Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2023, 03:10

General

  • Target

    a8bf87afacd9767a34350d3df6536b45093c39265cca2df8bfdda2d42578c519.exe

  • Size

    935KB

  • MD5

    17539f9bd8f4b58a6fa66cf8bbfc661d

  • SHA1

    37c2b58943ea61392a333ca5899f1bc7190f3f87

  • SHA256

    a8bf87afacd9767a34350d3df6536b45093c39265cca2df8bfdda2d42578c519

  • SHA512

    9a0499d942a071d8676c38e6184817b7f3a229e9234e55391416f624bb3329837093cb22c50d1df94454f630adec2b83395692e53812592b6dfb2deffea7e0b9

  • SSDEEP

    24576:MyVFPr1scNWvDV18Qk+0LOCNrHMZIj2PpxbgkGwWOGiq4:7n9Wvhy4HC9wIcp/xBGZ

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Extracted

Family

redline

Botnet

gena

C2

77.91.124.82:19071

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8bf87afacd9767a34350d3df6536b45093c39265cca2df8bfdda2d42578c519.exe
    "C:\Users\Admin\AppData\Local\Temp\a8bf87afacd9767a34350d3df6536b45093c39265cca2df8bfdda2d42578c519.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:32
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1458072.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1458072.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3358526.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3358526.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8448169.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8448169.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1336762.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1336762.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4444
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9528344.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9528344.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1348
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7775085.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7775085.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2916
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:772
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                  8⤵
                  • Creates scheduled task(s)
                  PID:3244
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1960
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    9⤵
                      PID:1612
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:N"
                      9⤵
                        PID:3772
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "saves.exe" /P "Admin:R" /E
                        9⤵
                          PID:1848
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          9⤵
                            PID:4364
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:N"
                            9⤵
                              PID:4212
                            • C:\Windows\SysWOW64\cacls.exe
                              CACLS "..\b40d11255d" /P "Admin:R" /E
                              9⤵
                                PID:2960
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                              8⤵
                              • Loads dropped DLL
                              PID:1152
                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7752125.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7752125.exe
                        5⤵
                        • Executes dropped EXE
                        PID:1148
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d0193482.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d0193482.exe
                      4⤵
                      • Executes dropped EXE
                      PID:2788
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:1980
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:3580

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1458072.exe

                Filesize

                831KB

                MD5

                89fe84034351b7d0319af482b3185ce0

                SHA1

                f7ea55c1ebca49d5eba4da8377e6981e4222e476

                SHA256

                80268baedfd795bd7822c4279ceab25d4ef4f0a1413d1e1eb88daffbf29bd67c

                SHA512

                71c840f2de7d36c4f618a04bb10179928ceb0237302ce0d0b995aa574e8c60513cc8a455915b675fee88c9d3ec5e86da262cc669a875790be1808b4c6f8cf39e

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1458072.exe

                Filesize

                831KB

                MD5

                89fe84034351b7d0319af482b3185ce0

                SHA1

                f7ea55c1ebca49d5eba4da8377e6981e4222e476

                SHA256

                80268baedfd795bd7822c4279ceab25d4ef4f0a1413d1e1eb88daffbf29bd67c

                SHA512

                71c840f2de7d36c4f618a04bb10179928ceb0237302ce0d0b995aa574e8c60513cc8a455915b675fee88c9d3ec5e86da262cc669a875790be1808b4c6f8cf39e

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3358526.exe

                Filesize

                706KB

                MD5

                c4db33e4dd489be372253906f9a4b939

                SHA1

                282ec95e8fc210d856befa2da821d95beab26117

                SHA256

                cae0605f7c8091e4ec2938a721d46fdbe8a8c473787418361038b85e920ff9b4

                SHA512

                1d8b583c0e25804f43b687f3acaa7d6ce5f39a35e1969d596cd57b795e203e38cbf180444012f28161c61bfce70f9bb0172a687300eccad03695e0ab78b595d7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3358526.exe

                Filesize

                706KB

                MD5

                c4db33e4dd489be372253906f9a4b939

                SHA1

                282ec95e8fc210d856befa2da821d95beab26117

                SHA256

                cae0605f7c8091e4ec2938a721d46fdbe8a8c473787418361038b85e920ff9b4

                SHA512

                1d8b583c0e25804f43b687f3acaa7d6ce5f39a35e1969d596cd57b795e203e38cbf180444012f28161c61bfce70f9bb0172a687300eccad03695e0ab78b595d7

