Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/09/2023, 14:27

General

  • Target

    4028908d4bcd6337efc4a03e5966d1877b8bfe1e99cb47630e70644aaf681f2b.exe

  • Size

    937KB

  • MD5

    11144f55ffbc371319604e66466a68fe

  • SHA1

    b1c6aadfe77715c3cbf2b26a707efaf3282a7ddd

  • SHA256

    4028908d4bcd6337efc4a03e5966d1877b8bfe1e99cb47630e70644aaf681f2b

  • SHA512

    9cbb435833e432f8c30f02096b80a5ca80a8a33cbd97e6108deccc0c6388d238ac004a86ea4eb2639fe20546d9462d318f0585cc58b6d6c36608463059fa2fec

  • SSDEEP

    24576:Hy7qVdIeOBH8lgc+SjiAtP3Re0dofsQQgQWPvNk:SWOBIgc+SmARk0iv9

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Extracted

Family

redline

Botnet

narik

C2

77.91.124.82:19071

Attributes
  • auth_value

    07924f5ef90576eb64faea857b8ba3e5

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4028908d4bcd6337efc4a03e5966d1877b8bfe1e99cb47630e70644aaf681f2b.exe
    "C:\Users\Admin\AppData\Local\Temp\4028908d4bcd6337efc4a03e5966d1877b8bfe1e99cb47630e70644aaf681f2b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2923734.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2923734.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3010580.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3010580.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9022815.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9022815.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4938591.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4938591.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4904
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9390538.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9390538.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5104
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3003287.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3003287.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2056
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4116
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                  8⤵
                  • Creates scheduled task(s)
                  PID:3920
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4264
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    9⤵
                      PID:3464
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:N"
                      9⤵
                        PID:5024
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "saves.exe" /P "Admin:R" /E
                        9⤵
                          PID:4160
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          9⤵
                            PID:396
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:N"
                            9⤵
                              PID:4596
                            • C:\Windows\SysWOW64\cacls.exe
                              CACLS "..\b40d11255d" /P "Admin:R" /E
                              9⤵
                                PID:4828
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                              8⤵
                              • Loads dropped DLL
                              PID:2652
                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c1838166.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c1838166.exe
                        5⤵
                        • Executes dropped EXE
                        PID:2180
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d3089570.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d3089570.exe
                      4⤵
                      • Executes dropped EXE
                      PID:3132
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:1840

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2923734.exe

                Filesize

                830KB

                MD5

                a2a190e3efb9c787de76e4ee006de8af

                SHA1

                7706db78398b2bd00355de3c1792992c98430620

                SHA256

                755b539136900bfb2eb586d98719ff843baabf409e484809e3146ec8ca71e53d

                SHA512

                871c5d7a00fb3ce25f337eec53f401db599a97c17b0c3121c6a030121497e1e11ba115b6697dac2271ed7b1e4a9fe24f9b305dae8bc987466840cca3047883e3

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2923734.exe

                Filesize

                830KB

                MD5

                a2a190e3efb9c787de76e4ee006de8af

                SHA1

                7706db78398b2bd00355de3c1792992c98430620

                SHA256

                755b539136900bfb2eb586d98719ff843baabf409e484809e3146ec8ca71e53d

                SHA512

                871c5d7a00fb3ce25f337eec53f401db599a97c17b0c3121c6a030121497e1e11ba115b6697dac2271ed7b1e4a9fe24f9b305dae8bc987466840cca3047883e3

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3010580.exe

                Filesize

                706KB

                MD5

                12ac7df5fb169d26173c27ad941625a9

                SHA1

                7c14bbb924b1c51516c81a87fd12ef36cfbb7a88

                SHA256

                3ee43b19e2e75e3b998c1c67c6c5f6089caefec958e449294668462c513387d5

                SHA512

                6bda79b487fbe9df7273305856b052945ec507882d75c5e2799e0985df19c6395cfaa43b1b724cf99d58313c360fc6f0e782127ba673df2f1bedde9347c7c60d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3010580.exe

                Filesize

                706KB

                MD5

                12ac7df5fb169d26173c27ad941625a9

                SHA1

                7c14bbb924b1c51516c81a87fd12ef36cfbb7a88

                SHA256

                3ee43b19e2e75e3b998c1c67c6c5f6089caefec958e449294668462c513387d5

                SHA512

                6bda79b487fbe9df7273305856b052945ec507882d75c5e2799e0985df19c6395cfaa43b1b724cf99d58313c360fc6f0e782127ba673df2f1bedde9347c7c60d

