Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2023, 18:39

General

  • Target

    d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe

  • Size

    867KB

  • MD5

    08fb8213523b037d030d043e358603fa

  • SHA1

    9188463260116c8d6542c34264d009fffb4939a2

  • SHA256

    d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323

  • SHA512

    c7da520e4cfed63979ecd52ff7851926847aeb539b2cb1fe10fd467234de2a85bc266fdaa5fdfea19236f603d2c061c9256eccbfec64c32fb3996208933a0321

  • SSDEEP

    24576:gyOSBDwYbtFDhw69HgIk9Hn2w2RRnNtgZnQSjhQh:n70YblPHgr9H2ZRRnY2Sj

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe
    "C:\Users\Admin\AppData\Local\Temp\d68bca2bccb7f4fed32ea113bfafcba3ab4848f84e89a6260c38f7fdc9640323.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1824
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe

    Filesize

    577KB

    MD5

    6f5292fc176a7f5c40cebfe6988f4523

    SHA1

    294b6e47e6f9ce47093b51d90fdde5b18037155e

    SHA256

    3c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e

    SHA512

    946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe

    Filesize

    577KB

    MD5

    6f5292fc176a7f5c40cebfe6988f4523

    SHA1

    294b6e47e6f9ce47093b51d90fdde5b18037155e

    SHA256

    3c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e

    SHA512

    946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe

    Filesize

    172KB

    MD5

    85a51ce72ae111efa7768eed479edf90

    SHA1

    0a0e03711c9ea219356d4e40e9b21282b97288bd

    SHA256

    14982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5

    SHA512

    24cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe

    Filesize

    172KB

    MD5

    85a51ce72ae111efa7768eed479edf90

    SHA1

    0a0e03711c9ea219356d4e40e9b21282b97288bd

    SHA256

    14982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5

    SHA512

    24cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\s82510535.exe

    Filesize

    395KB

    MD5

    4d8cb05a084335e0f50ea9ce96287a36

    SHA1

    b3403c1038ae92f12cb97ba58627bc78c45630e7

    SHA256

    f6b722e9251db8f028cd97def3c8e8694b10953efd96abd3f1c39fc47eaf1b63

    SHA512

    3ae335bfc2f139760c4801bc726c83ce94bc511d853f4b8a6339bcd2702a70f095cca8be8e7656da467450aec3f3d6cc5e74c662ab4cf0d4b8c4da366aa7ff99

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe

    Filesize

    577KB

    MD5

    6f5292fc176a7f5c40cebfe6988f4523

    SHA1

    294b6e47e6f9ce47093b51d90fdde5b18037155e

    SHA256

    3c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e

    SHA512

    946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\y91978596.exe

    Filesize

    577KB

    MD5

    6f5292fc176a7f5c40cebfe6988f4523

    SHA1

    294b6e47e6f9ce47093b51d90fdde5b18037155e

    SHA256

    3c089ff1c92d8930123ab2ae435c7f319ea88808cc2c11a48ea6488b038fa70e

    SHA512

    946a15a57d616392ce8880814b1ad2c65a62b6a227b79a93aa44fc33825871e9f7b50b0bc930d681fda50c04eaa5256ab4901f8866e826a0796cd8936aa925e5

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\p42816439.exe

    Filesize

    575KB

    MD5

    2cba3ace2ab6b5c80ac4ffb5570cf548

    SHA1

    34e392fdb111e2e5ecc1e5db42b105568c281141

    SHA256

    c8ebee2064c8f1d0beb5ce0e57cedb044d014e314d6665609bc92bea7927a184

    SHA512

    539d5255fd9be4df60a57be8d18fdb79c6f327a6a00203efb2a81e333524104361510dced18fc1bd309ac2970887383ec98f2d09982c70122240d09b80f811e8

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe

    Filesize

    172KB

    MD5

    85a51ce72ae111efa7768eed479edf90

    SHA1

    0a0e03711c9ea219356d4e40e9b21282b97288bd

    SHA256

    14982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5

    SHA512

    24cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\r99304155.exe

    Filesize

    172KB

    MD5

    85a51ce72ae111efa7768eed479edf90

    SHA1

    0a0e03711c9ea219356d4e40e9b21282b97288bd

    SHA256

    14982ffa8f5dc1560f6aa0fcad907b2490d766d81c9b21f74e2ea0b337f133a5

    SHA512

    24cefeec0ae3623d02bac2f7d4cebac3e7529a67ec098b2bd46e6549a075d11fef38ea93dd541786281501e5f93ee968371799138e6fb237f2f44596f8781db7

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • memory/1160-2294-0x0000000000310000-0x000000000033D000-memory.dmp

    Filesize

    180KB

  • memory/1160-2264-0x0000000000580000-0x000000000059A000-memory.dmp

    Filesize

    104KB

  • memory/1160-2295-0x0000000000A30000-0x0000000000A70000-memory.dmp

    Filesize

    256KB

  • memory/1160-2296-0x0000000000A30000-0x0000000000A70000-memory.dmp

    Filesize

    256KB

  • memory/1160-2265-0x0000000000BF0000-0x0000000000C08000-memory.dmp

    Filesize

    96KB

  • memory/1408-2250-0x0000000000F20000-0x0000000000F50000-memory.dmp

    Filesize

    192KB

  • memory/1408-2251-0x0000000000910000-0x0000000000916000-memory.dmp

    Filesize

    24KB

  • memory/1408-2252-0x0000000004DC0000-0x0000000004E00000-memory.dmp

    Filesize

    256KB

  • memory/1512-95-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-108-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-119-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-121-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-123-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-127-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-129-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-131-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-133-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-135-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-137-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-139-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-141-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-143-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-145-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-147-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-125-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-2230-0x0000000002660000-0x0000000002692000-memory.dmp

    Filesize

    200KB

  • memory/1512-2234-0x00000000026A0000-0x00000000026E0000-memory.dmp

    Filesize

    256KB

  • memory/1512-115-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-113-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-117-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-111-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-78-0x00000000025E0000-0x0000000002648000-memory.dmp

    Filesize

    416KB

  • memory/1512-79-0x00000000028A0000-0x0000000002906000-memory.dmp

    Filesize

    408KB

  • memory/1512-109-0x00000000026A0000-0x00000000026E0000-memory.dmp

    Filesize

    256KB

  • memory/1512-81-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-104-0x00000000002B0000-0x000000000030B000-memory.dmp

    Filesize

    364KB

  • memory/1512-107-0x00000000026A0000-0x00000000026E0000-memory.dmp

    Filesize

    256KB

  • memory/1512-106-0x00000000026A0000-0x00000000026E0000-memory.dmp

    Filesize

    256KB

  • memory/1512-103-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-101-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-80-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-99-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-97-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-93-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-89-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-91-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-87-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-85-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1512-83-0x00000000028A0000-0x0000000002900000-memory.dmp

    Filesize

    384KB

  • memory/1824-2253-0x0000000004B40000-0x0000000004B80000-memory.dmp

    Filesize

    256KB

  • memory/1824-2243-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/1824-2242-0x0000000000EF0000-0x0000000000F1E000-memory.dmp

    Filesize

    184KB