Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2023, 14:57

General

  • Target

    file.exe

  • Size

    947KB

  • MD5

    865fa96e8b70ace7764f8604ad9b413a

  • SHA1

    8ff4bf353f8cf95754f3d8ed0f0caa964b8952ce

  • SHA256

    b58cc2854f09e6fb3aa77751d34f78aeaf3f64f477e6605adfbf2c489b5d77fc

  • SHA512

    b9ec576ecaa0a61d8df1e367a537e00715e935a8caddfec6d069e860ef4977cd3e72f2fc2bce2aad274912d1df6b3a66d4496bd2315a297b7d8bfad3518bd3bc

  • SSDEEP

    24576:My8miUjjE24vW3NQMGlh4wvDcl4n4K0SHEnnQAcgZCg:7NHpE7lSwLcl1SHEN/Z

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Extracted

Family

redline

Botnet

ck

C2

176.113.115.17:4132

Attributes
  • auth_value

    7ac4424f89748eae7f5c6a4756d89c28

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gXa99ef.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gXa99ef.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gHl78RZ.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gHl78RZ.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gQM37RB.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gQM37RB.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3704
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\afV98.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\afV98.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:412
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bSt52Aj.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bSt52Aj.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2280
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cty1297.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cty1297.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1312
            5⤵
            • Program crash
            PID:2876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dRV29QF.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dRV29QF.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
          "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3340
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4092
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3476
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:1080
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "mnolyk.exe" /P "Admin:N"
                6⤵
                  PID:1444
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:R" /E
                  6⤵
                    PID:1996
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3448
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\4b9a106e76" /P "Admin:N"
                      6⤵
                        PID:2372
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\4b9a106e76" /P "Admin:R" /E
                        6⤵
                          PID:4420
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3740
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fUg4704.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fUg4704.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2960
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3076 -ip 3076
                1⤵
                  PID:2420
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3304
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1788

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fUg4704.exe

                  Filesize

                  252KB

                  MD5

                  5b4e241cbaecd4979c4253d244362901

                  SHA1

                  6930330a61ca122c08e7cee8084e051f5f04b10c

                  SHA256

                  d117e6c93943721d607fcee1d8b1992e2ac52b17baf0038e6e16c0364dc103fa

                  SHA512

                  311fa4cb3a8cf91aa3ef8da4ba1a8ca4c48cc2ccb01aaef16067d0fa93bbe2e060320acb18eca35bd6ec29c74bd43c658d4ae97e6e841477691e3e28d4a99ea5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fUg4704.exe

                  Filesize

                  252KB

                  MD5

                  5b4e241cbaecd4979c4253d244362901

                  SHA1

                  6930330a61ca122c08e7cee8084e051f5f04b10c

                  SHA256

                  d117e6c93943721d607fcee1d8b1992e2ac52b17baf0038e6e16c0364dc103fa

                  SHA512

                  311fa4cb3a8cf91aa3ef8da4ba1a8ca4c48cc2ccb01aaef16067d0fa93bbe2e060320acb18eca35bd6ec29c74bd43c658d4ae97e6e841477691e3e28d4a99ea5

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gXa99ef.exe

                  Filesize

                  743KB

                  MD5

                  9df396944db005f57733b204855f1759

                  SHA1

                  92f728f24783a9de54e5acd343705680901e451c

                  SHA256

                  250fa22f00dc8463b2492dded05e0af36d82b58637400f79e1464fecd74666bd

                  SHA512

                  d3aaf4f4d8333621ce3e5b60dcdfe4f587a25059deee0ffa80911510637e372bc2edce8e412adb307911f68b14ee73d9d1817b920126d1eb15a4200cf55b1e13

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gXa99ef.exe

                  Filesize

                  743KB

                  MD5

                  9df396944db005f57733b204855f1759

                  SHA1

                  92f728f24783a9de54e5acd343705680901e451c

                  SHA256

                  250fa22f00dc8463b2492dded05e0af36d82b58637400f79e1464fecd74666bd

                  SHA512

                  d3aaf4f4d8333621ce3e5b60dcdfe4f587a25059deee0ffa80911510637e372bc2edce8e412adb307911f68b14ee73d9d1817b920126d1eb15a4200cf55b1e13

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dRV29QF.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dRV29QF.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gHl78RZ.exe

                  Filesize

                  556KB

                  MD5

                  ea3b2044747159b567a3ac6acb38aae6

                  SHA1

                  912de51f1235c997fb67339f7d0fb3bab22341bd

                  SHA256

                  b24aec50f26ced488b33be6542f803dae7656f69708ec5bda041d7bcc6502cbf

                  SHA512

                  1e11838f82a98c9286b90d72e12b78bdba6867b1fc1935d46ebd53af3fec96ed7fe27452ee9b95b30896f07155704b554cf126bad9c6d939242387990135b53b

