Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    278s
  • max time network
    255s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2023, 04:37

General

  • Target

    t5489145.exe

  • Size

    314KB

  • MD5

    5ebd49060b21946157c3340c680769d0

  • SHA1

    435b9e144da84d8ffa40b490d081e1d20947ee0b

  • SHA256

    b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

  • SHA512

    5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

  • SSDEEP

    6144:zR/tsQnf6X0M6+koYhXMxjwigfwfgbePu97rrAOQ322222KTq:zRlHVckoaXMxcePu97Hg22222iq

Malware Config

Extracted

Family

amadey

Version

3.87

C2

193.233.255.9/nasa/index.php

Extracted

Family

redline

Botnet

metafile

C2

91.103.252.39:7899

Attributes
  • auth_value

    9ac6dc6d653e5268fd38b21a0ec2b458

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 7 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\t5489145.exe
    "C:\Users\Admin\AppData\Local\Temp\t5489145.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
      "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2624
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          4⤵
            PID:2772
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "legosa.exe" /P "Admin:N"
            4⤵
              PID:1572
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "legosa.exe" /P "Admin:R" /E
              4⤵
                PID:2952
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                4⤵
                  PID:2132
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "..\ebb444342c" /P "Admin:N"
                  4⤵
                    PID:2832
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\ebb444342c" /P "Admin:R" /E
                    4⤵
                      PID:3008
                  • C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:3016
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2848
                  • C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:2476
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1376
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                    3⤵
                    • Loads dropped DLL
                    PID:2480
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {76241F75-0964-4313-B50E-E802ECD20994} S-1-5-21-4159544280-4273523227-683900707-1000:UMAXQRGK\Admin:Interactive:[1]
                1⤵
                  PID:2256
                  • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2380
                  • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    2⤵
                    • Executes dropped EXE
                    PID:904
                  • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1912
                  • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1772
                  • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe
                    2⤵
                    • Executes dropped EXE
                    PID:936

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe

                  Filesize

                  1.6MB

                  MD5

                  7db9dd5aa17476727fa4321088a26fc3

                  SHA1

                  798e8db4d86bc714553ee5b715a2e49ae14887cc

                  SHA256

                  84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

                  SHA512

                  0b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b

                • C:\Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe

                  Filesize

                  1.6MB

                  MD5

                  7db9dd5aa17476727fa4321088a26fc3

                  SHA1

                  798e8db4d86bc714553ee5b715a2e49ae14887cc

                  SHA256

                  84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

                  SHA512

                  0b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b

                • C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe

                  Filesize

                  7.3MB

                  MD5

                  7278b6ce3ddda7dba2473e0392e54ea6

                  SHA1

                  3b406f221237fe9bfce48daa9033eda93ecc9b94

                  SHA256

                  6b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49

                  SHA512

                  02a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72

                • C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe

                  Filesize

                  7.3MB

                  MD5

                  7278b6ce3ddda7dba2473e0392e54ea6

                  SHA1

                  3b406f221237fe9bfce48daa9033eda93ecc9b94

                  SHA256

                  6b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49

                  SHA512

                  02a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72

                • C:\Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe

                  Filesize

                  7.3MB

                  MD5

                  7278b6ce3ddda7dba2473e0392e54ea6

                  SHA1

                  3b406f221237fe9bfce48daa9033eda93ecc9b94

                  SHA256

                  6b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49

                  SHA512

                  02a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • \Users\Admin\AppData\Local\Temp\1000122001\crypted158158.exe

                  Filesize

                  1.6MB

                  MD5

                  7db9dd5aa17476727fa4321088a26fc3

                  SHA1

                  798e8db4d86bc714553ee5b715a2e49ae14887cc

                  SHA256

                  84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

                  SHA512

                  0b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b

                • \Users\Admin\AppData\Local\Temp\1000123001\fasfqwrqweqw.exe

                  Filesize

                  7.3MB

                  MD5

                  7278b6ce3ddda7dba2473e0392e54ea6

                  SHA1

                  3b406f221237fe9bfce48daa9033eda93ecc9b94

                  SHA256

                  6b11e77eee3f401356c240303da1b819ec0b12fb82bfb6ac5f3a1b08a00f3d49

                  SHA512

                  02a8d04d327757e3d9df6de2d14b5e2143e01798bf25a51e32555afeac494ae64f66fd5493a9ce28ce850be48c6febe264c61330e67391c694fd910a99247f72

                • \Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe

                  Filesize

                  314KB

                  MD5

                  5ebd49060b21946157c3340c680769d0

                  SHA1

                  435b9e144da84d8ffa40b490d081e1d20947ee0b

                  SHA256

                  b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

                  SHA512

                  5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

                • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                  Filesize

                  89KB

                  MD5

                  43762ddccb9db44ea9914e448ba3e43e

                  SHA1

                  87e5766061740cf4a570133af6108399a11dbd1b

                  SHA256

                  459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef

                  SHA512

                  ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651

                • memory/1376-66-0x00000000736F0000-0x0000000073DDE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/1376-49-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-51-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-53-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-55-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                  Filesize

                  4KB

                • memory/1376-56-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-47-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-59-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-61-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/1376-62-0x00000000736F0000-0x0000000073DDE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/1376-63-0x0000000000330000-0x0000000000336000-memory.dmp

                  Filesize

                  24KB

                • memory/1376-64-0x0000000004C20000-0x0000000004C60000-memory.dmp

                  Filesize

                  256KB

                • memory/1376-65-0x00000000736F0000-0x0000000073DDE000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2476-58-0x0000000073770000-0x0000000073E5E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2476-46-0x00000000051C0000-0x0000000005200000-memory.dmp

                  Filesize

                  256KB

                • memory/2476-45-0x0000000073770000-0x0000000073E5E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2476-44-0x0000000000390000-0x0000000000AEE000-memory.dmp

                  Filesize

                  7.4MB

                • memory/2848-26-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-28-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-30-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-23-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                  Filesize

                  4KB

                • memory/2848-24-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-21-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-20-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/2848-19-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB