Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 11:24

General

  • Target

    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe

  • Size

    2.6MB

  • MD5

    55e393da1714013720ddf266c7906f43

  • SHA1

    91a636913604184c010c2d9e0b331a804a2c0ab4

  • SHA256

    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957

  • SHA512

    40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a

  • SSDEEP

    49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 13 IoCs
  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
    "C:\Users\Admin\AppData\Local\Temp\6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGsAcABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGkAcwAgAGMAbwBtAHAAdQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwB1AHAAcABvAHIAdABlAGQALAAgAHAAbABlAGEAcwBlACAAdAByAHkAIABhAGcAYQBpAG4AIABvAG4AIABhAG4AbwB0AGgAZQByACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB5AGMAYQAjAD4A"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4680
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAcAB5ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:548
    • C:\Users\Admin\AppData\Roaming\a.exe
      "C:\Users\Admin\AppData\Roaming\a.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3152
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4328
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:2656
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "TDFIYZSJ"
          3⤵
          • Launches sc.exe
          PID:4304
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "TDFIYZSJ" binpath= "C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:1624
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:2372
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "TDFIYZSJ"
          3⤵
          • Launches sc.exe
          PID:868
      • C:\Users\Admin\AppData\Roaming\b.exe
        "C:\Users\Admin\AppData\Roaming\b.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2496
    • C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
      C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          3⤵
            PID:4216
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          2⤵
            PID:3968
          • C:\Windows\system32\conhost.exe
            conhost.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1256

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Persistence

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Privilege Escalation

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Defense Evasion

        Impair Defenses

        1
        T1562

        Credential Access

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        Collection

        Data from Local System

        2
        T1005

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          17KB

          MD5

          30b6d10078bb24290061c157ad605aed

          SHA1

          d7e097a8cf744fea695c083ff747b5902b91a962

          SHA256

          c2eb455d0cd583a6db945f9b70f003cc9d32f4bb30ada49119c4a564b727d19e

          SHA512

          42c6e6924e40a20254e8b41cf28b5aa29c32bd823e88a9c7c1042cba8cde095fd24522588232548bde21fefba0b3cc1b157d8b873871e6150aaf8b1d54b49010

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2gn2zwz.bp5.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp660E.tmp
          Filesize

          46KB

          MD5

          02d2c46697e3714e49f46b680b9a6b83

          SHA1

          84f98b56d49f01e9b6b76a4e21accf64fd319140

          SHA256

          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

          SHA512

          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

        • C:\Users\Admin\AppData\Local\Temp\tmp6623.tmp
          Filesize

          92KB

          MD5

          17a7df30f13c3da857d658cacd4d32b5

          SHA1

          a7263013b088e677410d35f4cc4df02514cb898c

          SHA256

          c44cbdf2dbfb3ea10d471fa39c9b63e6e2fc00f1add109d51419b208a426f4d0

          SHA512

          ea96cc3e2a44d2adeca4ecb4b8875a808ef041a6a5b4ae77b6bfd1600dd31f449b51b1a5997064c43e5111861ac4e3bc40a55db6a39d6323c0b00ff26d113b72

        • C:\Users\Admin\AppData\Local\Temp\tmp663F.tmp
          Filesize

          48KB

          MD5

          349e6eb110e34a08924d92f6b334801d

          SHA1

          bdfb289daff51890cc71697b6322aa4b35ec9169

          SHA256

          c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

          SHA512

          2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

        • C:\Users\Admin\AppData\Local\Temp\tmp6645.tmp
          Filesize

          20KB

          MD5

          49693267e0adbcd119f9f5e02adf3a80

          SHA1

          3ba3d7f89b8ad195ca82c92737e960e1f2b349df

          SHA256

          d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

          SHA512

          b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

        • C:\Users\Admin\AppData\Local\Temp\tmp665B.tmp
          Filesize

          116KB

          MD5

          f70aa3fa04f0536280f872ad17973c3d

          SHA1

          50a7b889329a92de1b272d0ecf5fce87395d3123

          SHA256

          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

          SHA512

          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

        • C:\Users\Admin\AppData\Local\Temp\tmp6676.tmp
          Filesize

          96KB

          MD5

          d367ddfda80fdcf578726bc3b0bc3e3c

          SHA1

          23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

          SHA256

          0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

          SHA512

          40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

        • C:\Users\Admin\AppData\Roaming\a.exe
          Filesize

          2.5MB

          MD5

          6fd62e635b39a02ba8cac6fc124c9475

          SHA1

          e13080b9cc546e44a9f1c419ba86aeb190a14b2d

          SHA256

          78b9d7e485026278b02a1961999ad99cdfa988fbf4403767db5d10d1473e9870

          SHA512

          e77432582e6abcc0fd86ed997c9c4619bd67a044d33a752e1cf3ceb8008cea27c540949183b80f9dee8a41614cff54afe79c5db294efcb72b27685fcf1010cdc

