Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2024, 10:10

General

  • Target

    6d094c28983399f4e67187df97acb68e.exe

  • Size

    624KB

  • MD5

    6d094c28983399f4e67187df97acb68e

  • SHA1

    7fd102da844cc18501ba536222e4192aaa4f2f64

  • SHA256

    66d97c4d0bbce8d037eac53dab2c813863517a1e85fe8c06277a5bef1b6d6a7d

  • SHA512

    e5d64676b0d85acdc3d2412b7f2dfd791c17ac13b9246602c46d7d655f85aaf243703c34c4a3233b39ee5c3f30a0340856ff716c51a4cf183ba0ae549b73d4bc

  • SSDEEP

    3072:tSq4n6wVOvf2cxuIMMcxuIMLb8YZCuFqa/wnHCKK8GgiY:tSqoVm2cTcY8WYRcznY

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://archive.org/download/runpe2_20210708/runpe2.iso

ps1.dropper

https://archive.org/download/runpe1_20210708/runpe1.iso

Signatures

  • Blocklisted process makes network request 46 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d094c28983399f4e67187df97acb68e.exe
    "C:\Users\Admin\AppData\Local\Temp\6d094c28983399f4e67187df97acb68e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\Pictures\cc.exe
      "C:\Users\Admin\Pictures\cc.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        PID:2732
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Pictures\Defender32.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -command C:\Users\Public\Datax.ps1;
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    f7e4c8452cdf200480fa4094cc38b372

    SHA1

    0e84402d1bc349798af9fb6b63caf48adda24e03

    SHA256

    d1964bb89c23e5017e76326e66a90dad12d25f54cf63a86d616413c29c235652

    SHA512

    baa1302676e17445ba440e86cdfb6539963e6bfa27bc2607b7344bdd896f875e1a28f714a43458557fa9358877ed9cab6447cb5e2a1b52ff37594ad5b74835a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4b595f8d12aafc572fad88dc62aa9cbc

    SHA1

    3dc0b3180c641eb0c785fc6e3769ab9a0f76a0aa

    SHA256

    c8447e1d2fb7efd6bcc7c20fe60f20af3792d79087d79fd6742cdfb5a002e9a1

    SHA512

    ce871745d4ee7c67f8a4d764a49ab9aefafe640f660c96b85874b46b3959800524a8a10da60582c5082fe3470e32e2d96c9d2e33ae6f156be4d62d46faeb30f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e1375e8c8065d26bd169d57f662f96bc

    SHA1

    985ca13368067d10027610ffdb87e6d81ec557be

    SHA256

    a5f07068d058010bd41acd3d6faf9bee46449877919de7336a91c0909cefac9f

    SHA512

    810f72092235e2396853e9d4c0e0d0bc8829dc54897e0dbe0f86361468706e1a6dcbc78d22104000270b35d6e0f39de6b487006641b8323ab0be7e299bb59fd5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f6a9ab11bd7adce9bd41b3601471ffe2

    SHA1

    df1ab5c78d72173b899f4192072d21f350c642ef

    SHA256

    c980909f527d727cae51402809d26c75d8346181b2f5d5b6d17bd952fc5178a0

    SHA512

    51b5b1b1e80a472425175998b58747a1c71910a67d833327f573ffa876a836c729071c26c6e63464a4b5ee4ff55f8e5b3df9a4b986f4697473e2d4e2cfd0127c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3db4ba0a824e92fa7046263563c50384

    SHA1

    7edf55d9a87dff387e95860fcf3248f8aa608a18

    SHA256

    7875fc01d8e054c0e06ca7bc1f1bfef7bb10eb1e3c8050c9e52aab74cb97929d

    SHA512

    6c46453a6df132885143af34cec525bbcbdceeedf585d93a7d3c02d8bd8e11e3ec9be09de803c29ffd84cb7d9ec9fcf53f440ba3ba5a4ecb8a39a7e7bb4d31e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6f58c47c60599870bfa001af001b2ee2

