Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2023, 05:37

General

  • Target

    d09f4659bb17a23b91a0c042cfeb59b67286577d6998bfda4186e37e39ece84d.exe

  • Size

    592KB

  • MD5

    03c376e503c3d9ba48e8dca2275f1fbc

  • SHA1

    e021611a02f824e894a8ed7d8d0847bfdd21bfd0

  • SHA256

    d09f4659bb17a23b91a0c042cfeb59b67286577d6998bfda4186e37e39ece84d

  • SHA512

    97f57e079785e8d180482b89aee27be4ca5d388c499e4169029a6cfd754ebddd6367f85ada52808ceace92617faecb7fa684a7c3b3c1e36a1f14478a219e83f5

  • SSDEEP

    12288:FMrty90DxemUjFbub3IlsU1t5XvBM1V8gAkZKimWzA6hVqG:EyK/UAb34t5f4VWksIU23

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes
  • auth_value

    2d067e7e2372227d3a03b335260112e9

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d09f4659bb17a23b91a0c042cfeb59b67286577d6998bfda4186e37e39ece84d.exe
    "C:\Users\Admin\AppData\Local\Temp\d09f4659bb17a23b91a0c042cfeb59b67286577d6998bfda4186e37e39ece84d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0085063.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0085063.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1230368.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1230368.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3369475.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3369475.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5177112.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5177112.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7730065.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7730065.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:1572
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "Admin:N"&&CACLS "lamod.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:5080
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "lamod.exe" /P "Admin:N"
                6⤵
                  PID:4344
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "lamod.exe" /P "Admin:R" /E
                  6⤵
                    PID:3052
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:3584
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\a9e2a16078" /P "Admin:N"
                      6⤵
                        PID:4412
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:4160
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:1240
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7412938.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7412938.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4968
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2940
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 156
                    3⤵
                    • Program crash
                    PID:1416
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4968 -ip 4968
                1⤵
                  PID:4448
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:372
                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2652

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7412938.exe

                  Filesize

                  282KB

                  MD5

                  988063b06eb97bf3a49a270c67b66dec

                  SHA1

                  b3e4efb9edd0a14e4fee32412f23ccb7b8f09616

                  SHA256

                  46d1c955ceff73ebf753d464f6740d6ae586d3c73b559d0e6229a97852b94c96

                  SHA512

                  c35f287d2531d197a936f9c7d8f4f61cb50f56ae6e8d8976e68c9da2d70629adc32ce9aa7174ece1bba99002e8f02a45f38be2ed724553714f64a7fd4a73ea34

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7412938.exe

                  Filesize

                  282KB

                  MD5

                  988063b06eb97bf3a49a270c67b66dec

                  SHA1

                  b3e4efb9edd0a14e4fee32412f23ccb7b8f09616

                  SHA256

                  46d1c955ceff73ebf753d464f6740d6ae586d3c73b559d0e6229a97852b94c96

                  SHA512

                  c35f287d2531d197a936f9c7d8f4f61cb50f56ae6e8d8976e68c9da2d70629adc32ce9aa7174ece1bba99002e8f02a45f38be2ed724553714f64a7fd4a73ea34

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0085063.exe

                  Filesize

                  378KB

                  MD5

                  92c0f9f89ad1140f9c3c40c401761f40

                  SHA1

                  03b72ca69e0424629c215cbbbabeff49944bcc69

                  SHA256

                  8e293af1e45ab10a790ac5cabbe89fb02eb2dbb83da948e6589cc6cd92d8140e

                  SHA512

                  c80b7c056c692d7024d5c0985cde63d37e48f2afc61758382b284178d031c6cc0e0536451d3eb87edd01060c5ec1f78739c973eb142c395141c5bd0d23ac98c4

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0085063.exe

                  Filesize

                  378KB

                  MD5

                  92c0f9f89ad1140f9c3c40c401761f40

                  SHA1

                  03b72ca69e0424629c215cbbbabeff49944bcc69

                  SHA256

                  8e293af1e45ab10a790ac5cabbe89fb02eb2dbb83da948e6589cc6cd92d8140e

                  SHA512

                  c80b7c056c692d7024d5c0985cde63d37e48f2afc61758382b284178d031c6cc0e0536451d3eb87edd01060c5ec1f78739c973eb142c395141c5bd0d23ac98c4

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7730065.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7730065.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1230368.exe

                  Filesize

                  206KB

                  MD5

                  f2ede79df97cdefdc0ced86359248a96

                  SHA1

                  b7b26d7cf2932216c6ebf32efccde470db6d6c2c

                  SHA256

                  7c7e11c977ae52c50c41eb3156ed73826bb2687decb4e7bd94b4152cbce95646

                  SHA512

                  7eefc7d77902bc0ef49f3fcfacf42db6b00f333448830d8b7d8fe4d26a5bd78151ee8124d817e8ba653b475b8e151c9f3e497da1e1ab0f0febea111760902b08

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1230368.exe

                  Filesize

                  206KB

                  MD5

                  f2ede79df97cdefdc0ced86359248a96

                  SHA1

                  b7b26d7cf2932216c6ebf32efccde470db6d6c2c

                  SHA256

                  7c7e11c977ae52c50c41eb3156ed73826bb2687decb4e7bd94b4152cbce95646

                  SHA512

                  7eefc7d77902bc0ef49f3fcfacf42db6b00f333448830d8b7d8fe4d26a5bd78151ee8124d817e8ba653b475b8e151c9f3e497da1e1ab0f0febea111760902b08

