Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/10/2024, 19:09

General

  • Target

    0x0007000000023433-50.exe

  • Size

    705KB

  • MD5

    a3789c9b2a0bde3b59c7612879f8c9d4

  • SHA1

    a938c3009fcccaedd361ac52c6f53667c60fc82f

  • SHA256

    f338e5a346c8a6b3234270fc6e31e9232a37f80e18df9702f7dcf06dffeb969a

  • SHA512

    65255c566dcb5b441c1cd9e7a42400b3158bbc7ae8bfadcc76ecc0a75d6d75ac2be3fc03985afd9b7c9b08c2993564d9b4f52fd6896eeb8fa157be57822e4718

  • SSDEEP

    12288:WwHy90MAQMK4zypwqHsGIziL6v5H09sA7pjvSdXlyNBvMxX/Wmvc9nRh0rp:WwHyf0ypBzt2OeAxsXENBkx/WWc9nRh2

Malware Config

Extracted

Family

redline

Botnet

1

C2

193.203.203.82:63851

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0007000000023433-50.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0007000000023433-50.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5460
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6124
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe"
        3⤵
        • Executes dropped EXE
        PID:2832
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe"
        3⤵
        • Executes dropped EXE
        PID:2860
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\INSTAL~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\INSTAL~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS1DF3.tmp\Install.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5192
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1NEph7
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9ea723cb8,0x7ff9ea723cc8,0x7ff9ea723cd8
            5⤵
              PID:3892
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
              5⤵
                PID:5876
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2032
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
                5⤵
                  PID:2028
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
                  5⤵
                    PID:1548
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
                    5⤵
                      PID:5508
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                      5⤵
                        PID:3148
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
                        5⤵
                          PID:4592
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1256
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                          5⤵
                            PID:4708
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                            5⤵
                              PID:4652
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,6707342300848296294,18253897500153729822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
                              5⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2720
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:1432
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:5912

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Install.exe.log

                          Filesize

                          1KB

                          MD5

                          76941aaaab6bbee482734f28d4a14755

                          SHA1

                          db728a8c58750de23f4b3efb2a4d112bf22bdb73

                          SHA256

                          e14e18a79694280818c29ef858fd858ee5b4f4995da9ed096865203284dcc220

                          SHA512

                          17b687368de387417317540e83e59991cb3793479fbcb75509f75ae6e06a0135d91679827a1de0775dec9ac05fded857ee4aff7257de9fca90d90dfa8fb660b5

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          cb557349d7af9d6754aed39b4ace5bee

                          SHA1

                          04de2ac30defbb36508a41872ddb475effe2d793

                          SHA256

                          cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

                          SHA512

                          f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          aad1d98ca9748cc4c31aa3b5abfe0fed

                          SHA1

                          32e8d4d9447b13bc00ec3eb15a88c55c29489495

                          SHA256

                          2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

                          SHA512

                          150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          1c3ec3a01a67706e193d3c07e43b738d

                          SHA1

                          869611b19b5587a4212fed0fbb1e400570ae3b77

                          SHA256

                          54be44ea1aee5ca8893ebc7512c5e065859c2055f00e1849879dc16c37c571db

                          SHA512

                          4cb1994c145ec2d47b7f5edbb9db35f00564588c7cc768ee3702925b539c356798497b734d0bdf3362009eee48926196d41ecc9f3555db8bf8713287eb9a42b6

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          772b74e7a28d626527e299a51002f937

                          SHA1

                          f3ceedc4cae20da7922dac01682f11e52c05df06

                          SHA256

                          fd85c8c2b5a9f89749f7ffa7d41082d636a7ffc9aba879ec1c8e78d4109c522b

                          SHA512

                          f7074ca8d3e8bc11f111a6690de38c3a4e5e314ca31a0665195b8b556d6f447d8d4ec16e96fc201c4f8284cfdb946203cbf3b7eaf8723045ba8b614e4d6a36a8

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          206702161f94c5cd39fadd03f4014d98

                          SHA1

                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                          SHA256

                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                          SHA512

                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                          Filesize

                          10KB

                          MD5

                          4cb2a4d26c1e075551463a3df378fa4c

                          SHA1

                          51b78d1e5012813ff59932bc9d1219543b915a9a

                          SHA256

                          0f317b69f43dbc7a7c9b79b25667445a36f426d5721714800c267f622fafb731

                          SHA512

                          9a4b9eb5b0ba1cad697f0f678637b302cf7e1446dd5fbefea7431a7df10912e0f3b8c449fcb4849ea2fd294dc14d98214de9b03706b82e5f95f51c42aeebbd46

                        • C:\Users\Admin\AppData\Local\Temp\7zS1DF3.tmp\Install.cmd

                          Filesize

                          51B

                          MD5

                          d9b6b6bdeef1a3d9480dd644585e6e8b

                          SHA1

                          068c0e58cd7a58d3da0a39368e1be1907c6c08bb

                          SHA256

                          8c45bb0d8691c9c3981b1c8cba6ed8587a16b9aa59f7cf191cabfcb30d31b49d

                          SHA512

                          b30edbb544552e66dc9c20a51ea4cfc66ed86c7ae8aed44f953a917ca7430249e58d37fbb750cbd985b73ad5c9f2c31bec2c8b36a95b0eae525c6a3494a8a1b3

