Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    176s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:13

General

  • Target

    27319f213bcd97775862f7d2b1b8cf0aacd10b63f658ae3073123af375743a1b.exe

  • Size

    1.3MB

  • MD5

    556ca29c7ae44545dfe2fe704ab21ea5

  • SHA1

    343211ed26e9e22fe3e1cccbedbedba66f9d1713

  • SHA256

    27319f213bcd97775862f7d2b1b8cf0aacd10b63f658ae3073123af375743a1b

  • SHA512

    78400d59a7346c01cc806c957f11f89b9223a3d042cfff6716e2bf742745d216405a9dc5dafa0ebfedf47d36715952f347837531ff7ef9a774f796dc3fce5c06

  • SSDEEP

    24576:syFBytZvPnZdOH5RhZd1KSlpmldRk0RTyzdbFV23tk8hlQ+Qrpzip6V:bFQtJPnORVplpoRkKy5INX+NuU

Malware Config

Extracted

Family

redline

Botnet

darts

C2

77.91.124.82:19071

Attributes
  • auth_value

    3c8818da7045365845f15ec0946ebf11

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27319f213bcd97775862f7d2b1b8cf0aacd10b63f658ae3073123af375743a1b.exe
    "C:\Users\Admin\AppData\Local\Temp\27319f213bcd97775862f7d2b1b8cf0aacd10b63f658ae3073123af375743a1b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0618733.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0618733.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7901869.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7901869.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7469147.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7469147.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3424
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2062596.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2062596.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0291614.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0291614.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4248
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2312829.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2312829.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2172
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5092
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                    PID:4816
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    8⤵
                      PID:4592
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 600
                      8⤵
                      • Program crash
                      PID:1716
                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b0765977.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b0765977.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1832
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      8⤵
                        PID:1488
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 540
                          9⤵
                          • Program crash
                          PID:4708
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 564
                        8⤵
                        • Program crash
                        PID:4604
                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c3551061.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c3551061.exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:3876
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                      7⤵
                        PID:4652
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 564
                        7⤵
                        • Program crash
                        PID:2892
                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d7106569.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d7106569.exe
                    5⤵
                    • Executes dropped EXE
                    PID:1960
                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3919963.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3919963.exe
                  4⤵
                  • Executes dropped EXE
                  PID:1416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2172 -ip 2172
            1⤵
              PID:3816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1832 -ip 1832
              1⤵
                PID:4372
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1488 -ip 1488
                1⤵
                  PID:1828
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3876 -ip 3876
                  1⤵
                    PID:2708

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0618733.exe

                    Filesize

                    1.2MB

                    MD5

                    8dea6c28845a2e16331eec0594d68615

                    SHA1

                    a6bd77c2371dbd55fdf59b9a6ea8d7d73b03fa2a

                    SHA256

                    8a85132790a64a172abe4591e30ae7d42eb5fbfb73ee5fa0ada8c91a5318af39

                    SHA512

                    5b98e46a827b8ebf4de958983ee23202e0ebab013a668025b9eac16b948ecbe84d9fbca288894ece93aa21377eac99291526b626bcd2faaee5b0e0db8baeb8c6

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0618733.exe

                    Filesize

                    1.2MB

                    MD5

                    8dea6c28845a2e16331eec0594d68615

                    SHA1

                    a6bd77c2371dbd55fdf59b9a6ea8d7d73b03fa2a

                    SHA256

                    8a85132790a64a172abe4591e30ae7d42eb5fbfb73ee5fa0ada8c91a5318af39

                    SHA512

                    5b98e46a827b8ebf4de958983ee23202e0ebab013a668025b9eac16b948ecbe84d9fbca288894ece93aa21377eac99291526b626bcd2faaee5b0e0db8baeb8c6

