Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/10/2022, 04:32

221018-e51g6seeb8 10

18/10/2022, 04:06

221018-epj59aedd6 7

18/10/2022, 03:34

221018-d417mseefj 10

Analysis

  • max time kernel
    271s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/10/2022, 03:34

General

  • Target

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

  • Size

    521KB

  • MD5

    c0318aa61a314fed79c87be28f0db3ba

  • SHA1

    361e5206d2e0aeb88174c524e6c7cfb90c94670d

  • SHA256

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

  • SHA512

    619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586

  • SSDEEP

    12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe

Malware Config

Extracted

Family

redline

Botnet

BirjRo1

C2

79.137.197.136:23532

Attributes
  • auth_value

    278e5c62cf6a9bb4e0ab732b17b0368e

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies WinLogon 2 TTPs 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
    "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net user %username%
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\SysWOW64\net.exe
        net user Admin
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user Admin
          4⤵
            PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe Set-ExecutionPolicy bypass -Force
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Set-ExecutionPolicy bypass -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:376
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe C:\Windows\SvcManager\las.ps1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3624
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe C:\Windows\SvcManager\las.ps1
          3⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\SysWOW64\SecEdit.exe
            "C:\Windows\system32\SecEdit.exe" /export /cfg tempexport.inf
            4⤵
            • Drops file in Windows directory
            PID:2372
          • C:\Windows\SysWOW64\SecEdit.exe
            "C:\Windows\system32\SecEdit.exe" /import /db secedit.sdb /cfg .\tempimport.inf
            4⤵
              PID:200
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db secedit.sdb
              4⤵
                PID:3952
              • C:\Windows\SysWOW64\gpupdate.exe
                "C:\Windows\system32\gpupdate.exe" /force
                4⤵
                  PID:2592
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del /f C:\Windows\SvcManager\las.ps1
              2⤵
                PID:4328
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:4448
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\extra.exe
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4568
                  • C:\Users\Admin\AppData\Local\Temp\extra.exe
                    C:\Users\Admin\AppData\Local\Temp\\extra.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5076
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4172
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 1.1.1.1 -n 1 -w 3000
                    3⤵
                    • Runs ping.exe
                    PID:4528
              • C:\Windows\SvcManager\svcmgr.exe
                C:\Windows\SvcManager\svcmgr.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4556

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                13151583954f0def829054cc3eae25ec

                SHA1

                2a2b013e8d4201ddc8a80f9680931873702d0213

                SHA256

                eb542ae9c791940e8e74833eb50543dbbcbc8bf8485698fad82a8b079546c8a7

                SHA512

                3f7a6d0e5ca29de7b02f5cb993c508ce0c0df12c3d970a3ad6da95149b4cb5cc7a138e7ed6f83e910cb39120f199b3f74fc0ec1a14ca86435a52f247c2514aaf

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                15KB

                MD5

                07e0286ec094f7ea7802603d650838b6

                SHA1

                703980e0096c728ab501342b8bac81273d9c4fb8

                SHA256

                b2dcb659787376d41c30464131eedbaed0a1c878dc311a37c99ee986a69f0d80

                SHA512

                d747f78d87389f2f6baa6644da243f25050742ef1941310bd60dd7ea7bb70dd43e49e7532e4cab66ad16f2b9c5da0e17449a087334309f35955337f5cfe773fd

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                18KB

                MD5

                e5b17df920cb41523868f12d6ff1039b

                SHA1

                cac1060f88373aa12007d63458327c221d0f628e

                SHA256

                36c25723288815020afee9366ce44ec87a1bad2b8fcfa6691dd0d6633ad39253

                SHA512

                9aaa8bbaf49e1aceb5638d0ad29ac4dec2e5f563ef79376cddf5ce85843eb4789be42038e8f8de9b8235aeab575e4de308101d36568f5ed7489c071e52e195c1

