Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2023, 11:16

General

  • Target

    b2cc067782f33ea7dc6b3150c1a92ff91d90848fc5296ce3f92bb63d476828d1.exe

  • Size

    689KB

  • MD5

    dd9fbac73943cbd733f0223604ad732a

  • SHA1

    8970be4f08949398d8a1b94b91dc57d06bc26c52

  • SHA256

    b2cc067782f33ea7dc6b3150c1a92ff91d90848fc5296ce3f92bb63d476828d1

  • SHA512

    b196020a49a42da2022eadedd6eaaadb8a325479dccca6b859f19ca492877abd635a66fe672a3ba7f655811081f3bf2105da026271f151cfa7ba22fe2a92380d

  • SSDEEP

    12288:SMrHy90aitMHipRfPwmc7lyDgK6gfhdsRKux+djemxg8yNMCBKoJk:hy1ieipRnKlyDLfPsRKS+dj5m8iS

Malware Config

Extracted

Family

amadey

Version

3.68

C2

193.233.20.26/Do3m4Gor/index.php

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2cc067782f33ea7dc6b3150c1a92ff91d90848fc5296ce3f92bb63d476828d1.exe
    "C:\Users\Admin\AppData\Local\Temp\b2cc067782f33ea7dc6b3150c1a92ff91d90848fc5296ce3f92bb63d476828d1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zktm1668GP.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zktm1668GP.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkWV6791hi.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkWV6791hi.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knJQ00aH89.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knJQ00aH89.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1444
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1028
            5⤵
            • Program crash
            PID:3664
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljDC58Ss28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljDC58Ss28.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1400
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm31wU98hH67.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm31wU98hH67.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
          "C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ghaaer.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:1980
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "ghaaer.exe" /P "Admin:N"&&CACLS "ghaaer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3468
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "ghaaer.exe" /P "Admin:N"
                6⤵
                  PID:1868
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "ghaaer.exe" /P "Admin:R" /E
                  6⤵
                    PID:708
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:2064
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:N"
                      6⤵
                        PID:3216
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\5975271bda" /P "Admin:R" /E
                        6⤵
                          PID:3720
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4552
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdlV06sC20.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdlV06sC20.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1972
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1444 -ip 1444
                1⤵
                  PID:1116
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2136
                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4544

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\5975271bda\ghaaer.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdlV06sC20.exe

                  Filesize

                  175KB

                  MD5

                  e86e4af9ced5704c13498f1de7ce75d9

                  SHA1

                  e5c254a850eb4bec7aebac3ff1ff2e0d61aa4139

                  SHA256

                  3a8af10911fc350255d263d4523a9d0ce6880aabf252fe617ccff43e9aac0b91

                  SHA512

                  0e4a0368c30c87dfdd19f06554297ae14c0689c0d647eec0c15ed157dac4a816106904327c5abe37c93e1e8780b3ee0f2eb8a256531baca35cf174eaacd566c0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rdlV06sC20.exe

                  Filesize

                  175KB

                  MD5

                  e86e4af9ced5704c13498f1de7ce75d9

                  SHA1

                  e5c254a850eb4bec7aebac3ff1ff2e0d61aa4139

                  SHA256

                  3a8af10911fc350255d263d4523a9d0ce6880aabf252fe617ccff43e9aac0b91

                  SHA512

                  0e4a0368c30c87dfdd19f06554297ae14c0689c0d647eec0c15ed157dac4a816106904327c5abe37c93e1e8780b3ee0f2eb8a256531baca35cf174eaacd566c0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zktm1668GP.exe

                  Filesize

                  544KB

                  MD5

                  58e48c77aaadc2146c032d77e7ae00ad

                  SHA1

                  729bf98a332de5d712d5876d5ae402a4b419c2c9

                  SHA256

                  bcb4fbb8a5e864439e25387cce24e412d7243210a9f659d7033a7723d4472d09

                  SHA512

                  0634bd1f72276f87e65e5d0f28e3353e51cfa3a9f98dc6aed18159701b097a4dabcb870d3956c5eb44b8327d71e3dd8d3b263e0f55be930e46ff6325a54c28e0

