d11fa3c76f2c301bd3c2dc33c7736e6c0ed46e989d7ef76369823c33ec0f7496

Analysis

max time kernel
118s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aws2.2.exe
Size

696KB
MD5

54c63e845b75fd07f48739e5d2487ca1
SHA1

e0a8c295ea69905c83aec0603ac0bccc9fb981a3
SHA256

d11fa3c76f2c301bd3c2dc33c7736e6c0ed46e989d7ef76369823c33ec0f7496
SHA512

3f671c41c112ad7b0b4011a7dafd102de8912f1d81c8bc4e21a5ae7de560f6fdb0bb2a770647b7e60c8e082989a8d60ca00cfd00eeabe9091908ba47e86713b9
SSDEEP

12288:fXMhkFCmmrYcJ5wc68dgeSpAp10BWEhQaV+aGEcC7tC5bT9kZetKg3dBdHDit1w0:EyFCmJcTwb8xXAWEqlaGB0yTcgKg3dBI

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	Aws2.2.exe
File opened (read-only)	\??\b:	Aws2.2.exe
File opened (read-only)	\??\t:	Aws2.2.exe
File opened (read-only)	\??\m:	Aws2.2.exe
File opened (read-only)	\??\n:	Aws2.2.exe
File opened (read-only)	\??\r:	Aws2.2.exe
File opened (read-only)	\??\x:	Aws2.2.exe
File opened (read-only)	\??\z:	Aws2.2.exe
File opened (read-only)	\??\g:	Aws2.2.exe
File opened (read-only)	\??\l:	Aws2.2.exe
File opened (read-only)	\??\h:	Aws2.2.exe
File opened (read-only)	\??\i:	Aws2.2.exe
File opened (read-only)	\??\j:	Aws2.2.exe
File opened (read-only)	\??\k:	Aws2.2.exe
File opened (read-only)	\??\p:	Aws2.2.exe
File opened (read-only)	\??\s:	Aws2.2.exe
File opened (read-only)	\??\a:	Aws2.2.exe
File opened (read-only)	\??\e:	Aws2.2.exe
File opened (read-only)	\??\v:	Aws2.2.exe
File opened (read-only)	\??\w:	Aws2.2.exe
File opened (read-only)	\??\u:	Aws2.2.exe
File opened (read-only)	\??\o:	Aws2.2.exe
File opened (read-only)	\??\q:	Aws2.2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Aws2.2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Aws.ini	Aws2.2.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F359AFE1-26D9-11EE-A581-724B81B1CE5D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396607779"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dc65d4e6bad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c000000000200000000001066000000010000200000007ae7f4d27669630fd125e37dedbdae3bf7ba2dc3e2700071b23ca103caee8089000000000e8000000002000020000000757df446ad6fc33395d2baf2e69f7bfcb4aff3c9d12e074d78829e596fd03a73200000007bc2cc5bcd15fa0f9d1d46f3d364757d523b2f8ec66eea0ce82dcca6e4c4a40a4000000094fd52c61e5e6ebc037f3e7de7ed196da63b706b0e54a7e80fdfbfb60e8531a161a63e1747fe4754f1533c6f1db31058c9ee4d12d84da554c78b580e5a41d57f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c00000000020000000000106600000001000020000000b39febbfe00995c3a3311e806169146c6f7981e265c76952d6b1f754486f0896000000000e8000000002000020000000a3c4e6553537b6658610e6c676e6ba9598598e09c804706ae6f9328685658d4f90000000634c61cee898f07e9d42a33100377cb62d9356e8d6dcf3bec1fa6110cf7ea5d304e3e44a5f661f92a6805b91b3d182f6d88e215b5c76ffdb3a563a0dde9b16a79412d7b98cf5f8c3e00232ae07dc14e1df2db6f8df85e12e9f885a39566efeaa4ff706e65156908dc442fa5b235f87c1a0d044bb8ee52f6cb64e77dcd958170e55316df9f1a980f79823b10eacea960d4000000096be08758e96b4915444433844d84ece0dc71ea60da5bdb56cf8d6efc1575dfa625a2d0515b071dd047689af530c42a6b9fb5aeabe54e8715aa35cf72c998c93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	Aws2.2.exe
936	Aws2.2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
936	Aws2.2.exe
2340	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
936	Aws2.2.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
936	Aws2.2.exe
936	Aws2.2.exe
936	Aws2.2.exe
936	Aws2.2.exe
936	Aws2.2.exe
936	Aws2.2.exe
936	Aws2.2.exe
2340	iexplore.exe
2340	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2340	936	Aws2.2.exe	30
PID 936 wrote to memory of 2340	936	Aws2.2.exe	30
PID 936 wrote to memory of 2340	936	Aws2.2.exe	30
PID 936 wrote to memory of 2340	936	Aws2.2.exe	30
PID 2340 wrote to memory of 2836	2340	iexplore.exe	32
PID 2340 wrote to memory of 2836	2340	iexplore.exe	32
PID 2340 wrote to memory of 2836	2340	iexplore.exe	32
PID 2340 wrote to memory of 2836	2340	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe
"C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- \??\c:\program files\internet explorer\iexplore.exe
  "c:\program files\internet explorer\iexplore.exe" Http://10.127.0.162:80/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
98b4411190640145144749dfe98c277d