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7901869.exe

                    Filesize

                    954KB

                    MD5

                    f1c5ad88b5d8a829398664f2bca79168

                    SHA1

                    d559727556b3c22660b1c850425909885fabc0ab

                    SHA256

                    74d63d2c3a1d750cfe691beda2b4774f754cc71d019dbd5bd4ea7843e8f31d31

                    SHA512

                    3c2a160de4993bb5ee180ec27d141f154023d7dd0ad07e8e01a93d3fea3f85caafce6d84d29deeb976d21879e38d747d632b6a40a3400064e3909fcf7e1a5cf6

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7901869.exe

                    Filesize

                    954KB

                    MD5

                    f1c5ad88b5d8a829398664f2bca79168

                    SHA1

                    d559727556b3c22660b1c850425909885fabc0ab

                    SHA256

                    74d63d2c3a1d750cfe691beda2b4774f754cc71d019dbd5bd4ea7843e8f31d31

                    SHA512

                    3c2a160de4993bb5ee180ec27d141f154023d7dd0ad07e8e01a93d3fea3f85caafce6d84d29deeb976d21879e38d747d632b6a40a3400064e3909fcf7e1a5cf6

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3919963.exe

                    Filesize

                    174KB

                    MD5

                    6125f881676988a41d3437c87fea767a

                    SHA1

                    cee24b60af54e095a104a637fedf0edb5c5af97b

                    SHA256

                    fda7924efe66f62039d770ce558ee729750e80f22adef8e697808991a1a6eddb

                    SHA512

                    d619207b4ac7a4238a948247dea48b4c23c98c0cfc44168e3cc80b0c72b3d6dd0d2040ad13c43154e728c92618b4d5b5ce0e4caae053becee410a9fa6608fe85

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3919963.exe

                    Filesize

                    174KB

                    MD5

                    6125f881676988a41d3437c87fea767a

                    SHA1

                    cee24b60af54e095a104a637fedf0edb5c5af97b

                    SHA256

                    fda7924efe66f62039d770ce558ee729750e80f22adef8e697808991a1a6eddb

                    SHA512

                    d619207b4ac7a4238a948247dea48b4c23c98c0cfc44168e3cc80b0c72b3d6dd0d2040ad13c43154e728c92618b4d5b5ce0e4caae053becee410a9fa6608fe85

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7469147.exe

                    Filesize

                    797KB

                    MD5

                    4be5e6912940d7ba23bc891a794650f6

                    SHA1

                    b1d2b92e8415132ada31e49123b6b4d068903d1c

                    SHA256

                    803c9ec7ee48bde5d69650a64175969af74d450ac896ef1f81b4a55e6ca4a282

                    SHA512

                    c1436b5d42dff9698a856838f86e957c7424470ad46ddfbe5d2c5f518cea7cad352e47b104be37542752224fbe808c70335f07c02babd5a08df8303a7cb2f630

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v7469147.exe

                    Filesize

                    797KB

                    MD5

                    4be5e6912940d7ba23bc891a794650f6

                    SHA1

                    b1d2b92e8415132ada31e49123b6b4d068903d1c

                    SHA256

                    803c9ec7ee48bde5d69650a64175969af74d450ac896ef1f81b4a55e6ca4a282

                    SHA512

                    c1436b5d42dff9698a856838f86e957c7424470ad46ddfbe5d2c5f518cea7cad352e47b104be37542752224fbe808c70335f07c02babd5a08df8303a7cb2f630

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d7106569.exe

                    Filesize

                    140KB

                    MD5

                    0600ec145314ee4ca247a67d0f11c4c3

                    SHA1

                    589898883ca6392575da63238d1b7d39cb12777c

                    SHA256

                    cc97a1ad2ab343bc662b22552c71e338b21327119bf8686cc38a90ff2e95d26f

                    SHA512

                    2e40c99376648c83ed1cd88cf99271629fdb966aa1e27b58edc99030c6954d5aca7ba335d16c4a667eba44a62540043ecc47617e39ccefa2368e1949258337a9