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3369475.exe

                  Filesize

                  173KB

                  MD5

                  a15f8ef56e8f7138c3efbc6e219d5bd6

                  SHA1

                  b57204e1011031d313fcbd0fbaed0fbecd37a421

                  SHA256

                  1f0c1e5936a673e9836d73bf8b096fe6ae94307b81255aafc42863ca215e6b87

                  SHA512

                  f8bfd84d4e73b5bfbea33ca6a5ba8a18e45c46d7febc59c3ea471cad0b8e48595ffbf41cfbd87aa5ab6011cd0e593d82a4b476c36d836eb72741f5b2b859a37e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f3369475.exe

                  Filesize

                  173KB

                  MD5

                  a15f8ef56e8f7138c3efbc6e219d5bd6

                  SHA1

                  b57204e1011031d313fcbd0fbaed0fbecd37a421

                  SHA256

                  1f0c1e5936a673e9836d73bf8b096fe6ae94307b81255aafc42863ca215e6b87

                  SHA512

                  f8bfd84d4e73b5bfbea33ca6a5ba8a18e45c46d7febc59c3ea471cad0b8e48595ffbf41cfbd87aa5ab6011cd0e593d82a4b476c36d836eb72741f5b2b859a37e

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5177112.exe

                  Filesize

                  13KB

                  MD5

                  9b2413a5089ea3bf2b926f2bf78e14b4

                  SHA1

                  1864aaad95832ab8975e3902c5b02bab2eb9ce91

                  SHA256

                  7e73e67c454e99318811a66b1ea87620db6c6958de067e2ffcf3c631622eb8d8

                  SHA512

                  798cc525438983ad44ca7644bcaad67cc4a405120c9e409f4ae96878fe5fda4a93a62b60dd52906a8fa3f4a2c81d0b7495e887401a4b93d9692ec44c1de60e9a

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5177112.exe

                  Filesize

                  13KB

                  MD5

                  9b2413a5089ea3bf2b926f2bf78e14b4

                  SHA1

                  1864aaad95832ab8975e3902c5b02bab2eb9ce91

                  SHA256

                  7e73e67c454e99318811a66b1ea87620db6c6958de067e2ffcf3c631622eb8d8

                  SHA512

                  798cc525438983ad44ca7644bcaad67cc4a405120c9e409f4ae96878fe5fda4a93a62b60dd52906a8fa3f4a2c81d0b7495e887401a4b93d9692ec44c1de60e9a

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\lamod.exe

                  Filesize

                  207KB

                  MD5

                  86ce9b08c45ec2e4debae692fdc922fc

                  SHA1

                  3a43ff831b84930c4d08f5f26d9a22d572fa3e1d

                  SHA256

                  229790a4f98997d9a4a4f9c3deae7cd336f0538d7345696e4459ea998f4baafa

                  SHA512

                  26ef1128223106a16e5c3cb6325bca6c8702fe18485469e7cf81e0fe02420ba37f41be88e723d35074d4856af72fbcc7f09df756656186d81c30427d1a85b4ff

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  a5ed103ec4719a27ab3d3c01dac66f01

                  SHA1

                  c830d6980d7edea60568a518eccd36c0bc2a4924

                  SHA256

                  dbcdc009781edffc3c4e5234d3d23d26364d6bff47e2e384cffdef148d7b5b36

                  SHA512

                  b7fbe709a44f0e84a94c9e82f790d04e3d86b5409b5eb2d9f1d4d775b9669694c189042f04001acadb6da4c6284f4fbcbe39fd97427d41619191928510db9d80

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/440-172-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

                  Filesize

                  40KB

                • memory/2940-190-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/2940-195-0x0000000004E30000-0x0000000004E40000-memory.dmp

                  Filesize

                  64KB

                • memory/3056-157-0x000000000AD90000-0x000000000ADA2000-memory.dmp

                  Filesize

                  72KB

                • memory/3056-166-0x0000000003390000-0x00000000033A0000-memory.dmp

                  Filesize

                  64KB

                • memory/3056-167-0x000000000CE60000-0x000000000D38C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/3056-165-0x000000000C760000-0x000000000C922000-memory.dmp

                  Filesize

                  1.8MB

                • memory/3056-164-0x000000000BF50000-0x000000000BFA0000-memory.dmp

                  Filesize

                  320KB

                • memory/3056-163-0x000000000BA30000-0x000000000BA96000-memory.dmp

                  Filesize

                  408KB

                • memory/3056-162-0x000000000BFE0000-0x000000000C584000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3056-161-0x000000000B990000-0x000000000BA22000-memory.dmp

                  Filesize

                  584KB

                • memory/3056-160-0x000000000B100000-0x000000000B176000-memory.dmp

                  Filesize

                  472KB

                • memory/3056-159-0x0000000003390000-0x00000000033A0000-memory.dmp

                  Filesize

                  64KB

                • memory/3056-158-0x000000000ADF0000-0x000000000AE2C000-memory.dmp

                  Filesize

                  240KB

                • memory/3056-156-0x000000000AE50000-0x000000000AF5A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3056-155-0x000000000B2D0000-0x000000000B8E8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3056-154-0x0000000000ED0000-0x0000000000F00000-memory.dmp

                  Filesize

                  192KB