SHA1
0522f04146c8bfc0b5577900c56621d451069e37

SHA256
e4682574bcf819a2c6117db1a3f1d6f96e8eb623986da03fbc193c572fe5c79d

SHA512
45af15042d173e3561be6577d0576ac98acd26ef899f9a90ffbe5118bec64c915b2ab82d3c9c8b4ffe59a320fdd7545d0aec287e7b9c5bdc41840ed87ed91dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
410d1543a9280b01e6922342a6c9fe22

SHA1
e0a77aa20eb84f4477b4493ba07007110fc93ca1

SHA256
cf4039f17f102abc27845743ce026712e8afb44382f94455205f853aa2a366c6

SHA512
e0752a751f837a495371d0d67f076c988c8f8ecc7406822abb8b0322eb42b03aae02455f1721cc4a5e5d7b47983fc07f4f9b47b594d86bb42d4839490d0786c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6269e7177e776f6a1d50a2bbef6ff3c5

SHA1
117a98d0089ecd09587fee34fd441482e69048cb

SHA256
39ba7ae7bb2bf324267dae3d3073061a14d4eac62857f7c966af8477ac25054c

SHA512
ca2d6fd2e6bacdc1c438058cf9dd5d732934b55ea6497c035ceb30848e2ff43cb812104736553c5cb64ed55f06c7f98aa59c845d1e6cafbd6af60fac7de03cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2b190a467b22aea19efba3c0a62b9bf7

SHA1
377251bdb5eb04db2598ba41682db74d784dbb06

SHA256
392738b3c66e7fee1bed16a5b91e317b84156e2bfad503f93457e9e3ab9179b0

SHA512
97339c91da125032f35e5dfd926408ecdfc36b46b1c9a1e88b712aa989b81646cd7720213f7a35653e995a97f0d3b0f21601877b07fb766fdb606d7dc8311681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
70fee9bbed3585b241c5f56779dbc9ac

SHA1
90a0b823c09af49af4aa1ddfdc1afd6432882b11

SHA256
89ed25b360ee890a25495c211d22a2838c04ebbcebb26ddf900d28c276d82297

SHA512
9afb0ce5fdc7a21f2dc945f263db4ae3015fe3956f90eba6e590be06b18e571c23e63a8c3aede655b145f6ed170ba5bd6dfb02e5de3729c636d79ad620ca7193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1454c91498ed920954e76d7ba59dc698

SHA1
6b8d60ef0c01df6751d9d88019437f0158556c11

SHA256
4dab453aad88304b721f907abc42bb23de8f17d2cbd73d12fbea876574b40894

SHA512
417127c60585f4e69814382fb2a5f65cde49640344bf3b4094e63ce1e3e0472e5d2f5c15f7e33b3c5712e0e59ea4a9d9e5ed368c567eda326dcbfeb8c0d27040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2f04bc3f36b2b49689d47d6b746e85af