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d0193482.exe

                Filesize

                174KB

                MD5

                2519b8efebc4c01f7e60061988f572f8

                SHA1

                ca5088873b220c2187b5dd9673c2361f92795b28

                SHA256

                aec4178a866b1c9c759ff8a3b39cc76415330438d8a3f4a87a6be7a74705ec79

                SHA512

                1442e6c684a57d7082a04a3f629029c8d204585ad0910d1e7ebb1b888ea74b8317421cf9a016c674707d75207e7140fd604f4cd0a8eb2673d421dd52e340dd6c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d0193482.exe

                Filesize

                174KB

                MD5

                2519b8efebc4c01f7e60061988f572f8

                SHA1

                ca5088873b220c2187b5dd9673c2361f92795b28

                SHA256

                aec4178a866b1c9c759ff8a3b39cc76415330438d8a3f4a87a6be7a74705ec79

                SHA512

                1442e6c684a57d7082a04a3f629029c8d204585ad0910d1e7ebb1b888ea74b8317421cf9a016c674707d75207e7140fd604f4cd0a8eb2673d421dd52e340dd6c

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8448169.exe

                Filesize

                550KB

                MD5

                884408c3ca0cc4db6627affcd68b2a49

                SHA1

                24b7bb6deb1cfccbff4f724e5e6ba56191d1be13

                SHA256

                7ae3a8da380a01559b03df0274aedb715016312ad11b1397f11086e61a649d9f

                SHA512

                708d5abcc4151954409b909fb4aa5103e7997490801b296b5a37365cebcd167bb519ea6024ed365be9e3053c7afee2e917ed3abf8d1b91ad94a712d26bb79e1f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8448169.exe

                Filesize

                550KB

                MD5

                884408c3ca0cc4db6627affcd68b2a49

                SHA1

                24b7bb6deb1cfccbff4f724e5e6ba56191d1be13

                SHA256

                7ae3a8da380a01559b03df0274aedb715016312ad11b1397f11086e61a649d9f

                SHA512

                708d5abcc4151954409b909fb4aa5103e7997490801b296b5a37365cebcd167bb519ea6024ed365be9e3053c7afee2e917ed3abf8d1b91ad94a712d26bb79e1f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7752125.exe

                Filesize

                140KB

                MD5

                e1bcbdb45522116ca5e5f42c1345c4ff

                SHA1

                8f3155358d495f6f23eada29e200e14022d79631

                SHA256

                5bb500d1190e0b5b17402bc6a6d5c4adb21f6589d9fe79a0c576f0f66ded4b99

                SHA512

                89c013b8bd922d63ff8361189bf377f727f1464deb5de08ed5a64aba9eeba10312e15c1ffe435d4c4388965e4c98a33cbc2c73c0492d46dc3d67ae3382136b81

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c7752125.exe

                Filesize

                140KB

                MD5

                e1bcbdb45522116ca5e5f42c1345c4ff

                SHA1

                8f3155358d495f6f23eada29e200e14022d79631

                SHA256

                5bb500d1190e0b5b17402bc6a6d5c4adb21f6589d9fe79a0c576f0f66ded4b99

                SHA512

                89c013b8bd922d63ff8361189bf377f727f1464deb5de08ed5a64aba9eeba10312e15c1ffe435d4c4388965e4c98a33cbc2c73c0492d46dc3d67ae3382136b81

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1336762.exe

                Filesize

                384KB

                MD5

                3d1b5b6cde6bbb4cf04aa61984dcd592

                SHA1

                ea7ab68a7daeeee2c75cc7f402c5b93716173b62

                SHA256

                26cd23e25dcc849502fb07781414818c352d379da847ecbd1291d809097fde64

                SHA512

                4926a444a944b19018e3492da2149ab7fb9a04966eb5324c48ddb114ee1930fed16c30ee7f5d30889b1e2253f04f2988ca457e6158498eae3847b6a889dcb816