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zktm1668GP.exe

                  Filesize

                  544KB

                  MD5

                  58e48c77aaadc2146c032d77e7ae00ad

                  SHA1

                  729bf98a332de5d712d5876d5ae402a4b419c2c9

                  SHA256

                  bcb4fbb8a5e864439e25387cce24e412d7243210a9f659d7033a7723d4472d09

                  SHA512

                  0634bd1f72276f87e65e5d0f28e3353e51cfa3a9f98dc6aed18159701b097a4dabcb870d3956c5eb44b8327d71e3dd8d3b263e0f55be930e46ff6325a54c28e0

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm31wU98hH67.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nm31wU98hH67.exe

                  Filesize

                  235KB

                  MD5

                  ac37b26719e17ef06e7eff1e80d80fad

                  SHA1

                  7027aea7add1fdbbe8da8d1f2929db974aea9d0b

                  SHA256

                  5260335d8eccfa3de42a0819ecd504b80c9cc8dad5bddbc7fd1e48763961133b

                  SHA512

                  f791a7c1af223bbcb7234e791b69796919abc0c2e220f746a52f151e2ae4e5a395aae0693324430efc069f2276ab82e43895ae8cc36103f1846a98a012bfcf0f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkWV6791hi.exe

                  Filesize

                  358KB

                  MD5

                  0acb4c091ec9384773405140a2ab6499

                  SHA1

                  d317611bdffcb6567002a0c2590b929d76ad525c

                  SHA256

                  a5b51503c4bf09df0097c03ec0729eefb5ee2545268ea7b831f74f766f31d2f0

                  SHA512

                  013687c4c46cae1e76c8dc7cc2ff12ac447d4e6e08fa40034ef9c47bfda2ea0a2aeba1fa0ad0a7b3b18cce53a85655c6f8479dc8f846404bbb17c9a7b4442c23

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zkWV6791hi.exe

                  Filesize

                  358KB

                  MD5

                  0acb4c091ec9384773405140a2ab6499

                  SHA1

                  d317611bdffcb6567002a0c2590b929d76ad525c

                  SHA256

                  a5b51503c4bf09df0097c03ec0729eefb5ee2545268ea7b831f74f766f31d2f0

                  SHA512

                  013687c4c46cae1e76c8dc7cc2ff12ac447d4e6e08fa40034ef9c47bfda2ea0a2aeba1fa0ad0a7b3b18cce53a85655c6f8479dc8f846404bbb17c9a7b4442c23

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knJQ00aH89.exe

                  Filesize

                  358KB

                  MD5

                  c9da6f940ecfe32dbf4f12d2cecd2564

                  SHA1

                  cc1f1177503abd384a04b93248045a97927efeec

                  SHA256

                  c1024ef9462a41aee181d761646a34f88bcb461371249dd566dc23a1cc680bcb

                  SHA512

                  6084cbbf5554e6e555f5f95b48e9113f8cafce9bc71c1498ce4048999063e1b5978c7de78787200119c5cffeaf4e0809b87e1a56c09a2e4044598ed10e22dc8c

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\knJQ00aH89.exe

                  Filesize

                  358KB

                  MD5

                  c9da6f940ecfe32dbf4f12d2cecd2564

                  SHA1

                  cc1f1177503abd384a04b93248045a97927efeec

                  SHA256

                  c1024ef9462a41aee181d761646a34f88bcb461371249dd566dc23a1cc680bcb

                  SHA512

                  6084cbbf5554e6e555f5f95b48e9113f8cafce9bc71c1498ce4048999063e1b5978c7de78787200119c5cffeaf4e0809b87e1a56c09a2e4044598ed10e22dc8c

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljDC58Ss28.exe

                  Filesize

                  11KB

                  MD5

                  b4fad69b4c4ea06898ff4ebe62a47774

                  SHA1

                  1e9ff57670b3c273f4f9ea5724069f45d9076466

                  SHA256

                  79e1e0f95060ab0ee3afb8d7b3b52a2ec7d4852e19f24aa4b62f136a612e8a00

                  SHA512

                  5c20ad4f9ea3cea367f1028075f6479e048ea245e5641934187df9815b40dab677ed8d27d15d263aeb0cbd4350d9210f54857f7934fa504f312aef26ce671530