    SHA1

    d8ec7c86d43e6bd52bcd9dbe33599ca8385aa097

    SHA256

    748ccf4b8738f1bfe9aaa313bc3b1cc9763c46ca6612548f8aacf72007aa9eed

    SHA512

    640e0714625704c1f47c7260c666ede2fe9aa9ef06af93e78ae19fe637b4bf56a5475ba93b85eb1e632ea29c99b355537c5e9aceeb872a1984b980d81c32b10d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    603cda92f7525978406ec4a91e3b5283

    SHA1

    7160d3ef56bce6373757d2c8ab60b0b8e90d42e6

    SHA256

    41e9a39d8b336d2ebb0f155f65669a924740733569df321ab4f23a2c9b432bc4

    SHA512

    f061a0e76f70c67c49bae658afcd43764b5c2163ce6f453e4abb3305c215c1859916446be29c2613208b8dbd61530b393d8d9b40833c5613aaba30ec651af91c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cbe795a9794a6cc47892459df91c3c50

    SHA1

    2db77bbb4acb2e61d4b7ae4ad1b087c615eef0ed

    SHA256

    9efaa39f766f353533ef975f613d93d799339e4afacbe5dd8832ad29dc7d9d3d

    SHA512

    feaf28851722e8efb390755676994754752d64e59474826b2e0de2f486d839bd78cc184eb798e0f08d702ae6fddc804dde3f5a7db5c016e8e6753895d576b52b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ab225fde7b09c6f456ccde812c425325

    SHA1

    9cfe9e658ae3b20e68ce25bcfd37cf18303726d4

    SHA256

    2adf17f5fb585da6a4c1d7b1ebecf2b80663701e53a619d0a9e58451b351c0de

    SHA512

    fba390f1ad4fef987a98bc3fdd094627dfe5054c3af634b02f68b7e5b9bbffd83b507028c9a4d93c594f03512619569b0376fa9fc992ae208c8b92bd8a2ce1b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dca85b01f91228494d2c6d1655281240

    SHA1

    e9d4eb7f5272fb13d64a5a92a48670a5b567f0b2

    SHA256

    956f1a64e11e8e15cc127a29fc2efe76cad1a828f07997dab93b88d16b137b46

    SHA512

    e4e310cfe2263b1b29523de958e1a845b10df64522599cca2e47f4084097e748026ca67611c26d5bd8641bceb9b9ca44a7932389a6a577f973dd5058dabb02d6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6e5357e19e12a84170417150c3bf825a

    SHA1

    41c49cc9627decb95318ed11c8ab8d51d85f7f2e

    SHA256

    3055ea64092b77cb7b8baaea892952446320254d9b96b0513192a1a7690b987a

    SHA512

    8834b3d0e3474a04c7f2d46c5007345fb26c6734ca31575c71e6fc468d6b9dbbfa3ceb2bf5a0106ecc9d6c1b7177605759412c86928de293c7445f6abf520850

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ae0fc8401c38a81ae3564aa5a5d26373

    SHA1

    3c5aa8abbf165107f6980871a7ca77829ab6fc58

    SHA256

    0842a8bcf6e3c9a483b50d5a1d4de3b7fbdb6b56a2cae7a8b92f544aac578efa

    SHA512

    a07b44c0f96663612d1f831704466d0b0c87414db6a2852d165c50b2ec7a317a9180e7f10a2d59fdcecf00003d549ecbdd0db7e6a4c5dbf0dd4953933d5faafd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ccd03f8ac5e38aa3f1674703ecd40ce6

    SHA1

    490435a763757d9d1a6a9e6667aca49b43ee5f81

    SHA256

    83d8d119ec350bc155c7194b18eba3036e1e64b7a2f6e888b94553bf0836399d

    SHA512

    481a7050d85f092326e612ff88f37d8b831331ba6e25ccf5ea1f70147e13d92d15bd728b7a8d195203792e1deafd66366eb375178f3d1ea8b0895c9eaf2312ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    eec284c6e09d03e4a3f7e3c6fe4ee5aa

    SHA1

    99badcf974b660cf3eeb2409edd1559bdab50300

    SHA256

    74c62dd75f8b251a3c28d8b23deac2f3f3ff319fdeee64b4189330dfc168b4d0

    SHA512

    5afc74c64700c05f801a78b09d25c1c4704d16075fb6c473b4fde8d414415e9e54bed28ce033f11af7b050974f8d5cc4101e11b39d42d6fbe9ef8e330f9d1a0c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d27edbdf17398a75f71200ea053ae8a1

