Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2023, 15:44

General

  • Target

    file.exe

  • Size

    947KB

  • MD5

    07aceb643148c310649a59986c371b69

  • SHA1

    a0dbd629d23599209fb63225565a079ae2f85d45

  • SHA256

    4836a762fed220414052b6dad1bbc50bd12662396f861bc70cb47098bb878b99

  • SHA512

    1c72b12b4f1bbd12775f537921b6589951754f7f565c8b90cae85d694b0b6b8d84728eedeb4521c7ecb57d0a9cf0915b613849f2092f5282c05084c5dcaa52ce

  • SSDEEP

    24576:pyuGpjfklPPpdXUWohUJ3Fw6YuHPmndcxdi39/vEe02Rye:cukfklHLMCquHPmnsQv9zRy

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Extracted

Family

redline

Botnet

ck

C2

176.113.115.17:4132

Attributes
  • auth_value

    7ac4424f89748eae7f5c6a4756d89c28

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\git76IQ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\git76IQ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ggc05UY.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ggc05UY.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gEl31fI.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gEl31fI.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ayJ07.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ayJ07.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5024
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bHG83uX.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bHG83uX.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3520
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cmV0226.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cmV0226.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:792
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 1324
            5⤵
            • Program crash
            PID:4160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\daU15JX.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\daU15JX.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:204
        • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
          "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1388
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:5052
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:N"
                6⤵
                  PID:4204
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:R" /E
                  6⤵
                    PID:4616
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3796
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4b9a106e76" /P "Admin:N"
                      6⤵
                        PID:4288
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\4b9a106e76" /P "Admin:R" /E
                        6⤵
                          PID:2292
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4172
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fkP1927.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fkP1927.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1916
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1208
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 792 -ip 792
                1⤵
                  PID:4400
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3728
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3868

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fkP1927.exe

                  Filesize

                  252KB

                  MD5

                  5b4e241cbaecd4979c4253d244362901

                  SHA1

                  6930330a61ca122c08e7cee8084e051f5f04b10c

                  SHA256

                  d117e6c93943721d607fcee1d8b1992e2ac52b17baf0038e6e16c0364dc103fa

                  SHA512

                  311fa4cb3a8cf91aa3ef8da4ba1a8ca4c48cc2ccb01aaef16067d0fa93bbe2e060320acb18eca35bd6ec29c74bd43c658d4ae97e6e841477691e3e28d4a99ea5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fkP1927.exe

                  Filesize

                  252KB

                  MD5

                  5b4e241cbaecd4979c4253d244362901

                  SHA1

                  6930330a61ca122c08e7cee8084e051f5f04b10c

                  SHA256

                  d117e6c93943721d607fcee1d8b1992e2ac52b17baf0038e6e16c0364dc103fa

                  SHA512

                  311fa4cb3a8cf91aa3ef8da4ba1a8ca4c48cc2ccb01aaef16067d0fa93bbe2e060320acb18eca35bd6ec29c74bd43c658d4ae97e6e841477691e3e28d4a99ea5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\git76IQ.exe

                  Filesize

                  743KB

                  MD5

                  8e9a117ff8e030acc8d2d1bbdaace083

                  SHA1

                  019cdc288fc311db598d842aa49e707b7ebc9854

                  SHA256

                  9fd25076a85bbcf0729d154610aab398923700cc3699485bb6ed1a07ed1939e9

                  SHA512

                  aa7ce9b1a6ea55c5d83502b32a417bbce016a000f26e56852207c5a2f7e00abe86db3c5b0098b62abbbcf22f5a58389f9074b7bb8131429076539cb25b064591

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\git76IQ.exe

                  Filesize

                  743KB

                  MD5

                  8e9a117ff8e030acc8d2d1bbdaace083

                  SHA1

                  019cdc288fc311db598d842aa49e707b7ebc9854

                  SHA256

                  9fd25076a85bbcf0729d154610aab398923700cc3699485bb6ed1a07ed1939e9

                  SHA512

                  aa7ce9b1a6ea55c5d83502b32a417bbce016a000f26e56852207c5a2f7e00abe86db3c5b0098b62abbbcf22f5a58389f9074b7bb8131429076539cb25b064591

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\daU15JX.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\daU15JX.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ggc05UY.exe

                  Filesize

                  556KB

                  MD5

                  db341e3e8756c14bb221379c5e8a995b

                  SHA1

                  8c9db26eed11442f53b7c61f5e6fc87cffa219eb

                  SHA256

                  a14b0014c683c6e6cbede4cbb13bdbb301b2fea94dba3a46504ecd51d6e6328b

                  SHA512

                  307abca1fa1a299b7d74ed7adc440c95a1256224c1b4df3cf5beaea0114c26bc87e7dcb3bd8ae6c6a54313487b8e7edb4f23537604cf260dd24b32936e8c80f4