SHA1
21a1de8412b16d4c051d89cf6299e9def1d2a71a

SHA256
755d0cd4423390c9cb3e258b06a6718220b0b457746698009115e2f1f44e6056

SHA512
56ac871bd17bc4bfe13298f065114124f3c71be2a85601a2ef5818ef492866eefe0f7d31194c2d0f05497aae585c0041d8cb62df4379ce52a7cb140ccc0b4c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8e5117b83b994da8b86d443dac66266a

SHA1
2654ab7ad43630de79c5c3512763fd29647f240f

SHA256
bba64cffc836d9f257bd01f734911832fcacc12dc8607441f08c4483bf7be6ec

SHA512
3290af8e4050908cfa9cf5e395f4cd5499994abd229da450f18f22a6c825b07e5ca9e29dc08ada4d5cecaabbb6e09de10dc73f93887130a5b9ac734b11c88eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bb655a58277bcbe239aeba77f5ce0563

SHA1
6ecc92b87fabee76d785f3ae7fb74ec7e008c1f9

SHA256
522f7c19f416d163f4941e1ce2af42402d080aba6d28b1a97c8bfded4a78a0a1

SHA512
9463ce7e926022384a4b16dbca6ccf551aea1fca613602ae292511f6143f85a4ec6edf68bffc96512ac1c2dd9f133e09578a3e8dbb8c8cb8db4609a34031f0df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AJTUMOT\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AB0.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FD2.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FNWBTBLI.txt

Filesize
606B

MD5
5ba578f677282b5d93b90162b18a2aca

SHA1
40fa7833bdbd584ee3649c043d3ddfba4af7fd55

SHA256
fe6e9cad260da2936d9ac59032f07f21a230fe45f37d3ea26bfad35cac716abe

SHA512
c22e3d3834c00ea8dad8dda148160a572934d2c8e2c9efe77f3e1146e9e97506f5108021c63053e5796eb2a9f7b1810117f2a22b2c6adb49ca251ea9c9898b3d

Download Submit
C:\Windows\Aws.ini

Filesize
47B

MD5
f1dba6a1b1ccbaa77dfbaa1c82070f01

SHA1
e0d7bcee9f3873ce18eb921983fe36991b9a76c8

SHA256
c39a916801c2260d283464a5bed63476afc643f7c832d6b93f542cf67b42a48e

SHA512
a8a4c771a669e95ac3fc521f0b1052c9ce67724072301dbb4dc3cd4eec88d1e77c6e5d4ca8356a540a77c66ea149ece1644673a51a9838d4c66d0d8ef4bf580a

Download Submit
memory/936-62-0x00000000751B0000-0x00000000751B6000-memory.dmp

Filesize
24KB

Download
memory/936-54-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/936-76-0x0000000076F30000-0x0000000077020000-memory.dmp

Filesize
960KB

Download
memory/936-75-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/936-74-0x0000000076880000-0x000000007694C000-memory.dmp

Filesize
816KB

Download
memory/936-73-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/936-55-0x0000000074B40000-0x0000000074B7B000-memory.dmp

Filesize
236KB

Download
memory/936-77-0x0000000074B80000-0x0000000074C00000-memory.dmp

Filesize
512KB

Download
memory/936-59-0x0000000074EA0000-0x0000000074EA9000-memory.dmp

Filesize
36KB

Download
memory/936-60-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/936-58-0x0000000076880000-0x000000007694C000-memory.dmp

Filesize
816KB

Download
memory/936-56-0x0000000076F30000-0x0000000077020000-memory.dmp

Filesize
960KB

Download
memory/936-57-0x0000000074B80000-0x0000000074C00000-memory.dmp

Filesize
512KB

Download
memory/2340-72-0x0000000002620000-0x0000000002630000-memory.dmp

Filesize
64KB

Download