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d7106569.exe

                    Filesize

                    140KB

                    MD5

                    0600ec145314ee4ca247a67d0f11c4c3

                    SHA1

                    589898883ca6392575da63238d1b7d39cb12777c

                    SHA256

                    cc97a1ad2ab343bc662b22552c71e338b21327119bf8686cc38a90ff2e95d26f

                    SHA512

                    2e40c99376648c83ed1cd88cf99271629fdb966aa1e27b58edc99030c6954d5aca7ba335d16c4a667eba44a62540043ecc47617e39ccefa2368e1949258337a9

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2062596.exe

                    Filesize

                    632KB

                    MD5

                    c91c06d5060adc01b2a04b92dbee429f

                    SHA1

                    53160e02569b67021883ad37ffc72d09d62ccfa7

                    SHA256

                    51da29f85f2ab0ec26e688aa82f3799355a73be19b86494c780ba322a1275917

                    SHA512

                    e9b4d8ca3bdfb97ea44c8ed27f47655e4705db7411fcc8874d7252743ae7bd3dcea13ff2b136a8d6862c59b93ab5570f74346ec62d55462a9ac664d7d01d01fc

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2062596.exe

                    Filesize

                    632KB

                    MD5

                    c91c06d5060adc01b2a04b92dbee429f

                    SHA1

                    53160e02569b67021883ad37ffc72d09d62ccfa7

                    SHA256

                    51da29f85f2ab0ec26e688aa82f3799355a73be19b86494c780ba322a1275917

                    SHA512

                    e9b4d8ca3bdfb97ea44c8ed27f47655e4705db7411fcc8874d7252743ae7bd3dcea13ff2b136a8d6862c59b93ab5570f74346ec62d55462a9ac664d7d01d01fc

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c3551061.exe

                    Filesize

                    413KB

                    MD5

                    b14f3d77c5dd8fcff03e09c2e662ae51

                    SHA1

                    fe31048e96ed21eb2e4819532956354b77397c80

                    SHA256

                    07c100b5173c0820cd6522671f56c74e1dd124b35c4574dc5c0e9abec6c6ff3d

                    SHA512

                    6dc692340677c6e67004cf9ebd29cb280eca9b86eae362b7d7bc254a77a646b0daa80863f21976fc3c93d8ab1b723467ddd5c127e2f016ddd24d4fa9eba64ba1

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c3551061.exe

                    Filesize

                    413KB

                    MD5

                    b14f3d77c5dd8fcff03e09c2e662ae51

                    SHA1

                    fe31048e96ed21eb2e4819532956354b77397c80

                    SHA256

                    07c100b5173c0820cd6522671f56c74e1dd124b35c4574dc5c0e9abec6c6ff3d

                    SHA512

                    6dc692340677c6e67004cf9ebd29cb280eca9b86eae362b7d7bc254a77a646b0daa80863f21976fc3c93d8ab1b723467ddd5c127e2f016ddd24d4fa9eba64ba1

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0291614.exe

                    Filesize

                    354KB

                    MD5

                    13df56eb2c422dcd37381698723f0a08

                    SHA1

                    0cdc1273a079f54cc8225a648a0608e14c38107a

                    SHA256

                    8899b1da4d20b9a366d456109b71df65285c3bb3a106a141bf2ea295e6967680

                    SHA512

                    9a386d99e0c79b2af076325b04537ab41e1e301b4449f11285015cf3ba7256ba2b614ff8b7e0ebe227f4e26268734ebd0440050b6e0897ac12ec7b825b2d38f1

                  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v0291614.exe

                    Filesize

                    354KB

                    MD5

                    13df56eb2c422dcd37381698723f0a08

                    SHA1

                    0cdc1273a079f54cc8225a648a0608e14c38107a

                    SHA256

                    8899b1da4d20b9a366d456109b71df65285c3bb3a106a141bf2ea295e6967680

                    SHA512

                    9a386d99e0c79b2af076325b04537ab41e1e301b4449f11285015cf3ba7256ba2b614ff8b7e0ebe227f4e26268734ebd0440050b6e0897ac12ec7b825b2d38f1