              • C:\Users\Admin\AppData\Local\Temp\extra.exe

                Filesize

                137KB

                MD5

                0072395e192397b4f98bbb6852d1d495

                SHA1

                8246494746644b90380a4458e9248e7f3341ad8f

                SHA256

                f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c

                SHA512

                1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d

              • C:\Users\Admin\AppData\Local\Temp\extra.exe

                Filesize

                137KB

                MD5

                0072395e192397b4f98bbb6852d1d495

                SHA1

                8246494746644b90380a4458e9248e7f3341ad8f

                SHA256

                f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c

                SHA512

                1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d

              • C:\Windows\SvcManager\las.ps1

                Filesize

                1KB

                MD5

                9a6fbc01aa4147aa5aa91fca92ef6dfd

                SHA1

                f8b47020022626abef69f2032d22e89b95b994a8

                SHA256

                f63923ddc20574ca230a3b51bf7a6bf158a53f84494e2081071c3469abb068ca

                SHA512

                a80c89c1daa41d8c1f5c71ec06db7eaf6f686f4726ef5cce8d8854371fec4dfa88b4649ee7f78c59ff4f1f00a7296a917696a760228ce59206c09d3d7e954990

              • C:\Windows\SvcManager\svcmgr.exe

                Filesize

                788KB

                MD5

                621074969d8ccca5585201b6268e2faf

                SHA1

                252f556025ec03884edfd793da95179e31b055e5

                SHA256

                e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe

                SHA512

                0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a

              • C:\Windows\SvcManager\svcmgr.exe

                Filesize

                788KB

                MD5

                621074969d8ccca5585201b6268e2faf

                SHA1

                252f556025ec03884edfd793da95179e31b055e5

                SHA256

                e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe

                SHA512

                0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a

              • C:\Windows\SvcManager\tempexport.inf

                Filesize

                16KB

                MD5

                12521efd8145d438a53ae40ea56dca29

                SHA1

                cdf74522965a8d0b8ee74e1f49698fc334251a66

                SHA256

                621c13968a16a9280f14cea9e2577678af7129f6899615defebc08782eb8b756

                SHA512

                23086f47ce9cafcbe035d69a2bb3c86bed17029226e0b2a8ec33823d0515287f52a989cbc6aa6dd8fb7425dd6ddf0cd819c248a18d76de587839fb44404c2206

              • memory/376-694-0x0000000009A10000-0x0000000009A18000-memory.dmp

                Filesize

                32KB

              • memory/376-689-0x0000000009A20000-0x0000000009A3A000-memory.dmp

                Filesize

                104KB

              • memory/1324-265-0x0000000006B00000-0x0000000006B22000-memory.dmp

                Filesize

                136KB

              • memory/1324-268-0x0000000006BA0000-0x0000000006C06000-memory.dmp

                Filesize

                408KB

              • memory/1324-382-0x0000000008F00000-0x0000000008F1A000-memory.dmp

                Filesize

                104KB

              • memory/1324-303-0x0000000008DA0000-0x0000000008E45000-memory.dmp

                Filesize

                660KB

              • memory/1324-294-0x0000000008A40000-0x0000000008A5E000-memory.dmp

                Filesize

                120KB

              • memory/1324-293-0x0000000008C70000-0x0000000008CA3000-memory.dmp

                Filesize

                204KB

              • memory/1324-243-0x0000000000F70000-0x0000000000FA6000-memory.dmp

                Filesize

                216KB

              • memory/1324-248-0x0000000006C10000-0x0000000007238000-memory.dmp

                Filesize

                6.2MB

              • memory/1324-307-0x0000000008F60000-0x0000000008FF4000-memory.dmp

                Filesize

                592KB

              • memory/1324-278-0x0000000007C00000-0x0000000007C76000-memory.dmp

                Filesize

                472KB

              • memory/1324-269-0x0000000007420000-0x0000000007486000-memory.dmp

                Filesize

                408KB

              • memory/1324-270-0x00000000074E0000-0x0000000007830000-memory.dmp

                Filesize

                3.3MB

              • memory/1324-274-0x0000000007990000-0x00000000079DB000-memory.dmp

                Filesize

                300KB

              • memory/1324-273-0x0000000007300000-0x000000000731C000-memory.dmp

                Filesize

                112KB

              • memory/3064-182-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-190-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-189-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-188-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-187-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-186-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-185-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-184-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3064-183-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-146-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-148-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-147-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-281-0x00000000005E0000-0x000000000068E000-memory.dmp

