Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2023, 23:27

General

  • Target

    file.exe

  • Size

    947KB

  • MD5

    b40d9b03ef2f86f28e697c3ae2f331fe

  • SHA1

    717f342f2b6801a1c73af4dddd08afc7855073cb

  • SHA256

    060ba349fa2c86e655ee127156d632715c328cfb4bb474ce02f8cfcc295281c2

  • SHA512

    c3a55f32265eb11c7eeaf5d6c1dacc02718f65a50fd4ce5863c7970e3bcaaf0ac75e6f3459c9fd1c6fb99928caf65c6788623ef1c5737f75ab10c639490f3c78

  • SSDEEP

    24576:QyaxB1V/7BR2sa5KLok12vmCeKfArLnptfYaRS/bOScvy3:Xaxz1dAsuNmwYrLn7t2Tc6

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Extracted

Family

redline

Botnet

cr10

C2

176.113.115.17:4132

Attributes
  • auth_value

    0a52a09c70a98bb6612362e5eb8b1d02

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gfK00XB.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gfK00XB.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4668
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gOk84lv.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gOk84lv.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gdF43xA.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gdF43xA.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anT73.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anT73.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4984
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bTJ10iN.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bTJ10iN.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4972
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\chK6946.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\chK6946.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4156
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 1560
            5⤵
            • Program crash
            PID:2808
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWP72qa.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWP72qa.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
          "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4224
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1584
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4172
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:N"
                6⤵
                  PID:4176
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:R" /E
                  6⤵
                    PID:4380
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3316
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4b9a106e76" /P "Admin:N"
                      6⤵
                        PID:4596
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\4b9a106e76" /P "Admin:R" /E
                        6⤵
                          PID:548
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:2260
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fTS7124.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fTS7124.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4900
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3576
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4156 -ip 4156
                1⤵
                  PID:1784
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1840
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4776

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fTS7124.exe

                  Filesize

                  265KB

                  MD5

                  b9eedd1c8b16c4481c3cadbe6ed97280

                  SHA1

                  6d44e5ced475bda87d1282b30ebc84bd25595e1f

                  SHA256

                  ceb59e6ddd127fcc56e7dca136002b8552290a954c92dd565706c4dc472bad17

                  SHA512

                  335b334750f8de4e366c7eb3ddc854a46b0d8cbd4d5479671131c9ce9a93fe679ae728b970b6ce3489a6863472bd2172870c6c8e4f1271234b23717a6dc957f1

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fTS7124.exe

                  Filesize

                  265KB

                  MD5

                  b9eedd1c8b16c4481c3cadbe6ed97280

                  SHA1

                  6d44e5ced475bda87d1282b30ebc84bd25595e1f

                  SHA256

                  ceb59e6ddd127fcc56e7dca136002b8552290a954c92dd565706c4dc472bad17

                  SHA512

                  335b334750f8de4e366c7eb3ddc854a46b0d8cbd4d5479671131c9ce9a93fe679ae728b970b6ce3489a6863472bd2172870c6c8e4f1271234b23717a6dc957f1

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gfK00XB.exe

                  Filesize

                  726KB

                  MD5

                  21e55ce0b1e59c920fd250378a1d2677

                  SHA1

                  69e5d4808d0191e26759c15227c028a1d8d449e7

                  SHA256

                  9c98cf6a70cbb283c17f79f252f445cf5c9196756f39a52dbc759a768d153f5e

                  SHA512

                  c0dca78e2b77c4fb720c9e80566ad0bc3c9db46d6546cb0d9602c7ac68f76387b9a91ba36e021583b35fa2080ef5bac3776fecf0bf2ff76cf1d5057fe342278d

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gfK00XB.exe

                  Filesize

                  726KB

                  MD5

                  21e55ce0b1e59c920fd250378a1d2677

                  SHA1

                  69e5d4808d0191e26759c15227c028a1d8d449e7

                  SHA256

                  9c98cf6a70cbb283c17f79f252f445cf5c9196756f39a52dbc759a768d153f5e

                  SHA512

                  c0dca78e2b77c4fb720c9e80566ad0bc3c9db46d6546cb0d9602c7ac68f76387b9a91ba36e021583b35fa2080ef5bac3776fecf0bf2ff76cf1d5057fe342278d

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWP72qa.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWP72qa.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gOk84lv.exe

                  Filesize

                  539KB

                  MD5

                  69d06471f0aaa4b3ce1872cc25838522

                  SHA1

                  880a3effd5a84cd297e6897ad646b7d408050ae8

                  SHA256

                  147831e98048057a87dd39e90ac2ebd4d4b4f3da4c96fead938389b9d51cb493

                  SHA512

                  1ad9e5341d51948de4000b682fa149f007d45a05b5643c3aa9e4187055b05f97d4f3ffb1fb357c00b2af5396c94b703575733e9bef8ac23f71dba4d9aee1f981