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d3089570.exe

                Filesize

                175KB

                MD5

                99b670bba56277b30b8075d05c739a13

                SHA1

                cc0e42f4640eaf3b98dc89f0f59ca2644781ee70

                SHA256

                b324a0060f3633364b21e3665cf3fa7d74b2b79fa6d7fecca944571f6fcfdf28

                SHA512

                fd37e36f79e94eceeddbe30dc8deb1367b20da9b2e56cb5020fbe06e0d820c114a536a143c3b2e28ad71e530ed162ffac865159bbf9a4d4de53e339c71181073

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d3089570.exe

                Filesize

                175KB

                MD5

                99b670bba56277b30b8075d05c739a13

                SHA1

                cc0e42f4640eaf3b98dc89f0f59ca2644781ee70

                SHA256

                b324a0060f3633364b21e3665cf3fa7d74b2b79fa6d7fecca944571f6fcfdf28

                SHA512

                fd37e36f79e94eceeddbe30dc8deb1367b20da9b2e56cb5020fbe06e0d820c114a536a143c3b2e28ad71e530ed162ffac865159bbf9a4d4de53e339c71181073

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9022815.exe

                Filesize

                550KB

                MD5

                bd0d8a256e1707e470bf6433381445ba

                SHA1

                144d586180d065d52ee619e9d4a097ad40ed3f3c

                SHA256

                3e2d6a4c95433f240ed8e5ce628cbb80d7757b0443ed9c916c39f46a7760cb7d

                SHA512

                196dc75b722ecbebd15a64b66b66e2098d7b290a038fde812ce5c171a6e2993c3cecc558fb25ef822cbeeb101e99a8d230a9aae790d2aa131e7bc83c01ee1cf2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9022815.exe

                Filesize

                550KB

                MD5

                bd0d8a256e1707e470bf6433381445ba

                SHA1

                144d586180d065d52ee619e9d4a097ad40ed3f3c

                SHA256

                3e2d6a4c95433f240ed8e5ce628cbb80d7757b0443ed9c916c39f46a7760cb7d

                SHA512

                196dc75b722ecbebd15a64b66b66e2098d7b290a038fde812ce5c171a6e2993c3cecc558fb25ef822cbeeb101e99a8d230a9aae790d2aa131e7bc83c01ee1cf2

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c1838166.exe

                Filesize

                141KB

                MD5

                8920d388de1c8c5eb2eda4322d7320cd

                SHA1

                994a45fee82db54abe4aefda7e902f71a0582de4

                SHA256

                8fc20a12a2881d04dbd3b31e55f593e3c26d7789ee3eee2af0a319feafd6c412

                SHA512

                43d6cc7a2c014e853326fbed44a8869e3d2659219a619a644f202326a2f486adda25beb8137c9bb44b7a08fc373a507e332f2e21ef7b430c4b9b99c229864fc4

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c1838166.exe

                Filesize

                141KB

                MD5

                8920d388de1c8c5eb2eda4322d7320cd

                SHA1

                994a45fee82db54abe4aefda7e902f71a0582de4

                SHA256

                8fc20a12a2881d04dbd3b31e55f593e3c26d7789ee3eee2af0a319feafd6c412

                SHA512

                43d6cc7a2c014e853326fbed44a8869e3d2659219a619a644f202326a2f486adda25beb8137c9bb44b7a08fc373a507e332f2e21ef7b430c4b9b99c229864fc4

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4938591.exe

                Filesize

                384KB

                MD5

                015d902fa830e481f8c51593a9b9a748

                SHA1

                dd22628aa11fad9ecc8430569d13ae06afa85900

                SHA256

                1b933a72d4a0ce76caca90541562617fc7cb1f8836b82f7d80933d8f8c291a8f

                SHA512

                8f07bbff11e78a122c3d1c7bbb5d8ebd95a4cae3aa5095765f72419b27bc5f94b5af47ef713a522dcce6c48ca77a84a5ce297f67747a33131039e203ad3528aa

