Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 00:52

General

  • Target

    277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe

  • Size

    326KB

  • MD5

    79be094ebbacab9532d279b544481c63

  • SHA1

    70440dfceed530a5fc1935ebf5f52d267c58b94c

  • SHA256

    277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666

  • SHA512

    db885234f1415a08e43698473146dd110dfaa808db33f1b5f00c9ce0aa9b8ca53a0587b363a3bb214f04788f17ae5c2e1daa3bf7176a460241f75163e2799793

  • SSDEEP

    6144:THl0ndEmTgkCAaR+aubNawb9VOExRCiMOEoAbzPqGjfRpo:hO5fCAI+Xbswb9VOExxLEB/PdfRp

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • Loads dropped DLL 24 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe
    "C:\Users\Admin\AppData\Local\Temp\277e9cf60f1d52ecd1b7d370cf2b05f6a073ae65dd5b6656b93dcad1260b4666.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1348
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:844
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:952
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1624
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
      PID:956
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:268
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1672
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1248
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1852
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs
      1⤵
      • Loads dropped DLL
      PID:1060

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\helpsvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\irmon.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\logonhours.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\nla.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\ntmssvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\nwcworkstation.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\nwsapagent.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\pcaudit.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\srservice.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\uploadmgr.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \??\c:\windows\SysWOW64\wmdmpmsp.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Irmon.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Irmon.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\LogonHours.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\LogonHours.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\NWCWorkstation.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\NWCWorkstation.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Nla.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Nla.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Ntmssvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Ntmssvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Nwsapagent.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\Nwsapagent.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\PCAudit.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\PCAudit.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\SRService.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\SRService.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\WmdmPmSp.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\WmdmPmSp.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\helpsvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\helpsvc.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\uploadmgr.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • \Windows\SysWOW64\uploadmgr.dll

      Filesize

      326KB

      MD5

      c5128720a51b74c31e8820549611c93c

      SHA1

      4ff792a5ab727e53cb27360d447789e97030c078

      SHA256

      c291970cf388aba68c054871f5c9cc0a6b071683d724bd55cfb9e5ecd1e5226e

      SHA512

      f261e447212e613cc57651b11ba403abcda198a84d8753f5f0533031370ca67ba0e1fa2451f4c84538e98761d9fff3b5524d3ca09b6b6cef1a632a23ae566a12

    • memory/844-62-0x0000000000290000-0x00000000002B3000-memory.dmp

      Filesize

      140KB

    • memory/952-89-0x0000000000520000-0x0000000000543000-memory.dmp

      Filesize

      140KB

    • memory/952-71-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-76-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-85-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-84-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-72-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-83-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-77-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-78-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/952-79-0x0000000000460000-0x0000000000483000-memory.dmp

      Filesize

      140KB

    • memory/1348-63-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1348-56-0x0000000000820000-0x0000000000843000-memory.dmp

      Filesize

      140KB

    • memory/1348-54-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1348-57-0x0000000000820000-0x0000000000843000-memory.dmp

      Filesize

      140KB

    • memory/1348-55-0x00000000750A1000-0x00000000750A3000-memory.dmp

      Filesize

      8KB

    • memory/1348-58-0x0000000001EB0000-0x0000000005EB0000-memory.dmp

      Filesize

      64.0MB

    • memory/1348-67-0x0000000001EB0000-0x0000000005EB0000-memory.dmp

      Filesize

      64.0MB