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ggc05UY.exe

                  Filesize

                  556KB

                  MD5

                  db341e3e8756c14bb221379c5e8a995b

                  SHA1

                  8c9db26eed11442f53b7c61f5e6fc87cffa219eb

                  SHA256

                  a14b0014c683c6e6cbede4cbb13bdbb301b2fea94dba3a46504ecd51d6e6328b

                  SHA512

                  307abca1fa1a299b7d74ed7adc440c95a1256224c1b4df3cf5beaea0114c26bc87e7dcb3bd8ae6c6a54313487b8e7edb4f23537604cf260dd24b32936e8c80f4

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cmV0226.exe

                  Filesize

                  352KB

                  MD5

                  3c6eb15e40eaa09b88ebacad5f92a588

                  SHA1

                  851b5b722ae3c18c82471125d5d492989b1b6d56

                  SHA256

                  cc695bd0ddafc3c63f5037002132855008378ad39b0097876a4205f8babe50fe

                  SHA512

                  c52117cd8b024bf07135045e077bad1a1287864db06bfd73e128477ce0008949b741f5c16055e9f65aef21741c90352ef034863cdc7561f52d9e71891b8ecedc

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cmV0226.exe

                  Filesize

                  352KB

                  MD5

                  3c6eb15e40eaa09b88ebacad5f92a588

                  SHA1

                  851b5b722ae3c18c82471125d5d492989b1b6d56

                  SHA256

                  cc695bd0ddafc3c63f5037002132855008378ad39b0097876a4205f8babe50fe

                  SHA512

                  c52117cd8b024bf07135045e077bad1a1287864db06bfd73e128477ce0008949b741f5c16055e9f65aef21741c90352ef034863cdc7561f52d9e71891b8ecedc

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gEl31fI.exe

                  Filesize

                  202KB

                  MD5

                  ffb9401099a6f9e47a312553a0700c0e

                  SHA1

                  a796fca9860eac094e07501c3d1732d23043f305

                  SHA256

                  9543fa5e50c1048c7ebcfdea78972864f37f71184c4d26f8e8fa966c26c65436

                  SHA512

                  96c54feb8402b98c7b49d152ffd1d1bbcd4a725c7d41eb1e6dff7d3f345a2a5a7d8c012f41a8eabf20369017a49f5957e19e2ca8f415b58dfb219d990b2c943e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gEl31fI.exe

                  Filesize

                  202KB

                  MD5

                  ffb9401099a6f9e47a312553a0700c0e

                  SHA1

                  a796fca9860eac094e07501c3d1732d23043f305

                  SHA256

                  9543fa5e50c1048c7ebcfdea78972864f37f71184c4d26f8e8fa966c26c65436

                  SHA512

                  96c54feb8402b98c7b49d152ffd1d1bbcd4a725c7d41eb1e6dff7d3f345a2a5a7d8c012f41a8eabf20369017a49f5957e19e2ca8f415b58dfb219d990b2c943e

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ayJ07.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ayJ07.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bHG83uX.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bHG83uX.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • memory/792-165-0x0000000000744000-0x0000000000772000-memory.dmp

                  Filesize

                  184KB

                • memory/792-170-0x0000000000400000-0x00000000005D4000-memory.dmp

                  Filesize

                  1.8MB

                • memory/792-169-0x0000000000744000-0x0000000000772000-memory.dmp

                  Filesize

                  184KB

                • memory/792-168-0x0000000000744000-0x0000000000772000-memory.dmp

                  Filesize

                  184KB

                • memory/792-167-0x0000000000400000-0x00000000005D4000-memory.dmp

                  Filesize

                  1.8MB

                • memory/792-166-0x0000000002200000-0x000000000224B000-memory.dmp

                  Filesize

                  300KB

                • memory/1208-183-0x0000000000400000-0x0000000000432000-memory.dmp

                  Filesize

                  200KB

                • memory/3520-152-0x00000000059B0000-0x0000000005ABA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3520-157-0x0000000005D90000-0x0000000005DF6000-memory.dmp

                  Filesize

                  408KB

                • memory/3520-158-0x0000000007030000-0x00000000070A6000-memory.dmp

                  Filesize

                  472KB

                • memory/3520-151-0x0000000005E30000-0x0000000006448000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3520-150-0x0000000000F10000-0x0000000000F42000-memory.dmp

                  Filesize

                  200KB

                • memory/3520-159-0x0000000006FB0000-0x0000000007000000-memory.dmp

                  Filesize

                  320KB

                • memory/3520-160-0x0000000007280000-0x0000000007442000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3520-161-0x0000000007980000-0x0000000007EAC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3520-154-0x0000000005950000-0x000000000598C000-memory.dmp

                  Filesize

                  240KB

                • memory/3520-156-0x0000000006450000-0x00000000064E2000-memory.dmp

                  Filesize

                  584KB

                • memory/3520-155-0x0000000006A00000-0x0000000006FA4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3520-153-0x00000000058F0000-0x0000000005902000-memory.dmp

                  Filesize

                  72KB

                • memory/5024-144-0x0000000000740000-0x000000000074A000-memory.dmp

                  Filesize

                  40KB

                • memory/5024-145-0x00007FFC57A30000-0x00007FFC584F1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/5024-146-0x00007FFC57A30000-0x00007FFC584F1000-memory.dmp

                  Filesize

                  10.8MB