Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2023, 22:56

General

  • Target

    881fedabab9b8e599aa8164cc33168fd5fe7b150347d7cde2ac77b1e15efcd05.exe

  • Size

    722KB

  • MD5

    3254b58bd4b980a272b5057d1b224fd4

  • SHA1

    77c2f51f1e3ab54b0934be9bef2bbb63a6979915

  • SHA256

    881fedabab9b8e599aa8164cc33168fd5fe7b150347d7cde2ac77b1e15efcd05

  • SHA512

    a7e9ecd889facb487a68eef72f03bdb7f2bcb369938370f43bc4dce64f7b8354c7015cf69d28fbc9ea3e08600c615cd0514da39872afe095cb9d08372443c4f3

  • SSDEEP

    12288:TMr9y90jjdNpFxLcDE2KxPaWWqKSSpddDmc8CT6TWxo3R8Y8tpmvLRzO/hnySYEl:ayK5bnaXFxtj6Tyo3RISJEYEl

Malware Config

Extracted

Family

redline

Botnet

dana

C2

83.97.73.130:19061

Attributes
  • auth_value

    da2d1691db653e49676d799e1eae2673

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\881fedabab9b8e599aa8164cc33168fd5fe7b150347d7cde2ac77b1e15efcd05.exe
    "C:\Users\Admin\AppData\Local\Temp\881fedabab9b8e599aa8164cc33168fd5fe7b150347d7cde2ac77b1e15efcd05.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0295146.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0295146.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5912815.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5912815.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0571429.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0571429.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0713576.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0713576.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4488
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k6317751.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k6317751.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2204
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2265414.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2265414.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1060
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4304834.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4304834.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
          "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:1548
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2632
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:2716
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "rugen.exe" /P "Admin:N"
                6⤵
                  PID:2372
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "rugen.exe" /P "Admin:R" /E
                  6⤵
                    PID:1212
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\200f691d32" /P "Admin:N"
                    6⤵
                      PID:4144
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:3844
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\200f691d32" /P "Admin:R" /E
                        6⤵
                          PID:4464
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3616
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6994069.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6994069.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1908
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:2568

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6994069.exe

                Filesize

                255KB

                MD5

                f662b100eeb36b1d41727fe2e4fc03ed

                SHA1

                8a0890f80445dbe562895582addd3ca637915a1a

                SHA256

                309d3ccf0737fdff171d5f9885fcb2b49a92e7afe2d3386ba934cde7e75714d6

                SHA512

                9f925d363e1e1d09e620cf05238b58818dd29a7f9e0d31bd2856c088dbdcf4b1b4b71edb0d99da250861c1dd09d527be0e065dd458aae1b8f6786d5f986778d0

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n6994069.exe

                Filesize

                255KB

                MD5

                f662b100eeb36b1d41727fe2e4fc03ed

                SHA1

                8a0890f80445dbe562895582addd3ca637915a1a

                SHA256

                309d3ccf0737fdff171d5f9885fcb2b49a92e7afe2d3386ba934cde7e75714d6

                SHA512

                9f925d363e1e1d09e620cf05238b58818dd29a7f9e0d31bd2856c088dbdcf4b1b4b71edb0d99da250861c1dd09d527be0e065dd458aae1b8f6786d5f986778d0

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0295146.exe

                Filesize

                523KB

                MD5

                9855f56a046a322206967322a691c0f3

                SHA1

                dcca427c8865a12f861f429d4e4750e6ba55288d

                SHA256

                dda961963fc65f29a086ad2e0924ac790bce97461527be879501763b538700df

                SHA512

                39ced461b4764304fed206234c9ad15b9552d66fbab2fc82408d522c09982b7f1792ff836737ca24e0381ed362ac043b68ef06ec2a56b393c1ac2405e5d818c5

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0295146.exe

                Filesize

                523KB

                MD5

                9855f56a046a322206967322a691c0f3

                SHA1

                dcca427c8865a12f861f429d4e4750e6ba55288d

                SHA256

                dda961963fc65f29a086ad2e0924ac790bce97461527be879501763b538700df

                SHA512

                39ced461b4764304fed206234c9ad15b9552d66fbab2fc82408d522c09982b7f1792ff836737ca24e0381ed362ac043b68ef06ec2a56b393c1ac2405e5d818c5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4304834.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m4304834.exe