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2312829.exe

                    Filesize

                    250KB

                    MD5

                    6e7d82b81b53bf617ca01f9ea909e5ba

                    SHA1

                    86280d7943ca3fbcc0e2e5ce535aa632e8534eef

                    SHA256

                    bdc3ea8b3747acd33405f0d9a8889372251af746132dd13d3f7fc3ae93e8c05c

                    SHA512

                    816b6f42333642412ab1e9ca04b6712ebf037ac69440410d32a8d53033d1694ebf9e026184005c75da5ed5cd7d2295a3b5121248eba154e8662646c88b16ef2b

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2312829.exe

                    Filesize

                    250KB

                    MD5

                    6e7d82b81b53bf617ca01f9ea909e5ba

                    SHA1

                    86280d7943ca3fbcc0e2e5ce535aa632e8534eef

                    SHA256

                    bdc3ea8b3747acd33405f0d9a8889372251af746132dd13d3f7fc3ae93e8c05c

                    SHA512

                    816b6f42333642412ab1e9ca04b6712ebf037ac69440410d32a8d53033d1694ebf9e026184005c75da5ed5cd7d2295a3b5121248eba154e8662646c88b16ef2b

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b0765977.exe

                    Filesize

                    379KB

                    MD5

                    7ed6fb8894c6c0dca30833a4b030b9ea

                    SHA1

                    04e5792c834a6468c7aaa061dc5a14e554d485d8

                    SHA256

                    0460eda2a91b400167c75bed00aeec3faf953909fbf95ff0653d0cbbbe73c181

                    SHA512

                    102ee7b44e79e9f969d0980ba49831c8db1339637e7a4d800217c27464a93d0b79e545b254702fc17951c6aecb6025fee6f195e268160db1fa474dd714dc3c37

                  • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b0765977.exe

                    Filesize

                    379KB

                    MD5

                    7ed6fb8894c6c0dca30833a4b030b9ea

                    SHA1

                    04e5792c834a6468c7aaa061dc5a14e554d485d8

                    SHA256

                    0460eda2a91b400167c75bed00aeec3faf953909fbf95ff0653d0cbbbe73c181

                    SHA512

                    102ee7b44e79e9f969d0980ba49831c8db1339637e7a4d800217c27464a93d0b79e545b254702fc17951c6aecb6025fee6f195e268160db1fa474dd714dc3c37

                  • memory/1416-73-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1416-80-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1416-79-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1416-72-0x0000000002710000-0x0000000002716000-memory.dmp

                    Filesize

                    24KB

                  • memory/1416-71-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1416-70-0x0000000000530000-0x0000000000560000-memory.dmp

                    Filesize

                    192KB

                  • memory/1488-47-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/1488-48-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/1488-51-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/1488-49-0x0000000000400000-0x0000000000428000-memory.dmp

                    Filesize

                    160KB

                  • memory/4652-57-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/4652-61-0x000000000AD40000-0x000000000B358000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4652-66-0x000000000A9D0000-0x000000000AA1C000-memory.dmp

                    Filesize

                    304KB

                  • memory/4652-55-0x0000000000400000-0x0000000000430000-memory.dmp

                    Filesize

                    192KB

                  • memory/4652-63-0x000000000A800000-0x000000000A812000-memory.dmp

                    Filesize

                    72KB

                  • memory/4652-64-0x0000000005240000-0x0000000005250000-memory.dmp

                    Filesize

                    64KB

                  • memory/4652-62-0x000000000A8C0000-0x000000000A9CA000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4652-65-0x000000000A860000-0x000000000A89C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4652-56-0x0000000005230000-0x0000000005236000-memory.dmp

                    Filesize

                    24KB

                  • memory/4652-78-0x0000000005240000-0x0000000005250000-memory.dmp

                    Filesize

                    64KB

                  • memory/4652-77-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/5092-76-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/5092-74-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/5092-43-0x0000000073C50000-0x0000000074400000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/5092-42-0x0000000000400000-0x000000000040A000-memory.dmp

                    Filesize

                    40KB