    SHA1

    7ca30e9b58dc00504eeb7aee9afe663a67454709

    SHA256

    eab99f923978e575b8693402994c8b12fe9b14b02609c722db060f36f591e0a3

    SHA512

    7dff24f95bc86a4e0d865e1ab9b68e5898734ee1d927ed3bfaef801798635dc2ecf3d60fbe4f0972376c042f632b7dc2acec7a7421976e670d50bb1a0f554f08

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    03ed19be1982d7f375ffe54a05defe39

    SHA1

    1030d4c9a09cc24135ef808a7a07b30203131d30

    SHA256

    72f2d299acd493cb22defbb49abd4e1dbf1b88f22853d17bbbcafeb48bdba69a

    SHA512

    23872895ea6e37ae764749a272b4ae321285ba4e3acebeb25e078af2af53fc0147d9a0fc4b8aa04d4d1267371c444422fc4e2a3999faa8b9b74495e020ad354c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1cd13fd8823c38a658b7325be7d9a8a6

    SHA1

    859d92787af6319e1654ab48f6925976164db269

    SHA256

    f601c5ca237dc4e7e2b4f2f27655a3498fab6ced3959c4d2f1f989218e0d53bc

    SHA512

    dcbebd361cfdcd7bfbd2760eb1281eee5b462167934eac8410aa5036df260845d938719ef782b94fe52958497ca8363543ce092cf05f80e9bb52c17e45177d1c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4b3d1f0f84fe9a4c0b950e876f438c14

    SHA1

    36fde85994d935ba2820b7deeef43a3a2f985db8

    SHA256

    7088eece5ae7bcab2f46bf28bf45718ec3210f8e1add9610076150bdc8218bd1

    SHA512

    31082247e18dd013a750a512ad9cdabd9aaf1dff67922750ab5f34fb4998b3db3586ecdd6af29b68e2600dd56f24f747ebddee76569abe693906704cc8680856

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4782811627b78e5b43b4fef303c947e4

    SHA1

    f10a4dbb602f704ab51aeb903f2b5cd16d772733

    SHA256

    ced62f06efb13a84175041f0e2d2c4c5c2eada55c6c3990a8029ea7a2f672dfa

    SHA512

    cd8dc8a6e0363c1e7fa8a922d0443cf5062604976440109b060f5429e8c7108d017154bf0c3eed389d062b576551740baa4e2e04fcd3bcf996cf4c34c0f8a9fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    55945e2fb1cdd35d8258123f0436c375

    SHA1

    27d2c7c4a93448cd01a53ca55e9a75148cff5bf5

    SHA256

    a57228c189a261c75ccd5f2dc52e7b0211165d5ce0433131cc0655a77bb7122e

    SHA512

    c8b0c6dc01d628fb2f1f2c3264829a619836f6fad0158cc6f8db9fd7af334caf68686651bc3264aad92f70d3d3c806c60488b4c49acb9f7e357f7d25fe9bdbf9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    85b9f95b29f4127b1cd64f09709f9264

    SHA1

    1fea52cf06b969db64c52ab497e350ce70b75130

    SHA256

    47b04b385bd26623a7d90b7f25a4017d9733ef6736b7a89e51cb12ccce78bf6e

    SHA512

    adf67fc2de230b4c0ce3215fddf9926a6061659cd950ae9fb16956e9f0a75f19296e34057adc95103f3b16efc57809e88060662728bd3cd2e8745ac0c44ac627

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bb38319432bf1928ea66ab9bfec19568

    SHA1

    998427ab6b526e1b3b372e861f8048885333a12e

    SHA256

    1a273722a70815c44346f3837b37b6a34bc05b446c31837793ba2788e77c8869

    SHA512

    bb0e796109cebb0cbd3a41f30b9865326b010cf9273e431763f610ed18c6a5631ffc86aec93b5984bc5823c53daf476cecb15de66dca36a1c991c10b357f3b81