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\INSTAL~1.EXE

                          Filesize

                          117KB

                          MD5

                          7383806624310451cbdaec0b1b395c1c

                          SHA1

                          0b816e9d921983ba5755680886ca7ac661ebd593

                          SHA256

                          f077f1d88003955e423200cb2a2598444bfb5cb30958ec0787ff406de5a3645c

                          SHA512

                          f50ff46316f301146a2787844ca16fa5e15dd77f7db409b7001ae68fe3f3905605f3b76c98c853077d0b27d0980408219fbd6a52ad63d2507e219e5b6a8c135f

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

                          Filesize

                          1.3MB

                          MD5

                          34f8ed66eca16cc312795ffbd9b5d8f3

                          SHA1

                          e83bfe61b9251e58016137baf6d3bdee5fd8a37e

                          SHA256

                          5480d9d8193700dfa31817e4755e3d2615b1c07f38421b19575051f03ba504c5

                          SHA512

                          32003a0cf752c1bd0066f45858f3d765da3c0a0076639f6aaeb3dc0f0bb1e122a78979ca2c4d0e0fea2b7fc93078ad0c50cf2e1aa8651d59c3f122015142350e

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21ytjaxz.esp.ps1

                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        • memory/2628-36-0x0000000005890000-0x0000000005EA8000-memory.dmp

                          Filesize

                          6.1MB

                        • memory/2628-37-0x0000000005310000-0x0000000005322000-memory.dmp

                          Filesize

                          72KB

                        • memory/2628-41-0x00000000053B0000-0x00000000053FC000-memory.dmp

                          Filesize

                          304KB

                        • memory/2628-39-0x0000000005370000-0x00000000053AC000-memory.dmp

                          Filesize

                          240KB

                        • memory/2628-22-0x0000000000400000-0x0000000000422000-memory.dmp

                          Filesize

                          136KB

                        • memory/2628-38-0x0000000005440000-0x000000000554A000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/5460-11-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/5460-9-0x0000000005B20000-0x00000000060C6000-memory.dmp

                          Filesize

                          5.6MB

                        • memory/5460-18-0x00000000074B0000-0x0000000007506000-memory.dmp

                          Filesize

                          344KB

                        • memory/5460-12-0x00000000054F0000-0x00000000054FA000-memory.dmp

                          Filesize

                          40KB

                        • memory/5460-26-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/5460-10-0x0000000005570000-0x0000000005602000-memory.dmp

                          Filesize

                          584KB

                        • memory/5460-19-0x0000000007500000-0x000000000752A000-memory.dmp

                          Filesize

                          168KB

                        • memory/5460-14-0x0000000007140000-0x00000000071DC000-memory.dmp

                          Filesize

                          624KB

                        • memory/5460-13-0x0000000005910000-0x0000000005966000-memory.dmp

                          Filesize

                          344KB

                        • memory/5460-17-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/5460-16-0x000000007506E000-0x000000007506F000-memory.dmp

                          Filesize

                          4KB

                        • memory/5460-8-0x00000000008C0000-0x0000000000A04000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/5460-15-0x0000000005980000-0x000000000598A000-memory.dmp

                          Filesize

                          40KB

                        • memory/5460-7-0x000000007506E000-0x000000007506F000-memory.dmp

                          Filesize

                          4KB

                        • memory/6124-49-0x0000000005D30000-0x0000000005D96000-memory.dmp

                          Filesize

                          408KB

                        • memory/6124-57-0x00000000062A0000-0x00000000062BE000-memory.dmp

                          Filesize

                          120KB

                        • memory/6124-55-0x0000000005E10000-0x0000000006167000-memory.dmp

                          Filesize

                          3.3MB

                        • memory/6124-48-0x0000000005C90000-0x0000000005CB2000-memory.dmp

                          Filesize

                          136KB

                        • memory/6124-50-0x0000000005DA0000-0x0000000005E06000-memory.dmp

                          Filesize

                          408KB

                        • memory/6124-40-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/6124-80-0x0000000006880000-0x00000000068B4000-memory.dmp

                          Filesize

                          208KB

                        • memory/6124-81-0x0000000070A50000-0x0000000070A9C000-memory.dmp

                          Filesize

                          304KB

                        • memory/6124-90-0x00000000074A0000-0x00000000074BE000-memory.dmp

                          Filesize

                          120KB

                        • memory/6124-91-0x00000000074C0000-0x0000000007564000-memory.dmp

                          Filesize

                          656KB

                        • memory/6124-92-0x0000000007C40000-0x00000000082BA000-memory.dmp

                          Filesize

                          6.5MB

                        • memory/6124-93-0x00000000075F0000-0x000000000760A000-memory.dmp

                          Filesize

                          104KB

                        • memory/6124-94-0x0000000007670000-0x000000000767A000-memory.dmp

                          Filesize

                          40KB

                        • memory/6124-95-0x0000000007880000-0x0000000007916000-memory.dmp

                          Filesize

                          600KB

                        • memory/6124-96-0x0000000007800000-0x0000000007811000-memory.dmp

                          Filesize

                          68KB

                        • memory/6124-99-0x0000000007830000-0x000000000783E000-memory.dmp

                          Filesize

                          56KB

                        • memory/6124-100-0x0000000007840000-0x0000000007855000-memory.dmp

                          Filesize

                          84KB

                        • memory/6124-101-0x0000000007940000-0x000000000795A000-memory.dmp

                          Filesize

                          104KB

                        • memory/6124-102-0x0000000007930000-0x0000000007938000-memory.dmp

                          Filesize

                          32KB

                        • memory/6124-105-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/6124-25-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

                          Filesize

                          216KB

                        • memory/6124-31-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/6124-28-0x0000000075060000-0x0000000075811000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/6124-27-0x0000000005660000-0x0000000005C8A000-memory.dmp

                          Filesize

                          6.2MB