        • C:\Users\Admin\AppData\Roaming\b.exe
          Filesize

          95KB

          MD5

          184ac479b3a878e9ac5535770ca34a2b

          SHA1

          1f99039911cc2cfd1a62ce348429ddd0f4435a60

          SHA256

          8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c

          SHA512

          e0f5185ae890b902ea5325066df23959106712e7990e120a1b9752bbd0331cac968af5ddd6092f75a1c576d4c83f4093dfbf53a2c90870d1c02b31a0e8282bb4

        • memory/548-71-0x0000000004AE0000-0x0000000004AF0000-memory.dmp
          Filesize

          64KB

        • memory/548-77-0x00000000072E0000-0x00000000072EA000-memory.dmp
          Filesize

          40KB

        • memory/548-25-0x0000000004AE0000-0x0000000004AF0000-memory.dmp
          Filesize

          64KB

        • memory/548-78-0x0000000007500000-0x0000000007596000-memory.dmp
          Filesize

          600KB

        • memory/548-19-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/548-34-0x00000000057C0000-0x0000000005826000-memory.dmp
          Filesize

          408KB

        • memory/548-24-0x0000000004AE0000-0x0000000004AF0000-memory.dmp
          Filesize

          64KB

        • memory/548-86-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/548-83-0x00000000074F0000-0x00000000074F8000-memory.dmp
          Filesize

          32KB

        • memory/548-82-0x00000000075A0000-0x00000000075BA000-memory.dmp
          Filesize

          104KB

        • memory/548-81-0x00000000074C0000-0x00000000074D4000-memory.dmp
          Filesize

          80KB

        • memory/548-80-0x00000000074B0000-0x00000000074BE000-memory.dmp
          Filesize

          56KB

        • memory/548-57-0x0000000005F10000-0x0000000005F2E000-memory.dmp
          Filesize

          120KB

        • memory/548-70-0x0000000006500000-0x000000000651E000-memory.dmp
          Filesize

          120KB

        • memory/548-79-0x0000000007470000-0x0000000007481000-memory.dmp
          Filesize

          68KB

        • memory/548-60-0x0000000074580000-0x00000000745CC000-memory.dmp
          Filesize

          304KB

        • memory/548-59-0x000000007F460000-0x000000007F470000-memory.dmp
          Filesize

          64KB

        • memory/548-58-0x0000000006EF0000-0x0000000006F22000-memory.dmp
          Filesize

          200KB

        • memory/548-72-0x0000000007130000-0x00000000071D3000-memory.dmp
          Filesize

          652KB

        • memory/1256-365-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-356-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-374-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-376-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-375-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-373-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-369-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-368-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-355-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-357-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-367-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-366-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-359-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-364-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-363-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-360-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-362-0x000002698FB20000-0x000002698FB40000-memory.dmp
          Filesize

          128KB

        • memory/1256-361-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/1256-358-0x0000000140000000-0x0000000140848000-memory.dmp
          Filesize

          8.3MB

        • memory/2496-94-0x0000000007390000-0x00000000073AE000-memory.dmp
          Filesize

          120KB

        • memory/2496-324-0x0000000005750000-0x0000000005760000-memory.dmp
          Filesize

          64KB

        • memory/2496-40-0x00000000056E0000-0x000000000572C000-memory.dmp
          Filesize

          304KB

        • memory/2496-28-0x00000000056C0000-0x00000000056D2000-memory.dmp
          Filesize

          72KB

        • memory/2496-56-0x00000000059D0000-0x0000000005ADA000-memory.dmp
          Filesize

          1.0MB

        • memory/2496-27-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/2496-45-0x0000000005750000-0x0000000005760000-memory.dmp
          Filesize

          64KB

        • memory/2496-22-0x0000000000E40000-0x0000000000E5E000-memory.dmp
          Filesize

          120KB

        • memory/2496-30-0x0000000005760000-0x000000000579C000-memory.dmp
          Filesize