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ljDC58Ss28.exe

                  Filesize

                  11KB

                  MD5

                  b4fad69b4c4ea06898ff4ebe62a47774

                  SHA1

                  1e9ff57670b3c273f4f9ea5724069f45d9076466

                  SHA256

                  79e1e0f95060ab0ee3afb8d7b3b52a2ec7d4852e19f24aa4b62f136a612e8a00

                  SHA512

                  5c20ad4f9ea3cea367f1028075f6479e048ea245e5641934187df9815b40dab677ed8d27d15d263aeb0cbd4350d9210f54857f7934fa504f312aef26ce671530

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  c1ddaca25d84d05e809ffce1d2b468b7

                  SHA1

                  38f257a264e657a20aa2fb3b48adb53c4bce5c8f

                  SHA256

                  cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd

                  SHA512

                  87fc6fc4aa53d4ba31da2802677599709cbd04556082cf3531e2c90659c23d5fa2210b658635f11f48b22d87e01c26bed5bf42f8139962441a3778754229f14e

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1400-196-0x0000000000F20000-0x0000000000F2A000-memory.dmp

                  Filesize

                  40KB

                • memory/1444-184-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-164-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-176-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-180-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-178-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-182-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-172-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-186-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-170-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-168-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-166-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-160-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-162-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-187-0x00000000072F0000-0x0000000007300000-memory.dmp

                  Filesize

                  64KB

                • memory/1444-188-0x0000000000400000-0x0000000002BC7000-memory.dmp

                  Filesize

                  39.8MB

                • memory/1444-189-0x00000000072F0000-0x0000000007300000-memory.dmp

                  Filesize

                  64KB

                • memory/1444-191-0x00000000072F0000-0x0000000007300000-memory.dmp

                  Filesize

                  64KB

                • memory/1444-192-0x0000000000400000-0x0000000002BC7000-memory.dmp

                  Filesize

                  39.8MB

                • memory/1444-155-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

                  Filesize

                  180KB

                • memory/1444-174-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1444-156-0x00000000072F0000-0x0000000007300000-memory.dmp

                  Filesize

                  64KB

                • memory/1444-157-0x00000000072F0000-0x0000000007300000-memory.dmp

                  Filesize

                  64KB

                • memory/1444-158-0x0000000007300000-0x00000000078A4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1444-159-0x0000000007270000-0x0000000007282000-memory.dmp

                  Filesize

                  72KB

                • memory/1972-214-0x0000000005A30000-0x0000000006048000-memory.dmp

                  Filesize

                  6.1MB

                • memory/1972-220-0x0000000006050000-0x00000000060B6000-memory.dmp

                  Filesize

                  408KB

                • memory/1972-221-0x0000000009150000-0x00000000091C6000-memory.dmp

                  Filesize

                  472KB

                • memory/1972-222-0x00000000091D0000-0x0000000009220000-memory.dmp

                  Filesize

                  320KB

                • memory/1972-223-0x00000000093F0000-0x00000000095B2000-memory.dmp

                  Filesize

                  1.8MB

                • memory/1972-224-0x0000000005860000-0x0000000005870000-memory.dmp

                  Filesize

                  64KB

                • memory/1972-225-0x0000000009AF0000-0x000000000A01C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/1972-219-0x0000000005870000-0x0000000005902000-memory.dmp

                  Filesize

                  584KB

                • memory/1972-218-0x0000000005860000-0x0000000005870000-memory.dmp

                  Filesize

                  64KB

                • memory/1972-217-0x0000000005530000-0x000000000556C000-memory.dmp

                  Filesize

                  240KB

                • memory/1972-216-0x00000000054D0000-0x00000000054E2000-memory.dmp

                  Filesize

                  72KB

                • memory/1972-215-0x00000000055A0000-0x00000000056AA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/1972-213-0x0000000000C30000-0x0000000000C62000-memory.dmp

                  Filesize

                  200KB