                Filesize

                205KB

                MD5

                9c2aafb52fe28b3acc6c1b967121777b

                SHA1

                cd9a015d9ff5538bfa340e46a75ff9c59bde57e4

                SHA256

                e1d45a690b009f522b10491846db9b7389d2e862934f324b1560b1101d8093a1

                SHA512

                05f5b9fdb52b77256b8501ccbb1ca6cde574a9a6c752d2a953df74da0817ad4a873bfc3baef259c2f11524a8f6af6eafaabbb64c00eac6f0e4c33184d1f25e2c

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5912815.exe

                Filesize

                351KB

                MD5

                abab79102337d0aa58ba1595b4ec6f27

                SHA1

                1596a829b98b9dd2338e496967766e6ca3a13ae7

                SHA256

                f7862d962116c4ed820fb3bb94cdda9f1975eefa9c6fed7bd6fbf2ca802add44

                SHA512

                c903117b954f30f43e8d289584bb2faa0e5994ea21e3b4779f5717eeeb47ccb630cf33ab5623d627d48d42315c6c96de29ddeab7bffb623896313eadfe1f6cfd

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5912815.exe

                Filesize

                351KB

                MD5

                abab79102337d0aa58ba1595b4ec6f27

                SHA1

                1596a829b98b9dd2338e496967766e6ca3a13ae7

                SHA256

                f7862d962116c4ed820fb3bb94cdda9f1975eefa9c6fed7bd6fbf2ca802add44

                SHA512

                c903117b954f30f43e8d289584bb2faa0e5994ea21e3b4779f5717eeeb47ccb630cf33ab5623d627d48d42315c6c96de29ddeab7bffb623896313eadfe1f6cfd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2265414.exe

                Filesize

                172KB

                MD5

                f28c919c220ddf69a6363b82eb624625

                SHA1

                01cdbf1b4a3bd8032d141f4b6b2e64fab8bfa212

                SHA256

                5eed34eb03f419f9559310af783361929b79647cf4f52c3fbd0ebf7ca28cc9b0

                SHA512

                a0d1cd60b983921f38ed30396f4529dd46df03e22c6a4b453adc5b3054ada3530aab574c16bfe494765ec5ae2320f8a7dd2e3544bd2e7ceb250ba63ef5d65de7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l2265414.exe

                Filesize

                172KB

                MD5

                f28c919c220ddf69a6363b82eb624625

                SHA1

                01cdbf1b4a3bd8032d141f4b6b2e64fab8bfa212

                SHA256

                5eed34eb03f419f9559310af783361929b79647cf4f52c3fbd0ebf7ca28cc9b0

                SHA512

                a0d1cd60b983921f38ed30396f4529dd46df03e22c6a4b453adc5b3054ada3530aab574c16bfe494765ec5ae2320f8a7dd2e3544bd2e7ceb250ba63ef5d65de7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0571429.exe

                Filesize

                196KB

                MD5

                08f3d59f896103edd8d1fab3b3072e10

                SHA1

                019f89a74f134529ba661dee46bcd3d6b4aecb28

                SHA256

                64ea3eef5483cb8046d0d30d4b144821886403c4c829e70135bc837efaae1b17

                SHA512

                59051eef4f8d67015c79b0b8f0a1712560a713ed0aa41907ee4385c950d916be43d5e405e6cd53edd1984b48079e756fac0db1fa2d6f786544d7b00ac35e8281

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0571429.exe

                Filesize

                196KB

                MD5

                08f3d59f896103edd8d1fab3b3072e10

                SHA1

                019f89a74f134529ba661dee46bcd3d6b4aecb28

                SHA256

                64ea3eef5483cb8046d0d30d4b144821886403c4c829e70135bc837efaae1b17

                SHA512

                59051eef4f8d67015c79b0b8f0a1712560a713ed0aa41907ee4385c950d916be43d5e405e6cd53edd1984b48079e756fac0db1fa2d6f786544d7b00ac35e8281