          240KB

        • memory/2496-26-0x0000000005D80000-0x0000000006398000-memory.dmp
          Filesize

          6.1MB

        • memory/2496-91-0x0000000006CB0000-0x0000000006E72000-memory.dmp
          Filesize

          1.8MB

        • memory/2496-92-0x00000000073B0000-0x00000000078DC000-memory.dmp
          Filesize

          5.2MB

        • memory/2496-93-0x0000000007200000-0x0000000007276000-memory.dmp
          Filesize

          472KB

        • memory/2496-294-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/3968-350-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3968-348-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3968-349-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3968-347-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3968-354-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/3968-351-0x0000000140000000-0x000000014000E000-memory.dmp
          Filesize

          56KB

        • memory/4328-304-0x0000019AE8DF0000-0x0000019AE8E00000-memory.dmp
          Filesize

          64KB

        • memory/4328-293-0x0000019AEAE70000-0x0000019AEAE92000-memory.dmp
          Filesize

          136KB

        • memory/4328-303-0x00007FFC86A60000-0x00007FFC87521000-memory.dmp
          Filesize

          10.8MB

        • memory/4328-308-0x00007FFC86A60000-0x00007FFC87521000-memory.dmp
          Filesize

          10.8MB

        • memory/4328-305-0x0000019AE8DF0000-0x0000019AE8E00000-memory.dmp
          Filesize

          64KB

        • memory/4680-32-0x0000000005170000-0x0000000005192000-memory.dmp
          Filesize

          136KB

        • memory/4680-18-0x0000000004CB0000-0x0000000004CE6000-memory.dmp
          Filesize

          216KB

        • memory/4680-75-0x00000000084A0000-0x0000000008A44000-memory.dmp
          Filesize

          5.6MB

        • memory/4680-73-0x0000000007870000-0x0000000007EEA000-memory.dmp
          Filesize

          6.5MB

        • memory/4680-31-0x0000000004CA0000-0x0000000004CB0000-memory.dmp
          Filesize

          64KB

        • memory/4680-29-0x0000000004CA0000-0x0000000004CB0000-memory.dmp
          Filesize

          64KB

        • memory/4680-90-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/4680-23-0x0000000005320000-0x0000000005948000-memory.dmp
          Filesize

          6.2MB

        • memory/4680-76-0x00000000073F0000-0x0000000007482000-memory.dmp
          Filesize

          584KB

        • memory/4680-33-0x0000000005950000-0x00000000059B6000-memory.dmp
          Filesize

          408KB

        • memory/4680-46-0x0000000005C20000-0x0000000005F74000-memory.dmp
          Filesize

          3.3MB

        • memory/4680-74-0x00000000066B0000-0x00000000066CA000-memory.dmp
          Filesize

          104KB

        • memory/4680-21-0x0000000073AE0000-0x0000000074290000-memory.dmp
          Filesize

          7.7MB

        • memory/4792-343-0x000002862E3B0000-0x000002862E3C0000-memory.dmp
          Filesize

          64KB

        • memory/4792-342-0x0000028649010000-0x000002864901A000-memory.dmp
          Filesize

          40KB

        • memory/4792-341-0x0000028649000000-0x0000028649006000-memory.dmp
          Filesize

          24KB

        • memory/4792-340-0x0000028648FD0000-0x0000028648FD8000-memory.dmp
          Filesize

          32KB

        • memory/4792-338-0x0000028648FC0000-0x0000028648FCA000-memory.dmp
          Filesize

          40KB

        • memory/4792-339-0x0000028649020000-0x000002864903A000-memory.dmp
          Filesize

          104KB

        • memory/4792-337-0x0000028648FE0000-0x0000028648FFC000-memory.dmp
          Filesize

          112KB

        • memory/4792-323-0x000002862E3B0000-0x000002862E3C0000-memory.dmp
          Filesize

          64KB

        • memory/4792-335-0x0000028648DC0000-0x0000028648E75000-memory.dmp
          Filesize

          724KB

        • memory/4792-334-0x0000028648DA0000-0x0000028648DBC000-memory.dmp
          Filesize

          112KB

        • memory/4792-336-0x0000028648D90000-0x0000028648D9A000-memory.dmp
          Filesize

          40KB

        • memory/4792-321-0x00007FFC86A60000-0x00007FFC87521000-memory.dmp
          Filesize

          10.8MB

        • memory/4792-322-0x000002862E3B0000-0x000002862E3C0000-memory.dmp
          Filesize

          64KB