Analysis

  • max time kernel
    136s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-06-2023 15:19

General

  • Target

    cb4343ed979e946dde368ae2150406d6677de5b8a223f012ffb6376ef23c43a5.exe

  • Size

    600KB

  • MD5

    653c9d29ffc5e81ef2db5a40a1eba68d

  • SHA1

    1351c63cf44b69332ea7aa1feaf57523bbab82f9

  • SHA256

    cb4343ed979e946dde368ae2150406d6677de5b8a223f012ffb6376ef23c43a5

  • SHA512

    58d09bbd199fcd452b7370ad1694d722fb57ae7856348f9b2afd98dfb15e629915877db6daf22a3ce289dac6dd6fd74e3dc3ebea63e57649e1cc31f2a945dc26

  • SSDEEP

    12288:3MrZy90Uc9DuIBwVI4ieC7svMQSQJJEcJfWr3n06ssHruXKuuWK:iyFc17DveC7iJJEB3ruEZ

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb4343ed979e946dde368ae2150406d6677de5b8a223f012ffb6376ef23c43a5.exe
    "C:\Users\Admin\AppData\Local\Temp\cb4343ed979e946dde368ae2150406d6677de5b8a223f012ffb6376ef23c43a5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2091014.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2091014.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3195296.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3195296.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7375619.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7375619.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2396
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7215643.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7215643.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4464
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0270300.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0270300.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3856
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2580
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4232
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4452
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "lamod.exe" /P "Admin:N"
                6⤵
                  PID:4140
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "lamod.exe" /P "Admin:R" /E
                  6⤵
                    PID:4668
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:992
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:3320
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:1284
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:552
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6421131.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6421131.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2784
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2116
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 152
                    3⤵
                    • Program crash
                    PID:4944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2784 -ip 2784
                1⤵
                  PID:5080
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3348
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3036

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Execution

                Scheduled Task

                1
                T1053

                Persistence

                Modify Existing Service

                1
                T1031

                Registry Run Keys / Startup Folder

                1
                T1060

                Scheduled Task

                1
                T1053

                Privilege Escalation

                Scheduled Task

                1
                T1053

                Defense Evasion

                Modify Registry

                3
                T1112

                Disabling Security Tools

                2
                T1089

                Credential Access

                Credentials in Files

                2
                T1081

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Collection

                Data from Local System

                2
                T1005

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6421131.exe
                  Filesize

                  308KB

                  MD5

                  526fbe3350cdba2e5b84c42a1d475a02

                  SHA1

                  cada2497c578bade877df93ef345200b2fa137cc

                  SHA256

                  f3d3b4ee9aae5ca567a45df4cb5d7a69ec052eb5a69f8a8e83e15aab45c910a1

                  SHA512

                  752e24bd79f1e0257970aa4040f4fac7b6164cfccc025cb4c8c92368a8065e41ede701f1f9ec278e2ad687f72aeba3bf2344f72356d780b6256b4f259363ac1f

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6421131.exe
                  Filesize

                  308KB

                  MD5

                  526fbe3350cdba2e5b84c42a1d475a02

                  SHA1

                  cada2497c578bade877df93ef345200b2fa137cc

                  SHA256

                  f3d3b4ee9aae5ca567a45df4cb5d7a69ec052eb5a69f8a8e83e15aab45c910a1

                  SHA512

                  752e24bd79f1e0257970aa4040f4fac7b6164cfccc025cb4c8c92368a8065e41ede701f1f9ec278e2ad687f72aeba3bf2344f72356d780b6256b4f259363ac1f

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2091014.exe
                  Filesize

                  377KB

                  MD5

                  b6acee914f26982ed5e53925be551e2d

                  SHA1

                  79ddde43af61b6dba2f3396e901e6fb1257b4b72

                  SHA256

                  baa8c5ea3f7ea29282ae2ad134d16f05cc6b0ce62fcecef6f82543392bbc5e7e

                  SHA512

                  022d36c6aeef266fff0943b7330474b866c6461b81f334a680f6580ad1810e32791f3f85d01f909bfb13497db67d49bd7d215cae272cb5d264220a1dcf5ee675

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2091014.exe
                  Filesize

                  377KB

                  MD5

                  b6acee914f26982ed5e53925be551e2d

                  SHA1

                  79ddde43af61b6dba2f3396e901e6fb1257b4b72

                  SHA256

                  baa8c5ea3f7ea29282ae2ad134d16f05cc6b0ce62fcecef6f82543392bbc5e7e

                  SHA512

                  022d36c6aeef266fff0943b7330474b866c6461b81f334a680f6580ad1810e32791f3f85d01f909bfb13497db67d49bd7d215cae272cb5d264220a1dcf5ee675

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0270300.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0270300.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3195296.exe
                  Filesize

                  206KB

                  MD5

                  17910cf75bfda1ed60f1d81e2fdec1f0

                  SHA1

                  cd75165c1f26dc0fd6a80749b3cd461021643cda

                  SHA256

                  099624103965e0de5e81c33ca9b393a2ed436d2cc5d4aef74f112b3fe2a7ad4d

                  SHA512

                  ea2a6c7191880d5adc48a8f81765d8db97de68c0388a6211bb549c2ee9962f6d032180487e99dd0e896b3c79ecca17a989d28411b1c4b351fe781f6ed16243ac

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3195296.exe
                  Filesize