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0713576.exe

                Filesize

                94KB

                MD5

                e70f9bb996bef2db9a0491174db2206c

                SHA1

                2dd5c3126613128112f85a3729815e5a57abcc41

                SHA256

                077b2b1dcd295c7f2408641fc99977c37f489c0e8d3d0d5ff4a93ac729493aca

                SHA512

                35f73c42d5837a756e3670478f242b5e7d42532c8008e05b8ab2c57c5d70b16ccc369a8ded7f480ca0b7b917a432299457c0355b5a8a94431aa5474fc73c8718

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\j0713576.exe

                Filesize

                94KB

                MD5

                e70f9bb996bef2db9a0491174db2206c

                SHA1

                2dd5c3126613128112f85a3729815e5a57abcc41

                SHA256

                077b2b1dcd295c7f2408641fc99977c37f489c0e8d3d0d5ff4a93ac729493aca

                SHA512

                35f73c42d5837a756e3670478f242b5e7d42532c8008e05b8ab2c57c5d70b16ccc369a8ded7f480ca0b7b917a432299457c0355b5a8a94431aa5474fc73c8718

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k6317751.exe

                Filesize

                11KB

                MD5

                daa8dbddbca6d077a7fc234496923cf1

                SHA1

                4df2b6327e8e75ed71c0e3055c9d17a043ff6b65

                SHA256

                17528baacf916fa9379bb2df7a9cb98e87f6759a74a3dccd565a04c671d67b56

                SHA512

                b8c878f507ad26dfee4caa5f37ad8f6e909ce5354f9aa4df8535fcdeb75e654afbd179ca2c16eedfc4c2ba9d4de13b58e1fdb23424a72c9da893f6b1f5f4890a

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\k6317751.exe

                Filesize

                11KB

                MD5

                daa8dbddbca6d077a7fc234496923cf1

                SHA1

                4df2b6327e8e75ed71c0e3055c9d17a043ff6b65

                SHA256

                17528baacf916fa9379bb2df7a9cb98e87f6759a74a3dccd565a04c671d67b56

                SHA512

                b8c878f507ad26dfee4caa5f37ad8f6e909ce5354f9aa4df8535fcdeb75e654afbd179ca2c16eedfc4c2ba9d4de13b58e1fdb23424a72c9da893f6b1f5f4890a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1060-178-0x000000000A630000-0x000000000A642000-memory.dmp

                Filesize

                72KB

              • memory/1060-175-0x0000000000770000-0x00000000007A0000-memory.dmp

                Filesize

                192KB

              • memory/1060-188-0x0000000005100000-0x0000000005110000-memory.dmp

                Filesize

                64KB

              • memory/1060-181-0x000000000A9A0000-0x000000000AA16000-memory.dmp

                Filesize

                472KB

              • memory/1060-180-0x0000000005100000-0x0000000005110000-memory.dmp

                Filesize

                64KB

              • memory/1060-179-0x000000000A690000-0x000000000A6CC000-memory.dmp

                Filesize

                240KB

              • memory/1060-182-0x000000000AAC0000-0x000000000AB52000-memory.dmp

                Filesize

                584KB

              • memory/1060-177-0x000000000A6F0000-0x000000000A7FA000-memory.dmp

                Filesize

                1.0MB

              • memory/1060-176-0x000000000ABB0000-0x000000000B1C8000-memory.dmp

                Filesize

                6.1MB

              • memory/1060-187-0x000000000C6A0000-0x000000000CBCC000-memory.dmp

                Filesize

                5.2MB

              • memory/1060-183-0x000000000B780000-0x000000000BD24000-memory.dmp

                Filesize

                5.6MB

              • memory/1060-184-0x000000000B2D0000-0x000000000B336000-memory.dmp

                Filesize

                408KB

              • memory/1060-185-0x000000000BD80000-0x000000000BDD0000-memory.dmp

                Filesize

                320KB

              • memory/1060-186-0x000000000BFA0000-0x000000000C162000-memory.dmp

                Filesize

                1.8MB

              • memory/1908-211-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

                Filesize

                64KB

              • memory/1908-206-0x0000000000440000-0x0000000000470000-memory.dmp

                Filesize

                192KB

              • memory/2204-170-0x0000000000360000-0x000000000036A000-memory.dmp

                Filesize

                40KB

              • memory/4488-161-0x00000000001F0000-0x00000000001FA000-memory.dmp

                Filesize

                40KB