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gHl78RZ.exe

                  Filesize

                  556KB

                  MD5

                  ea3b2044747159b567a3ac6acb38aae6

                  SHA1

                  912de51f1235c997fb67339f7d0fb3bab22341bd

                  SHA256

                  b24aec50f26ced488b33be6542f803dae7656f69708ec5bda041d7bcc6502cbf

                  SHA512

                  1e11838f82a98c9286b90d72e12b78bdba6867b1fc1935d46ebd53af3fec96ed7fe27452ee9b95b30896f07155704b554cf126bad9c6d939242387990135b53b

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cty1297.exe

                  Filesize

                  352KB

                  MD5

                  dd858415b75360783fdc870c89eb958f

                  SHA1

                  b3af4e657c2a0e4e1110d38cfc930cd814a28a5f

                  SHA256

                  1cd184e3f9576e553ec992f0fc60a05d0aee6fd7f98bc5bf1484d796902b9674

                  SHA512

                  fb0f42f6498c13147b04aad01f9d42b6f6ce79864f061ada0dc71fff35f4810a6790b8adc361c9616e83e55d0013b5617ac446b6649f4bbb62848d520ecc5179

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cty1297.exe

                  Filesize

                  352KB

                  MD5

                  dd858415b75360783fdc870c89eb958f

                  SHA1

                  b3af4e657c2a0e4e1110d38cfc930cd814a28a5f

                  SHA256

                  1cd184e3f9576e553ec992f0fc60a05d0aee6fd7f98bc5bf1484d796902b9674

                  SHA512

                  fb0f42f6498c13147b04aad01f9d42b6f6ce79864f061ada0dc71fff35f4810a6790b8adc361c9616e83e55d0013b5617ac446b6649f4bbb62848d520ecc5179

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gQM37RB.exe

                  Filesize

                  202KB

                  MD5

                  95601bfc7523922b79621a0c4b171b0e

                  SHA1

                  0b863eb2c1931694782f1e2264368253f54363ec

                  SHA256

                  d645d6033c05179b7d47000a4aecb8534c2b646bfb26ec13efc7b15dd3179171

                  SHA512

                  280c5644860f7b561e344e3f7e1be49c39b47ce964463cba770f02f0beecde97d6fe748edaec7d833847a2fd25a2a0991076bfbe57c7371da1c7181b833a2e2f

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gQM37RB.exe

                  Filesize

                  202KB

                  MD5

                  95601bfc7523922b79621a0c4b171b0e

                  SHA1

                  0b863eb2c1931694782f1e2264368253f54363ec

                  SHA256

                  d645d6033c05179b7d47000a4aecb8534c2b646bfb26ec13efc7b15dd3179171

                  SHA512

                  280c5644860f7b561e344e3f7e1be49c39b47ce964463cba770f02f0beecde97d6fe748edaec7d833847a2fd25a2a0991076bfbe57c7371da1c7181b833a2e2f

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\afV98.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\afV98.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bSt52Aj.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bSt52Aj.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • memory/412-146-0x00007FF9C6FC0000-0x00007FF9C7A81000-memory.dmp

                  Filesize

                  10.8MB

                • memory/412-144-0x0000000000860000-0x000000000086A000-memory.dmp

                  Filesize

                  40KB

                • memory/412-145-0x00007FF9C6FC0000-0x00007FF9C7A81000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2280-161-0x0000000006E60000-0x000000000738C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/2280-158-0x0000000005EF0000-0x0000000005F66000-memory.dmp

                  Filesize

                  472KB

                • memory/2280-155-0x00000000052A0000-0x0000000005332000-memory.dmp

                  Filesize

                  584KB

                • memory/2280-154-0x0000000004F20000-0x0000000004F5C000-memory.dmp

                  Filesize

                  240KB

                • memory/2280-160-0x0000000006760000-0x0000000006922000-memory.dmp

                  Filesize

                  1.8MB

                • memory/2280-159-0x0000000005F70000-0x0000000005FC0000-memory.dmp

                  Filesize

                  320KB

                • memory/2280-153-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

                  Filesize

                  72KB

                • memory/2280-157-0x0000000005340000-0x00000000053A6000-memory.dmp

                  Filesize

                  408KB

                • memory/2280-152-0x0000000004F90000-0x000000000509A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/2280-151-0x0000000005410000-0x0000000005A28000-memory.dmp

                  Filesize

                  6.1MB

                • memory/2280-156-0x0000000005FE0000-0x0000000006584000-memory.dmp

                  Filesize

                  5.6MB

                • memory/2280-150-0x00000000004F0000-0x0000000000522000-memory.dmp

                  Filesize

                  200KB

                • memory/3076-166-0x0000000002230000-0x000000000227B000-memory.dmp

                  Filesize

                  300KB

                • memory/3076-169-0x00000000006D2000-0x0000000000700000-memory.dmp

                  Filesize

                  184KB

                • memory/3076-165-0x00000000006D2000-0x0000000000700000-memory.dmp

                  Filesize

                  184KB

                • memory/3076-170-0x0000000000400000-0x00000000005D4000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3076-167-0x0000000000400000-0x00000000005D4000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3076-168-0x00000000006D2000-0x0000000000700000-memory.dmp

                  Filesize

                  184KB

                • memory/3720-185-0x0000000000400000-0x0000000000432000-memory.dmp

                  Filesize

                  200KB