                  206KB

                  MD5

                  17910cf75bfda1ed60f1d81e2fdec1f0

                  SHA1

                  cd75165c1f26dc0fd6a80749b3cd461021643cda

                  SHA256

                  099624103965e0de5e81c33ca9b393a2ed436d2cc5d4aef74f112b3fe2a7ad4d

                  SHA512

                  ea2a6c7191880d5adc48a8f81765d8db97de68c0388a6211bb549c2ee9962f6d032180487e99dd0e896b3c79ecca17a989d28411b1c4b351fe781f6ed16243ac

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7375619.exe
                  Filesize

                  173KB

                  MD5

                  b9de62b3cf39ee425b5426ebcf221401

                  SHA1

                  972e460878e181390daec1b80571836c4143789d

                  SHA256

                  0ca13e63ec0e932fc179c8b2e4aecfcc1d04f515a3ad317c211265895ebb56ba

                  SHA512

                  45f30b26af1cf38c28f88bfcde1951a223593283cf764b26eff7ce1a23ed0bc467017cef61ed38d8f27a9a270c3afff497e120d7c4d59a9e6af10a602af87558

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7375619.exe
                  Filesize

                  173KB

                  MD5

                  b9de62b3cf39ee425b5426ebcf221401

                  SHA1

                  972e460878e181390daec1b80571836c4143789d

                  SHA256

                  0ca13e63ec0e932fc179c8b2e4aecfcc1d04f515a3ad317c211265895ebb56ba

                  SHA512

                  45f30b26af1cf38c28f88bfcde1951a223593283cf764b26eff7ce1a23ed0bc467017cef61ed38d8f27a9a270c3afff497e120d7c4d59a9e6af10a602af87558

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7215643.exe
                  Filesize

                  14KB

                  MD5

                  5e8067dc55b638a11eea1ee5c6796cab

                  SHA1

                  7fe44bd106b5985e927f40ed1f988362a214cdc0

                  SHA256

                  5e8bb787de4d442695d586843f72708fa3a670f58775f154325880d084d871b0

                  SHA512

                  9ef56fc6cb0d1de5ce475ac1aff6b6d38bbd3d8e7800046a13bb7d1177cacfda19449e4ef4fd703a63af013fdbb50ebc5a68aba593bc3245d5d3e61678fb92ee

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g7215643.exe
                  Filesize

                  14KB

                  MD5

                  5e8067dc55b638a11eea1ee5c6796cab

                  SHA1

                  7fe44bd106b5985e927f40ed1f988362a214cdc0

                  SHA256

                  5e8bb787de4d442695d586843f72708fa3a670f58775f154325880d084d871b0

                  SHA512

                  9ef56fc6cb0d1de5ce475ac1aff6b6d38bbd3d8e7800046a13bb7d1177cacfda19449e4ef4fd703a63af013fdbb50ebc5a68aba593bc3245d5d3e61678fb92ee

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  Filesize

                  208KB

                  MD5

                  135b22702a347368d08da0ba7dc3b307

                  SHA1

                  5fe0793289861eb976b10e3b1e2c809145f864b3

                  SHA256

                  c1df2a12094ba1ad6a1e46666be9ac71492da86a408d34eff7158ae344e235a5

                  SHA512

                  b91981780ef0768c1f3da92b42b8e664ccff3aee6a351d1b1104973c18e37f89c2237bfd4c3c3351e69195b6a967a81ec98b55664793d81ec999706f3176393a

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/2116-190-0x0000000000400000-0x0000000000430000-memory.dmp
                  Filesize

                  192KB

                • memory/2116-195-0x0000000005760000-0x0000000005770000-memory.dmp
                  Filesize

                  64KB

                • memory/2396-157-0x000000000A030000-0x000000000A042000-memory.dmp
                  Filesize

                  72KB

                • memory/2396-162-0x000000000A520000-0x000000000A586000-memory.dmp
                  Filesize

                  408KB

                • memory/2396-167-0x000000000B500000-0x000000000B550000-memory.dmp
                  Filesize

                  320KB

                • memory/2396-166-0x0000000004B70000-0x0000000004B80000-memory.dmp
                  Filesize

                  64KB

                • memory/2396-165-0x000000000C070000-0x000000000C59C000-memory.dmp
                  Filesize

                  5.2MB

                • memory/2396-164-0x000000000B2E0000-0x000000000B4A2000-memory.dmp
                  Filesize

                  1.8MB

                • memory/2396-163-0x000000000B590000-0x000000000BB34000-memory.dmp
                  Filesize

                  5.6MB

                • memory/2396-154-0x0000000000170000-0x00000000001A0000-memory.dmp
                  Filesize

                  192KB

                • memory/2396-161-0x000000000AC40000-0x000000000ACD2000-memory.dmp
                  Filesize

                  584KB

                • memory/2396-160-0x000000000A3A0000-0x000000000A416000-memory.dmp
                  Filesize

                  472KB

                • memory/2396-159-0x0000000004B70000-0x0000000004B80000-memory.dmp
                  Filesize

                  64KB

                • memory/2396-158-0x000000000A090000-0x000000000A0CC000-memory.dmp
                  Filesize

                  240KB

                • memory/2396-156-0x000000000A110000-0x000000000A21A000-memory.dmp
                  Filesize

                  1.0MB

                • memory/2396-155-0x000000000A620000-0x000000000AC38000-memory.dmp
                  Filesize

                  6.1MB

                • memory/4464-172-0x0000000000060000-0x000000000006A000-memory.dmp
                  Filesize

                  40KB