Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2023, 22:53

General

  • Target

    0089ebac1cf2da8cc6135b96ac8b4ef618c538d960b0e584edb6d0d10e344042.exe

  • Size

    755KB

  • MD5

    163639fd282c29a6dbff57092b5f8eeb

  • SHA1

    1c6f5d8e67c454dd8031748464ae376d476d500b

  • SHA256

    0089ebac1cf2da8cc6135b96ac8b4ef618c538d960b0e584edb6d0d10e344042

  • SHA512

    8e8fd0d58874465d2ca3b4afe6e199a6c52217b4f1b66a80ea0e639b950aeb9b0e4272fbec4ea6e76dc2df0a4e72a90f5932f975a4fcb9e499e66954a52a8af7

  • SSDEEP

    12288:WMrwy90K45rSh8BP5/Tf1aRPF0YXJez7qVT6f/zUZWwFXxYchFv+s6WAG:SyKJw8hlTfERPF0Y5ek3ZWgXHFv+Y

Malware Config

Extracted

Family

redline

Botnet

dars

C2

83.97.73.127:19045

Attributes
  • auth_value

    7cd208e6b6c927262304d5d4d88647fd

Extracted

Family

redline

Botnet

grom

C2

83.97.73.127:19045

Attributes
  • auth_value

    2193aac8692a5e1ec66d9db9fa25ee00

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0089ebac1cf2da8cc6135b96ac8b4ef618c538d960b0e584edb6d0d10e344042.exe
    "C:\Users\Admin\AppData\Local\Temp\0089ebac1cf2da8cc6135b96ac8b4ef618c538d960b0e584edb6d0d10e344042.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:508
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6274723.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6274723.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4668
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9234710.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9234710.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5158737.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5158737.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2060
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7245858.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7245858.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4368
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3861919.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3861919.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3932
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4736
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:2184
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:1964
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3816
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4768
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:2320
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4340
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1731973.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1731973.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1704
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4904
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1444
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:412
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4280

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1731973.exe

                Filesize

                302KB

                MD5

                977e2d61c588c747014f1f85e97d74c9

                SHA1

                6f0d18a3466063a99886a02b37b7704d13b5b628

                SHA256

                01a466bad6774ebef2534724a6d4b5ddec71925ef6dbb13be7dcdbc6b3a12492

                SHA512

                45c4439826dec07ae9199f64fbe4c457215c64d5d777d94f9a85ed1dcc7cf0e57ad0a6fe77691f85828658f094d3e5ed44021c47b399ac947dfafd23fd4b2578

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n1731973.exe

                Filesize

                302KB

                MD5

                977e2d61c588c747014f1f85e97d74c9

                SHA1

                6f0d18a3466063a99886a02b37b7704d13b5b628

                SHA256

                01a466bad6774ebef2534724a6d4b5ddec71925ef6dbb13be7dcdbc6b3a12492

                SHA512

                45c4439826dec07ae9199f64fbe4c457215c64d5d777d94f9a85ed1dcc7cf0e57ad0a6fe77691f85828658f094d3e5ed44021c47b399ac947dfafd23fd4b2578

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6274723.exe

                Filesize

                445KB

                MD5

                3c493cbfd49aca869fbcd300b583c40e

                SHA1

                a4d38c26275b7eabc7675976ebcfb001bd14cd51

                SHA256

                8d3bb6bea93243965195c53a29a19ab83f8e0580d006be93ad24c8262dab5aaf

                SHA512

                23c2c19ed42adece584e9e36c6b3d4e51a9e7eb3af6b7d0a16106631e2afc9e771b1a3410ca8d38aaa958b61b1ee51112f107e678fa9661fae2e55991b0c9d88

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y6274723.exe

                Filesize

                445KB

                MD5

                3c493cbfd49aca869fbcd300b583c40e

                SHA1

                a4d38c26275b7eabc7675976ebcfb001bd14cd51

                SHA256

                8d3bb6bea93243965195c53a29a19ab83f8e0580d006be93ad24c8262dab5aaf

                SHA512

                23c2c19ed42adece584e9e36c6b3d4e51a9e7eb3af6b7d0a16106631e2afc9e771b1a3410ca8d38aaa958b61b1ee51112f107e678fa9661fae2e55991b0c9d88

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3861919.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m3861919.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9234710.exe

                Filesize

                274KB

                MD5

                1ff699529da0b35712067dff4f125c53

                SHA1

                13d3736f0702dd6aeea435cb87d8f2feb2659cf7

                SHA256

                d8d77406d1a3556ffd789d47ef7b816db639e020b194785b79e1c1293d70e9bf

                SHA512

                19603782b6fdd1b10e1600e072af18deae0d026f62c087dc55ab3af3e89610df3bc20e311a61ef53dc9b34e3f707aec19421613cbfe731e9209ed9005c7a3ec9