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\application-b11c2d1e.chunk[1].css

    Filesize

    217KB

    MD5

    3fc554971b188eadc7e36861a404b9c1

    SHA1

    f65a47f13a55ca6b771d612112b33c10683d6915

    SHA256

    a687f0e999d5343a576d0c6b1a13ff14114d558aa31c1ccd61b4e682f687add0

    SHA512

    19d23e2c0454d4194d3f94650f93d28461706279416c7fdd3da4ad8157e1137699a690c902048646d67211b336ea77e5becfb918406d4fcc235f260004b39aec

  • C:\Users\Admin\AppData\Local\Temp\Cab5044.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar5057.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\Pictures\Defender32.vbs

    Filesize

    15KB

    MD5

    3e440309fcf0deb8219c7f97bfbb2141

    SHA1

    ac8188052c50230b10451140a4e4ae53a07aa60b

    SHA256

    f34dc24cdbd5dba5de9ed0cfc5c7e3ce5a504c12e6631ec2aec7cd749007b11f

    SHA512

    03729f0bb30920e4d6045dce97fab5e984eca0572009bd412166376cc676a6b1336b12daf3649d53edbc9012349b54923e3cef4faed7c5d794c1aeb8228c3945

  • C:\Users\Admin\Pictures\cc.exe

    Filesize

    563KB

    MD5

    b3e4312db76b35663728f2ce7fae143a

    SHA1

    b3884a89f4ecd469ebaad3a03ff7e89145cc427b

    SHA256

    68fe607aa500c33f3b69d274bcf770622594df431cd25780090f3ef5a7f75539

    SHA512

    7f0a7a57385990390c949724b166c1683833150bb892881a4d7b171a970e0649a9d7206b9b2d0a88b607d16105cdd9c1dec1a761872bc17c16e559f9c27b9a95

  • C:\Users\Public\Datax.ps1

    Filesize

    613B

    MD5

    36d123f188849666f11e983230b62722

    SHA1

    76d8c01a5de6d397aea011e011df032a1a3bab6c

    SHA256

    512514eae37973872640a41cce70e6b825a6d7e4da50ee25d35d37e352f67514

    SHA512

    0977f7eb3eeed46d778e3467ea9115bae82caf9f2664f3f76e762a099bb1daa098520af590b6c030f36ae2516707be6f84eae1788d76492e800ae3e2df27f632

  • memory/1168-1692-0x00000000026F0000-0x0000000002770000-memory.dmp

    Filesize

    512KB

  • memory/1168-1697-0x00000000026F0000-0x0000000002770000-memory.dmp

    Filesize

    512KB

  • memory/1168-1695-0x00000000026F0000-0x0000000002770000-memory.dmp

    Filesize

    512KB

  • memory/1168-1694-0x00000000026F0000-0x0000000002770000-memory.dmp

    Filesize

    512KB

  • memory/1168-1691-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

    Filesize

    32KB

  • memory/1168-1698-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/1168-1693-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/1168-1689-0x000000001B290000-0x000000001B572000-memory.dmp

    Filesize

    2.9MB

  • memory/1168-1699-0x00000000026F0000-0x0000000002770000-memory.dmp

    Filesize

    512KB

  • memory/1168-1690-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/2216-0-0x0000000000F90000-0x0000000001034000-memory.dmp

    Filesize

    656KB

  • memory/2216-1022-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

    Filesize

    9.9MB

  • memory/2216-1-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

    Filesize

    9.9MB

  • memory/2460-10-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-1681-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-1680-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/2460-1682-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-1688-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-1679-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/2460-1558-0x0000000026330000-0x0000000026AD6000-memory.dmp

    Filesize

    7.6MB

  • memory/2460-8-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-7-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/2460-9-0x000007FEF2CF0000-0x000007FEF368D000-memory.dmp

    Filesize

    9.6MB

  • memory/2460-11-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-12-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-13-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-14-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2460-15-0x0000000001FB0000-0x0000000002030000-memory.dmp

    Filesize

    512KB

  • memory/2732-16-0x0000000001D30000-0x0000000001D31000-memory.dmp

    Filesize

    4KB