Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2023, 04:38

General

  • Target

    cb8ffb708c7e6ba45ab9699f8c076e49ae6fe6ba72129e439b9f16bcfaa88771.exe

  • Size

    754KB

  • MD5

    f7ccd81d1e1e7d0c92090e87647f0b9e

  • SHA1

    aa46dce7e47261c73b74ec390fad0a19fd855e70

  • SHA256

    cb8ffb708c7e6ba45ab9699f8c076e49ae6fe6ba72129e439b9f16bcfaa88771

  • SHA512

    b41d0e17047f55ee9f1812424b9c5e58fa72cf0dcb47f15eab4e93ec2e5fe974f98d2abdea3d2879028a8bf82d5e18ab83c583bd15d31eb7881e182a48a86eae

  • SSDEEP

    12288:bMr8y903c8zgBbNklI3oB4djLK7rTC+7oTmYJJ48ujyWDv5XAVg+yTouEiizHMmB:ryE/gBbr34KybyUv5ogdTo3isM6g4V3

Malware Config

Extracted

Family

redline

Botnet

mars

C2

83.97.73.127:19045

Attributes
  • auth_value

    91bd3682cfb50cdc64b6009eb977b766

Extracted

Family

redline

Botnet

grom

C2

83.97.73.127:19045

Attributes
  • auth_value

    2193aac8692a5e1ec66d9db9fa25ee00

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb8ffb708c7e6ba45ab9699f8c076e49ae6fe6ba72129e439b9f16bcfaa88771.exe
    "C:\Users\Admin\AppData\Local\Temp\cb8ffb708c7e6ba45ab9699f8c076e49ae6fe6ba72129e439b9f16bcfaa88771.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2667055.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2667055.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9007777.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9007777.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4401944.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4401944.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3644
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:728
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2211872.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2211872.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001838.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001838.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4024
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:3220
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3444
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:1048
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:2800
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3320
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:2788
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:2108
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4856
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8722948.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8722948.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1300
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4512
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:3804
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4248
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:4912

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8722948.exe

                Filesize

                303KB

                MD5

                f082df2caa52db37feab9df47c3df83e

                SHA1

                722c9af406fbaa901a3a5628f35c51f11bc83249

                SHA256

                31f05811a7d6df27660193b60ae0a966b01779fb6d941a6cf4db8dd2515cf6e6

                SHA512

                f80a3520e6c5223e5102d73f08a8a3b01039958e4f464d72d6e6e19c787c1cb4ddeea77ce73712fab6d7c4615a87802b3d46f2617cc3d3079020412b8f592f54

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8722948.exe

                Filesize

                303KB

                MD5

                f082df2caa52db37feab9df47c3df83e

                SHA1

                722c9af406fbaa901a3a5628f35c51f11bc83249

                SHA256

                31f05811a7d6df27660193b60ae0a966b01779fb6d941a6cf4db8dd2515cf6e6

                SHA512

                f80a3520e6c5223e5102d73f08a8a3b01039958e4f464d72d6e6e19c787c1cb4ddeea77ce73712fab6d7c4615a87802b3d46f2617cc3d3079020412b8f592f54

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2667055.exe

                Filesize

                445KB

                MD5

                23da2106a7ce0fb3c56d2eb5d2f09c44

                SHA1

                f2896e36c7316d63f30f6a49ce3ec7a867b78531

                SHA256

                a542aa1ea82915332cfd081fdbf9c85fe3a5a75ab0d1e3f7dd54ac7b8594ffd7

                SHA512

                fd6d61e86cd6a8943a81a7a5f823d33ab3eca3fbd2ec575e4fdddd4b39d8048d0d191cc50696bfccb79b9cb0484961a69cd0572b0f9f8e2500a2133e1ac5e9aa

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2667055.exe

                Filesize

                445KB

                MD5

                23da2106a7ce0fb3c56d2eb5d2f09c44

                SHA1

                f2896e36c7316d63f30f6a49ce3ec7a867b78531

                SHA256

                a542aa1ea82915332cfd081fdbf9c85fe3a5a75ab0d1e3f7dd54ac7b8594ffd7

                SHA512

                fd6d61e86cd6a8943a81a7a5f823d33ab3eca3fbd2ec575e4fdddd4b39d8048d0d191cc50696bfccb79b9cb0484961a69cd0572b0f9f8e2500a2133e1ac5e9aa

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001838.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5001838.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9007777.exe

                Filesize

                273KB

                MD5

                7ec60b2e5f0b56f215fc409c1f5a071b

                SHA1

                5242367313a15ff47268d034eafbd13e12f74b4a

                SHA256

                ec9a24a9ea0ce0d0010446ef9ea37d304af6990ba0c2a442985887a82eda0484

                SHA512

                a29b54a6a059f0aef5a7926512474b0d86ad25611075294f490bbf101088a4ab87b7640f26716b14abbfef8a95c70fb3cae154303617e3e6cc5ed950e6857997