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gOk84lv.exe

                  Filesize

                  539KB

                  MD5

                  69d06471f0aaa4b3ce1872cc25838522

                  SHA1

                  880a3effd5a84cd297e6897ad646b7d408050ae8

                  SHA256

                  147831e98048057a87dd39e90ac2ebd4d4b4f3da4c96fead938389b9d51cb493

                  SHA512

                  1ad9e5341d51948de4000b682fa149f007d45a05b5643c3aa9e4187055b05f97d4f3ffb1fb357c00b2af5396c94b703575733e9bef8ac23f71dba4d9aee1f981

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\chK6946.exe

                  Filesize

                  315KB

                  MD5

                  f294797a611f6dee63a6fcad56fa3e5a

                  SHA1

                  b526f47e46b96c55059660891d1260ee0b51d5e7

                  SHA256

                  ee8c1327dd23846c9c6fdd9eb6930e7bc91b18c31a9291c01fa0e2a6dc462ff2

                  SHA512

                  15ca26c8bb2affac72d413973d5639ac045c73b1b49c5728a611b5d7624e8d19b0c2b42f24fddd23168da2c60b1b6452dc3454e9799c8c8c284a2ec05343e828

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\chK6946.exe

                  Filesize

                  315KB

                  MD5

                  f294797a611f6dee63a6fcad56fa3e5a

                  SHA1

                  b526f47e46b96c55059660891d1260ee0b51d5e7

                  SHA256

                  ee8c1327dd23846c9c6fdd9eb6930e7bc91b18c31a9291c01fa0e2a6dc462ff2

                  SHA512

                  15ca26c8bb2affac72d413973d5639ac045c73b1b49c5728a611b5d7624e8d19b0c2b42f24fddd23168da2c60b1b6452dc3454e9799c8c8c284a2ec05343e828

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gdF43xA.exe

                  Filesize

                  202KB

                  MD5

                  ec202f6cc948e22e70a1304c9f18e691

                  SHA1

                  44e042409589a35f8166df31e3f19d3a37343511

                  SHA256

                  002bf46393ac7f69f8199b8c5c482f18a902bb8e22ea3f888959ca500426e0eb

                  SHA512

                  f29ecfcb1f7350352f62e680f93c8d4e7fce8efe167fb056929fde33c7f5ac9ed414f93ce9cef7fb86f5a87830f258e0a6251bc91c39b14145921105a28b5365

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gdF43xA.exe

                  Filesize

                  202KB

                  MD5

                  ec202f6cc948e22e70a1304c9f18e691

                  SHA1

                  44e042409589a35f8166df31e3f19d3a37343511

                  SHA256

                  002bf46393ac7f69f8199b8c5c482f18a902bb8e22ea3f888959ca500426e0eb

                  SHA512

                  f29ecfcb1f7350352f62e680f93c8d4e7fce8efe167fb056929fde33c7f5ac9ed414f93ce9cef7fb86f5a87830f258e0a6251bc91c39b14145921105a28b5365

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anT73.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anT73.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bTJ10iN.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bTJ10iN.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • memory/3576-183-0x0000000000400000-0x0000000000432000-memory.dmp

                  Filesize

                  200KB

                • memory/4156-169-0x0000000000770000-0x000000000079F000-memory.dmp

                  Filesize

                  188KB

                • memory/4156-170-0x0000000000400000-0x0000000000583000-memory.dmp

                  Filesize

                  1.5MB

                • memory/4156-165-0x0000000000770000-0x000000000079F000-memory.dmp

                  Filesize

                  188KB

                • memory/4156-166-0x00000000006E0000-0x000000000072B000-memory.dmp

                  Filesize

                  300KB

                • memory/4156-167-0x0000000000400000-0x0000000000583000-memory.dmp

                  Filesize

                  1.5MB

                • memory/4156-168-0x0000000000770000-0x000000000079F000-memory.dmp

                  Filesize

                  188KB

                • memory/4972-154-0x0000000005020000-0x000000000505C000-memory.dmp

                  Filesize

                  240KB

                • memory/4972-150-0x00000000005E0000-0x0000000000612000-memory.dmp

                  Filesize

                  200KB

                • memory/4972-156-0x00000000063E0000-0x0000000006984000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4972-153-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

                  Filesize

                  72KB

                • memory/4972-152-0x0000000005080000-0x000000000518A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4972-151-0x0000000005500000-0x0000000005B18000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4972-157-0x0000000005F10000-0x0000000005FA2000-memory.dmp

                  Filesize

                  584KB

                • memory/4972-158-0x0000000006990000-0x0000000006B52000-memory.dmp

                  Filesize

                  1.8MB

                • memory/4972-159-0x0000000007090000-0x00000000075BC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/4972-155-0x0000000005320000-0x0000000005386000-memory.dmp

                  Filesize

                  408KB

                • memory/4972-160-0x0000000006180000-0x00000000061F6000-memory.dmp

                  Filesize

                  472KB

                • memory/4972-161-0x0000000006110000-0x0000000006160000-memory.dmp

                  Filesize

                  320KB

                • memory/4984-145-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4984-144-0x0000000000910000-0x000000000091A000-memory.dmp

                  Filesize

                  40KB

                • memory/4984-146-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                  Filesize

                  10.8MB