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4938591.exe

                Filesize

                384KB

                MD5

                015d902fa830e481f8c51593a9b9a748

                SHA1

                dd22628aa11fad9ecc8430569d13ae06afa85900

                SHA256

                1b933a72d4a0ce76caca90541562617fc7cb1f8836b82f7d80933d8f8c291a8f

                SHA512

                8f07bbff11e78a122c3d1c7bbb5d8ebd95a4cae3aa5095765f72419b27bc5f94b5af47ef713a522dcce6c48ca77a84a5ce297f67747a33131039e203ad3528aa

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9390538.exe

                Filesize

                184KB

                MD5

                63207136900ee4e2d6be52043fba88f4

                SHA1

                117e25dc1c9cdce10afef11ecd5972d7baeb147b

                SHA256

                75aa6416141584f8464fdbe2c4dfa89e8a1352f6903f5a83ccc301a83750ca6e

                SHA512

                998e2b3ca8ad3e6fdc47a59391de553496acccc0f063241ef477303f64a9357817929496f99e2cfb9302b5bb5d6899049bf8aaccb8b57b042fd631b75b532ade

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9390538.exe

                Filesize

                184KB

                MD5

                63207136900ee4e2d6be52043fba88f4

                SHA1

                117e25dc1c9cdce10afef11ecd5972d7baeb147b

                SHA256

                75aa6416141584f8464fdbe2c4dfa89e8a1352f6903f5a83ccc301a83750ca6e

                SHA512

                998e2b3ca8ad3e6fdc47a59391de553496acccc0f063241ef477303f64a9357817929496f99e2cfb9302b5bb5d6899049bf8aaccb8b57b042fd631b75b532ade

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3003287.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3003287.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                333KB

                MD5

                eb9e9584bfec5087944faeffab43f3ab

                SHA1

                dd384e4f8e0577d8455225331f54e46404611153

                SHA256

                036227ae1af538fa3f4c268746a102bd78e5505093801c8c48ccca5a8cddee42

                SHA512

                fac2395bb0467222012716e75b0240a09baeed6e8a02d3e80f5cc867312bf49fb0a57f4a506ff950beaaf012db12e4f93818e9b1a846d6a52e724125f4d65ddb

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/3132-93-0x00000000727C0000-0x0000000072EAE000-memory.dmp

                Filesize

                6.9MB

              • memory/3132-85-0x0000000000080000-0x00000000000B0000-memory.dmp

                Filesize

                192KB

              • memory/3132-86-0x00000000727C0000-0x0000000072EAE000-memory.dmp

                Filesize

                6.9MB

              • memory/3132-87-0x0000000000890000-0x0000000000896000-memory.dmp

                Filesize

                24KB

              • memory/3132-88-0x0000000004FE0000-0x00000000055E6000-memory.dmp

                Filesize

                6.0MB

              • memory/3132-89-0x0000000004AE0000-0x0000000004BEA000-memory.dmp

                Filesize

                1.0MB

              • memory/3132-90-0x00000000048A0000-0x00000000048B2000-memory.dmp

                Filesize

                72KB

              • memory/3132-91-0x00000000049D0000-0x0000000004A0E000-memory.dmp

                Filesize

                248KB

              • memory/3132-92-0x0000000004A50000-0x0000000004A9B000-memory.dmp

                Filesize

                300KB

              • memory/5104-38-0x00000000023D0000-0x00000000023EC000-memory.dmp

                Filesize

                112KB

              • memory/5104-69-0x0000000073880000-0x0000000073F6E000-memory.dmp

                Filesize

                6.9MB

              • memory/5104-67-0x0000000073880000-0x0000000073F6E000-memory.dmp

                Filesize

                6.9MB

              • memory/5104-66-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-64-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-62-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-60-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-58-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-56-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-54-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-52-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-50-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-48-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-46-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-44-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-42-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-40-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-39-0x00000000023D0000-0x00000000023E6000-memory.dmp

                Filesize

                88KB

              • memory/5104-37-0x0000000004B00000-0x0000000004FFE000-memory.dmp

                Filesize

                5.0MB

              • memory/5104-36-0x0000000073880000-0x0000000073F6E000-memory.dmp

                Filesize

                6.9MB

              • memory/5104-35-0x00000000020B0000-0x00000000020CE000-memory.dmp

                Filesize

                120KB