Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/10/2022, 05:27

General

  • Target

    39bd9c5c4f811d8dcb54d08d6b001f55aec17e1b1379956774c638bcc64e3e8b.exe

  • Size

    731KB

  • MD5

    fabcaa2c45199a48a6a1675791d8c15a

  • SHA1

    ae1421e50557e023e45610ca918dd9c2848598c5

  • SHA256

    39bd9c5c4f811d8dcb54d08d6b001f55aec17e1b1379956774c638bcc64e3e8b

  • SHA512

    e70750f39e722b31fa1c266ff9371c8ca24bc8712c153c44d35a39bccddce09d88cf72e2210eba5de1e2051d3f3bd51b0d42715ddaa99cc9ed9a5d192f327092

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39bd9c5c4f811d8dcb54d08d6b001f55aec17e1b1379956774c638bcc64e3e8b.exe
    "C:\Users\Admin\AppData\Local\Temp\39bd9c5c4f811d8dcb54d08d6b001f55aec17e1b1379956774c638bcc64e3e8b.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4204
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:940
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
            PID:2424
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
        • C:\ProgramData\Dllhost\dllhost.exe
          "C:\ProgramData\Dllhost\dllhost.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5088
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1480
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:1400
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1776
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2916
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:1920
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4672
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:204
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2172
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:1596
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9020" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:1588
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7897" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:2684
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1364" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:748
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3403" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          3⤵
                            PID:2216
                            • C:\Windows\SysWOW64\schtasks.exe
                              SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3403" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                              4⤵
                              • Creates scheduled task(s)
                              PID:4932
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1020
                            • C:\Windows\SysWOW64\schtasks.exe
                              SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                              4⤵
                              • Creates scheduled task(s)
                              PID:4088
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                            3⤵
                              PID:96
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:1572
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                3⤵
                                  PID:2164
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:1400
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                    3⤵
                                      PID:2132
                                      • C:\Windows\SysWOW64\chcp.com
                                        chcp 1251
                                        4⤵
                                          PID:5096

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\ProgramData\Dllhost\dllhost.exe

                                    Filesize

                                    950KB

                                    MD5

                                    2ad4b3ae7935c6857df3985e9c643654

                                    SHA1

                                    160dff9bc66ea348f2646674930a163c61b4d02e

                                    SHA256

                                    f02360e2ac8c72416198bb2bb4dc32640d929f030f80ed2a72a2b03204074a81

                                    SHA512

                                    706a95d3affbf30d8036a458fcf8b174655d25d683772ff610d393cf7a32b8c29822154d622364abea55df721f5152be585b9d254e9973bdf70d567f504e9ef4

                                  • C:\ProgramData\Dllhost\dllhost.exe

                                    Filesize

                                    950KB

                                    MD5

                                    2ad4b3ae7935c6857df3985e9c643654

                                    SHA1

                                    160dff9bc66ea348f2646674930a163c61b4d02e

                                    SHA256

                                    f02360e2ac8c72416198bb2bb4dc32640d929f030f80ed2a72a2b03204074a81

                                    SHA512

                                    706a95d3affbf30d8036a458fcf8b174655d25d683772ff610d393cf7a32b8c29822154d622364abea55df721f5152be585b9d254e9973bdf70d567f504e9ef4

                                  • C:\ProgramData\HostData\logs.uce

                                    Filesize

                                    497B

                                    MD5

                                    13fda2ab01b83a5130842a5bab3892d3

                                    SHA1

                                    6e18e4b467cde054a63a95d4dfc030f156ecd215

                                    SHA256

                                    76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                    SHA512

                                    c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                    Filesize

                                    2KB

                                    MD5

                                    1c19c16e21c97ed42d5beabc93391fc5

                                    SHA1

                                    8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                    SHA256

                                    1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                    SHA512

                                    7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    18KB

                                    MD5

                                    0a66d5219a1c6d4d779c9ff09477247b

                                    SHA1

                                    a792336dacb71f80b1b07707a77cca6ec03a7b27

                                    SHA256

                                    703422c13537dd58f4d24a64ab2a45a1a1083628e317da310376704b19a54155

                                    SHA512

                                    d2e954dbb06edcd76730d528e9d33d35614b122a770e33e9f15dc1a6d5879d90bbea2e4950dcc778b644d9669658af87c1ed714c85802b869070bc6c233b18a8

                                  • memory/940-284-0x0000000008FF0000-0x000000000900E000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/940-247-0x00000000078A0000-0x0000000007BF0000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/940-186-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/940-221-0x0000000000FB0000-0x0000000000FE6000-memory.dmp

                                    Filesize

                                    216KB

                                  • memory/940-226-0x0000000007030000-0x0000000007658000-memory.dmp

                                    Filesize

                                    6.2MB

                                  • memory/940-244-0x0000000006E80000-0x0000000006EA2000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/940-293-0x0000000009050000-0x00000000090F5000-memory.dmp

                                    Filesize

                                    660KB

                                  • memory/940-246-0x0000000006F20000-0x0000000006F86000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/940-252-0x0000000007C70000-0x0000000007CBB000-memory.dmp

                                    Filesize

                                    300KB

                                  • memory/940-297-0x0000000009300000-0x0000000009394000-memory.dmp

                                    Filesize

                                    592KB

                                  • memory/940-283-0x0000000009010000-0x0000000009043000-memory.dmp

                                    Filesize

                                    204KB

                                  • memory/940-500-0x00000000092A0000-0x00000000092BA000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/940-262-0x0000000008010000-0x0000000008086000-memory.dmp

                                    Filesize

                                    472KB

                                  • memory/940-505-0x0000000009290000-0x0000000009298000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/940-250-0x00000000076C0000-0x00000000076DC000-memory.dmp

                                    Filesize

                                    112KB

                                  • memory/3004-144-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-129-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-158-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-159-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-160-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-161-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-162-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-163-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-164-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-165-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-166-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-167-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-168-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-169-0x0000000005340000-0x000000000534A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3004-116-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-118-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-117-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-119-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-120-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-170-0x00000000055E0000-0x0000000005646000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/3004-121-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-122-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-123-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-124-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-125-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-126-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-127-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-128-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-157-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-156-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-155-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-154-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-153-0x0000000005370000-0x0000000005402000-memory.dmp

                                    Filesize

                                    584KB

                                  • memory/3004-152-0x0000000005790000-0x0000000005C8E000-memory.dmp

                                    Filesize

                                    5.0MB

                                  • memory/3004-151-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-150-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-149-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-148-0x0000000000A60000-0x0000000000B08000-memory.dmp

                                    Filesize

                                    672KB

                                  • memory/3004-147-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-146-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-145-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-115-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-143-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-142-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-141-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-140-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-139-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-138-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-136-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-130-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-137-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-135-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-131-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-134-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-133-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/3004-132-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-178-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-184-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-183-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-182-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-181-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-180-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4204-179-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4868-176-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4868-173-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4868-175-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4868-174-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/4868-172-0x0000000077D30000-0x0000000077EBE000-memory.dmp

                                    Filesize

                                    1.6MB

                                  • memory/5088-736-0x0000000000540000-0x00000000005F0000-memory.dmp

                                    Filesize

                                    704KB