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1336762.exe

                Filesize

                384KB

                MD5

                3d1b5b6cde6bbb4cf04aa61984dcd592

                SHA1

                ea7ab68a7daeeee2c75cc7f402c5b93716173b62

                SHA256

                26cd23e25dcc849502fb07781414818c352d379da847ecbd1291d809097fde64

                SHA512

                4926a444a944b19018e3492da2149ab7fb9a04966eb5324c48ddb114ee1930fed16c30ee7f5d30889b1e2253f04f2988ca457e6158498eae3847b6a889dcb816

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9528344.exe

                Filesize

                185KB

                MD5

                866b2001f0823e726645c498c0444eaa

                SHA1

                157194aad5269a66049d3bdbfd17c849ae96ce60

                SHA256

                dbc020db66cba58acd5763866852b5b70fcac5b7878e670b7fe05fcefa645dcd

                SHA512

                ef5d4f769b909a2295a7071cd737decdf64dd36e25f73e2629e8d156f9951c4f7aab9d626709fdce3b6a5d48b406ed9b4e3f81cf7acb3f3e226fab01f9df39dd

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a9528344.exe

                Filesize

                185KB

                MD5

                866b2001f0823e726645c498c0444eaa

                SHA1

                157194aad5269a66049d3bdbfd17c849ae96ce60

                SHA256

                dbc020db66cba58acd5763866852b5b70fcac5b7878e670b7fe05fcefa645dcd

                SHA512

                ef5d4f769b909a2295a7071cd737decdf64dd36e25f73e2629e8d156f9951c4f7aab9d626709fdce3b6a5d48b406ed9b4e3f81cf7acb3f3e226fab01f9df39dd

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7775085.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b7775085.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                334KB

                MD5

                3ab27ee8c7a14fa73dda8ddb475ad61d

                SHA1

                d6a6594485b0cbd39d8a603ed1f2738e2a2df305

                SHA256

                73339554045910a8360eb3365dfdfceb29856db147b7f7047903d51987900165

                SHA512

                def9c3e29611bd03931e20b7a03868e35a57f6c96ce0242f5dcd560b36adc5861dbccde5c77811e51936699e030751954073d82457e0484c69fae70df1ac16c8

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • memory/1348-56-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-68-0x0000000004A30000-0x0000000004A40000-memory.dmp

                Filesize

                64KB

              • memory/1348-52-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-54-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-48-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-58-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-60-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-62-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-64-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-46-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-44-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-40-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-42-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-66-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-67-0x0000000074080000-0x0000000074830000-memory.dmp

                Filesize

                7.7MB

              • memory/1348-50-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/1348-69-0x0000000004A30000-0x0000000004A40000-memory.dmp

                Filesize

                64KB

              • memory/1348-71-0x0000000074080000-0x0000000074830000-memory.dmp

                Filesize

                7.7MB

              • memory/1348-35-0x0000000074080000-0x0000000074830000-memory.dmp

                Filesize

                7.7MB

              • memory/1348-36-0x0000000004A30000-0x0000000004A40000-memory.dmp

                Filesize

                64KB

              • memory/1348-37-0x0000000004A30000-0x0000000004A40000-memory.dmp

                Filesize

                64KB

              • memory/1348-38-0x0000000004A40000-0x0000000004FE4000-memory.dmp

                Filesize

                5.6MB

              • memory/1348-39-0x00000000049A0000-0x00000000049B6000-memory.dmp

                Filesize

                88KB

              • memory/2788-94-0x0000000004F10000-0x0000000004F22000-memory.dmp

                Filesize

                72KB

              • memory/2788-96-0x0000000004F70000-0x0000000004FAC000-memory.dmp

                Filesize

                240KB

              • memory/2788-97-0x0000000072BC0000-0x0000000073370000-memory.dmp

                Filesize

                7.7MB

              • memory/2788-98-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                Filesize

                64KB

              • memory/2788-95-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

                Filesize

                64KB

              • memory/2788-93-0x0000000004FE0000-0x00000000050EA000-memory.dmp

                Filesize

                1.0MB

              • memory/2788-92-0x00000000054F0000-0x0000000005B08000-memory.dmp

                Filesize

                6.1MB

              • memory/2788-91-0x0000000072BC0000-0x0000000073370000-memory.dmp

                Filesize

                7.7MB

              • memory/2788-90-0x0000000000580000-0x00000000005B0000-memory.dmp

                Filesize

                192KB