/4256-146-0x00000000056A0000-0x00000000056EB000-memory.dmp

                Filesize

                300KB

              • memory/4256-144-0x0000000005680000-0x0000000005692000-memory.dmp

                Filesize

                72KB

              • memory/4256-143-0x0000000005750000-0x000000000585A000-memory.dmp

                Filesize

                1.0MB

              • memory/4256-142-0x0000000005BC0000-0x00000000061C6000-memory.dmp

                Filesize

                6.0MB

              • memory/4256-141-0x0000000000E30000-0x0000000000E5A000-memory.dmp

                Filesize

                168KB