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v9007777.exe

                Filesize

                273KB

                MD5

                7ec60b2e5f0b56f215fc409c1f5a071b

                SHA1

                5242367313a15ff47268d034eafbd13e12f74b4a

                SHA256

                ec9a24a9ea0ce0d0010446ef9ea37d304af6990ba0c2a442985887a82eda0484

                SHA512

                a29b54a6a059f0aef5a7926512474b0d86ad25611075294f490bbf101088a4ab87b7640f26716b14abbfef8a95c70fb3cae154303617e3e6cc5ed950e6857997

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4401944.exe

                Filesize

                145KB

                MD5

                24b503e9e23baf5f605f638f30837642

                SHA1

                e4b65310c3caeba0957b03c1ec042298054f78a4

                SHA256

                2b0059bea669da3f8fa6680015bf11c96335cd61faad72f7ee8075cdc96c1b02

                SHA512

                bc865bf4ac5c710c15f737e37e5c33ce3d92c938c937eaf80c4c03c38a25f1f7988079dcec98a52e8d8020dc9f84c75bb5ac8a0ecaf6c962a1fd1c4c8f8e52f6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a4401944.exe

                Filesize

                145KB

                MD5

                24b503e9e23baf5f605f638f30837642

                SHA1

                e4b65310c3caeba0957b03c1ec042298054f78a4

                SHA256

                2b0059bea669da3f8fa6680015bf11c96335cd61faad72f7ee8075cdc96c1b02

                SHA512

                bc865bf4ac5c710c15f737e37e5c33ce3d92c938c937eaf80c4c03c38a25f1f7988079dcec98a52e8d8020dc9f84c75bb5ac8a0ecaf6c962a1fd1c4c8f8e52f6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2211872.exe

                Filesize

                168KB

                MD5

                c5ececaffaa7379ea89e29f0ef6dd95b

                SHA1

                4c2bd25c42cb5ab1d5c0aca8b4f907bb389ba78a

                SHA256

                71e92a3990f00bdafdbb6b24cb5360ada8d4394798b18b54c46b63a8f94541c8

                SHA512

                5b50ef9ccfc9229bc293fe24a09645b6bcb1dc563b2c90998e2ce4e2748eb45674bedc6454dd07c75d49977557cf88d10d5cafca9debfccbbe7327edabee9851

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2211872.exe

                Filesize

                168KB

                MD5

                c5ececaffaa7379ea89e29f0ef6dd95b

                SHA1

                4c2bd25c42cb5ab1d5c0aca8b4f907bb389ba78a

                SHA256

                71e92a3990f00bdafdbb6b24cb5360ada8d4394798b18b54c46b63a8f94541c8

                SHA512

                5b50ef9ccfc9229bc293fe24a09645b6bcb1dc563b2c90998e2ce4e2748eb45674bedc6454dd07c75d49977557cf88d10d5cafca9debfccbbe7327edabee9851

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                214KB

                MD5

                c5ee1648dc959d3ac5bcc8de73b059c7

                SHA1

                1359bf9131dea62ad38cb7d73ad53327a422106c

                SHA256

                4dc54af9390618660e01c7f625f5c7c6d75781ca0dfb79d315ce68730bd454d6

                SHA512

                337070cefb2b6ee7e8e93de276e8108edf2e7e681971c96b35837f927b9acbafef05ebc05a61eedaa29c663ec23e14aa1d12c2f8c4ff9b9c5d1c36000bf5d3b9

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/728-154-0x0000000000540000-0x000000000054A000-memory.dmp

                Filesize

                40KB

              • memory/4512-194-0x0000000000390000-0x00000000003BE000-memory.dmp

                Filesize

                184KB

              • memory/4512-200-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

                Filesize

                64KB

              • memory/4716-163-0x0000000005250000-0x0000000005868000-memory.dmp

                Filesize

                6.1MB

              • memory/4716-176-0x0000000006050000-0x00000000060A0000-memory.dmp

                Filesize

                320KB

              • memory/4716-175-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/4716-173-0x00000000083E0000-0x000000000890C000-memory.dmp

                Filesize

                5.2MB

              • memory/4716-172-0x00000000060C0000-0x0000000006282000-memory.dmp

                Filesize

                1.8MB

              • memory/4716-171-0x0000000006310000-0x00000000068B4000-memory.dmp

                Filesize

                5.6MB

              • memory/4716-170-0x0000000004FE0000-0x0000000005046000-memory.dmp

                Filesize

                408KB

              • memory/4716-169-0x0000000005080000-0x0000000005112000-memory.dmp

                Filesize

                584KB

              • memory/4716-168-0x0000000004F60000-0x0000000004FD6000-memory.dmp

                Filesize

                472KB

              • memory/4716-167-0x0000000004C70000-0x0000000004CAC000-memory.dmp

                Filesize

                240KB

              • memory/4716-166-0x0000000004A20000-0x0000000004A30000-memory.dmp

                Filesize

                64KB

              • memory/4716-165-0x00000000049E0000-0x00000000049F2000-memory.dmp

                Filesize

                72KB

              • memory/4716-164-0x0000000004D40000-0x0000000004E4A000-memory.dmp

                Filesize

                1.0MB

              • memory/4716-162-0x0000000000160000-0x000000000018E000-memory.dmp

                Filesize

                184KB