                Filesize

                696KB

              • memory/3500-152-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-145-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-144-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-143-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-141-0x0000000002290000-0x0000000002331000-memory.dmp

                Filesize

                644KB

              • memory/3500-121-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-142-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-140-0x00000000005E0000-0x000000000068E000-memory.dmp

                Filesize

                696KB

              • memory/3500-139-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-138-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-137-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-136-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-311-0x0000000000400000-0x00000000005DF000-memory.dmp

                Filesize

                1.9MB

              • memory/3500-135-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-134-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-133-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-282-0x0000000002290000-0x0000000002331000-memory.dmp

                Filesize

                644KB

              • memory/3500-122-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-149-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-150-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-151-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-1056-0x0000000000400000-0x00000000005DF000-memory.dmp

                Filesize

                1.9MB

              • memory/3500-157-0x0000000000400000-0x00000000005DF000-memory.dmp

                Filesize

                1.9MB

              • memory/3500-123-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-120-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-153-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-132-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-131-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-130-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-129-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-128-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-126-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-125-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-124-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4424-155-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4424-156-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4424-158-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4424-160-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4424-159-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-164-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-168-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-174-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-173-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-172-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-171-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-169-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-163-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-170-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-177-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-180-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-162-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-175-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-179-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-167-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-178-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-166-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-176-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4464-165-0x00000000778E0000-0x0000000077A6E000-memory.dmp

                Filesize

                1.6MB

              • memory/4536-810-0x00000000094A0000-0x00000000094C2000-memory.dmp

                Filesize

                136KB

              • memory/4536-795-0x0000000008620000-0x000000000866B000-memory.dmp

                Filesize

                300KB

              • memory/4536-848-0x0000000007CE0000-0x0000000007CFE000-memory.dmp

                Filesize

                120KB

              • memory/4536-840-0x000000000A8A0000-0x000000000AF18000-memory.dmp

                Filesize

                6.5MB

              • memory/4536-811-0x0000000009D20000-0x000000000A21E000-memory.dmp

                Filesize

                5.0MB

              • memory/4536-792-0x0000000007EF0000-0x0000000008240000-memory.dmp

                Filesize

                3.3MB

              • memory/4556-953-0x0000020EA15F0000-0x0000020EA16BC000-memory.dmp

                Filesize

                816KB

              • memory/4556-980-0x0000020EBAA30000-0x0000020EBAAD6000-memory.dmp

                Filesize

                664KB

              • memory/4556-1009-0x0000020EBAB20000-0x0000020EBAB42000-memory.dmp

                Filesize

                136KB

              • memory/5076-1023-0x0000000005630000-0x0000000005642000-memory.dmp

                Filesize

                72KB

              • memory/5076-1025-0x0000000005690000-0x00000000056CE000-memory.dmp

                Filesize

                248KB

              • memory/5076-1027-0x0000000005820000-0x000000000586B000-memory.dmp

                Filesize

                300KB

              • memory/5076-1031-0x0000000005A20000-0x0000000005AB2000-memory.dmp

                Filesize

                584KB

              • memory/5076-1041-0x0000000006DD0000-0x0000000006F92000-memory.dmp

                Filesize

                1.8MB

              • memory/5076-1042-0x00000000074D0000-0x00000000079FC000-memory.dmp

                Filesize

                5.2MB

              • memory/5076-1046-0x00000000070A0000-0x00000000070F0000-memory.dmp

                Filesize

                320KB

              • memory/5076-1021-0x0000000005710000-0x000000000581A000-memory.dmp

                Filesize

                1.0MB

              • memory/5076-1020-0x0000000005BD0000-0x00000000061D6000-memory.dmp

                Filesize

                6.0MB

              • memory/5076-998-0x0000000000DF0000-0x0000000000E18000-memory.dmp

                Filesize

                160KB