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9234710.exe

                Filesize

                274KB

                MD5

                1ff699529da0b35712067dff4f125c53

                SHA1

                13d3736f0702dd6aeea435cb87d8f2feb2659cf7

                SHA256

                d8d77406d1a3556ffd789d47ef7b816db639e020b194785b79e1c1293d70e9bf

                SHA512

                19603782b6fdd1b10e1600e072af18deae0d026f62c087dc55ab3af3e89610df3bc20e311a61ef53dc9b34e3f707aec19421613cbfe731e9209ed9005c7a3ec9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5158737.exe

                Filesize

                145KB

                MD5

                6c1ec97c7d30ae7f3deb9869a43f27ed

                SHA1

                8b106674802bcabcbfa14048a0f8c7fa6cbea49f

                SHA256

                b9aec012bbbc1fe58970c1f2e908b41a7ec040c42cb3541001fc49ae8b91b9df

                SHA512

                7f62d8b026c7424d9d9cd024241e1fff37ca5e540acb6ae892714315a3c8e0ff5b268ba399790294fc49281cd6ffddc6b4dd23ce5269d6c31f4fc315750aa36f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k5158737.exe

                Filesize

                145KB

                MD5

                6c1ec97c7d30ae7f3deb9869a43f27ed

                SHA1

                8b106674802bcabcbfa14048a0f8c7fa6cbea49f

                SHA256

                b9aec012bbbc1fe58970c1f2e908b41a7ec040c42cb3541001fc49ae8b91b9df

                SHA512

                7f62d8b026c7424d9d9cd024241e1fff37ca5e540acb6ae892714315a3c8e0ff5b268ba399790294fc49281cd6ffddc6b4dd23ce5269d6c31f4fc315750aa36f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7245858.exe

                Filesize

                168KB

                MD5

                04d7fd8e6efe50ee6f127ec34b66ace3

                SHA1

                506dcad9c95ebc6eb9ab71f3f41df39475f862c7

                SHA256

                91b0b2408ae9c78c6ae80a2473dc0ae450277a85bcd18228eea05d554bd27b48

                SHA512

                9e55753f2f1b9ed8cc51509031b8100fa4ad4f24146cec4fc0a6ba7feab3b11c8d91fb04ffe79e82f56e463bd0a5f57d0ac1eec3c506a8159246fa2d0a3dea32

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7245858.exe

                Filesize

                168KB

                MD5

                04d7fd8e6efe50ee6f127ec34b66ace3

                SHA1

                506dcad9c95ebc6eb9ab71f3f41df39475f862c7

                SHA256

                91b0b2408ae9c78c6ae80a2473dc0ae450277a85bcd18228eea05d554bd27b48

                SHA512

                9e55753f2f1b9ed8cc51509031b8100fa4ad4f24146cec4fc0a6ba7feab3b11c8d91fb04ffe79e82f56e463bd0a5f57d0ac1eec3c506a8159246fa2d0a3dea32

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                22b370dddf271df9ae3f792055c4a76a

                SHA1

                642bb5d1b7b6767659d4db9f8d85cfc833994d40

                SHA256

                12455128feece93cc3e1f26971435b8d9a9d035c116e739749080d2baccb0bda

                SHA512

                373a7163b6855b0fde1dc4ab77d790deb8d569882619021b52b48f73915c8891598da160ae1780f743a3515cd6de454907dfb26f587cd12ff88dd650431d1d5a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/2060-154-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB

              • memory/4368-174-0x000000000CAB0000-0x000000000CFDC000-memory.dmp

                Filesize

                5.2MB

              • memory/4368-169-0x000000000AF00000-0x000000000AF92000-memory.dmp

                Filesize

                584KB

              • memory/4368-175-0x00000000054B0000-0x00000000054C0000-memory.dmp

                Filesize

                64KB

              • memory/4368-173-0x000000000BD60000-0x000000000BF22000-memory.dmp

                Filesize

                1.8MB

              • memory/4368-171-0x000000000BFD0000-0x000000000C574000-memory.dmp

                Filesize

                5.6MB

              • memory/4368-170-0x000000000AE60000-0x000000000AEC6000-memory.dmp

                Filesize

                408KB

              • memory/4368-162-0x0000000000BC0000-0x0000000000BEE000-memory.dmp

                Filesize

                184KB

              • memory/4368-176-0x000000000BC10000-0x000000000BC60000-memory.dmp

                Filesize

                320KB

              • memory/4368-163-0x000000000AFC0000-0x000000000B5D8000-memory.dmp

                Filesize

                6.1MB

              • memory/4368-168-0x000000000ADE0000-0x000000000AE56000-memory.dmp

                Filesize

                472KB

              • memory/4368-167-0x00000000054B0000-0x00000000054C0000-memory.dmp

                Filesize

                64KB

              • memory/4368-166-0x000000000AAD0000-0x000000000AB0C000-memory.dmp

                Filesize

                240KB

              • memory/4368-165-0x000000000AA70000-0x000000000AA82000-memory.dmp

                Filesize

                72KB

              • memory/4368-164-0x000000000AB40000-0x000000000AC4A000-memory.dmp

                Filesize

                1.0MB

              • memory/4904-200-0x0000000005840000-0x0000000005850000-memory.dmp

                Filesize

                64KB

              • memory/4904-194-0x0000000001300000-0x000000000132E000-memory.dmp

                Filesize

                184KB