Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2022, 03:02

General

  • Target

    7af9378762710bb5e1f2090b98e0a515f8680321874262b9834421f7b9b556a9.exe

  • Size

    4.5MB

  • MD5

    12f5f001ec2ef7421599f8415f9d2db0

  • SHA1

    5a7776eb5cb8d3d6c14d9ecbf8157f4df3b4e964

  • SHA256

    7af9378762710bb5e1f2090b98e0a515f8680321874262b9834421f7b9b556a9

  • SHA512

    60eff2d80b7d41f79dc2bb7d8d8430eaf77f87408910f6e4108ec4a219061d3d40f52a855ca59a48f905fcb9c13266c68158130ed0d994732cd5ddf39a6b2c45

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 14 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 7 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7af9378762710bb5e1f2090b98e0a515f8680321874262b9834421f7b9b556a9.exe
    "C:\Users\Admin\AppData\Local\Temp\7af9378762710bb5e1f2090b98e0a515f8680321874262b9834421f7b9b556a9.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Program Files (x86)\System\install.bat" "
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System" +H +S /S /D
          4⤵
          • Sets file to hidden
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:1908
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
          4⤵
          • Sets file to hidden
          • Drops file in Program Files directory
          • Views/modifies file attributes
          PID:1628
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1744
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1676
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:612
        • C:\Windows\SysWOW64\taskkill.exe
          Taskkill /f /im rfusclient.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1708
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
          4⤵
            PID:1472
          • C:\Windows\SysWOW64\regedit.exe
            regedit /s "regedit.reg"
            4⤵
            • Runs .reg file with regedit
            PID:572
          • C:\Windows\SysWOW64\timeout.exe
            timeout 2
            4⤵
            • Delays execution with timeout.exe
            PID:460
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /silentinstall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:516
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /firewall
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1664
          • C:\Program Files (x86)\System\rutserv.exe
            rutserv.exe /start
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1060
          • C:\Windows\SysWOW64\sc.exe
            sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
            4⤵
            • Launches sc.exe
            PID:1584
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService obj= LocalSystem type= interact type= own
            4⤵
            • Launches sc.exe
            PID:1720
          • C:\Windows\SysWOW64\sc.exe
            sc config RManService DisplayName= "Windows_Defender v6.3"
            4⤵
            • Launches sc.exe
            PID:1028
          • C:\Windows\SysWOW64\timeout.exe
            timeout 120
            4⤵
            • Delays execution with timeout.exe
            PID:1964
    • C:\Program Files (x86)\System\rutserv.exe
      "C:\Program Files (x86)\System\rutserv.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1924
      • C:\Program Files (x86)\System\rfusclient.exe
        "C:\Program Files (x86)\System\rfusclient.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:788
        • C:\Program Files (x86)\System\rfusclient.exe
          "C:\Program Files (x86)\System\rfusclient.exe" /tray
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:1212
      • C:\Program Files (x86)\System\rfusclient.exe
        "C:\Program Files (x86)\System\rfusclient.exe" /tray
        2⤵
        • Executes dropped EXE
        PID:960

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\System\install.bat

      Filesize

      1KB

      MD5

      ac3d4997dc463a1cfe688d52de344ddf

      SHA1

      ef333b000e54893263735369f8c5cafd82cf5bca

      SHA256

      840fb0df9bd936936a56d48902da8263c12775e96c489a48718d92ae36395118

      SHA512

      746e53236dc534426e2fe0d07137654e62e912927bfeefb7d3c47ea35d00c7e7b125d723e285f13bb78876a9f8f6778ac31a5683d0677873fcdcd56c8a824006

    • C:\Program Files (x86)\System\install.vbs

      Filesize

      120B

      MD5

      c719a030434d3fa96d62868f27e904a6

      SHA1

      f2f750a752dd1fda8915a47b082af7cf2d3e3655

      SHA256

      2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f

      SHA512

      47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0

    • C:\Program Files (x86)\System\mailsend.exe

      Filesize

      1.2MB

      MD5

      ac23b87f8ec60ddd3f555556f89a6af8

      SHA1

      3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

      SHA256

      80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

      SHA512

      57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

    • C:\Program Files (x86)\System\regedit.reg

      Filesize

      12KB

      MD5

      251212852a073e6fc5fbe3af92f66adb

      SHA1

      6ee07cb20f57830325c11867e68fea49ae0e87ea

      SHA256

      f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb

      SHA512

      f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be

    • C:\Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • C:\Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • C:\Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • C:\Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • C:\Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • C:\Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • C:\Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • C:\Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • C:\Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • C:\Program Files (x86)\System\vp8decoder.dll

      Filesize

      155KB

      MD5

      88318158527985702f61d169434a4940

      SHA1

      3cc751ba256b5727eb0713aad6f554ff1e7bca57

      SHA256

      4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

      SHA512

      5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

    • C:\Program Files (x86)\System\vp8encoder.dll

      Filesize

      593KB

      MD5

      6298c0af3d1d563834a218a9cc9f54bd

      SHA1

      0185cd591e454ed072e5a5077b25c612f6849dc9

      SHA256

      81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

      SHA512

      389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

    • \Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • \Program Files (x86)\System\rfusclient.exe

      Filesize

      1.5MB

      MD5

      b8667a1e84567fcf7821bcefb6a444af

      SHA1

      9c1f91fe77ad357c8f81205d65c9067a270d61f0

      SHA256

      dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

      SHA512

      ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

    • \Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • \Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • \Program Files (x86)\System\rutserv.exe

      Filesize

      1.7MB

      MD5

      37a8802017a212bb7f5255abc7857969

      SHA1

      cb10c0d343c54538d12db8ed664d0a1fa35b6109

      SHA256

      1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

      SHA512

      4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

    • memory/516-89-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-90-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-91-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-92-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-93-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-95-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/516-96-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/788-144-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/788-149-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/788-139-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/788-140-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/788-142-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/960-137-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/960-138-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/960-141-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/960-143-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/960-147-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1060-115-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1060-114-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1060-116-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1060-113-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1060-118-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1060-136-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1212-165-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1212-160-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1212-162-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1212-166-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1212-163-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1212-164-0x0000000000400000-0x00000000009B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1308-54-0x0000000075681000-0x0000000075683000-memory.dmp

      Filesize

      8KB

    • memory/1664-103-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1664-108-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1664-101-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1664-102-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1664-104-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1664-107-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1680-94-0x0000000002080000-0x0000000002739000-memory.dmp

      Filesize

      6.7MB

    • memory/1680-105-0x0000000002080000-0x0000000002739000-memory.dmp

      Filesize

      6.7MB

    • memory/1680-117-0x0000000002080000-0x0000000002739000-memory.dmp

      Filesize

      6.7MB

    • memory/1924-124-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1924-125-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1924-135-0x00000000037B0000-0x0000000003D66000-memory.dmp

      Filesize

      5.7MB

    • memory/1924-123-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1924-121-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB

    • memory/1924-131-0x0000000002E00000-0x00000000033B6000-memory.dmp

      Filesize

      5.7MB

    • memory/1924-122-0x0000000000400000-0x0000000000AB9000-memory.dmp

      Filesize

      6.7MB