Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/10/2022, 06:06

General

  • Target

    a98e224833552894b1717b036d5e40e8247a105b6e62da6da0a3e051979b7aed.exe

  • Size

    733KB

  • MD5

    d701e7ebc381460a623eb38f6e067819

  • SHA1

    c4f77e40fbc63c8ba934e13253256f42ca71d90d

  • SHA256

    a98e224833552894b1717b036d5e40e8247a105b6e62da6da0a3e051979b7aed

  • SHA512

    db5b9aa4f83fabcf4660e0375ee537de55d54cc4dbfa53da8b9657df47cda35771fe35ffeacb486c154857537226c8f937c2c012638deeaf8300827fbe918e4c

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a98e224833552894b1717b036d5e40e8247a105b6e62da6da0a3e051979b7aed.exe
    "C:\Users\Admin\AppData\Local\Temp\a98e224833552894b1717b036d5e40e8247a105b6e62da6da0a3e051979b7aed.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4288
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3828
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4368
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4504
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4296
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:1360
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3572
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4560
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:956
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4428
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4952
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:1744
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3098" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:2228
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5376" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:3948
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk176" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:4344
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk176" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:1548
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1582" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4304
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:1272
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:5036
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:652
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:4708
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:808
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:4496
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:4632

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  961KB

                                  MD5

                                  9319d92066d7aec70fe1a0351c8b00ca

                                  SHA1

                                  402d86b45cf6e52e118ce02bbe3e510950885edb

                                  SHA256

                                  2147462f3398edbd92644892f568952d7d01a1c9bb49917f315a8040b23682b1

                                  SHA512

                                  7cc533eaf85cc42546f997bb3f96245598b16d56ed7ef1fbb1a9f49d6b8afbb7a3e69f50f92a710befea5daeb9fe905f058429c41f4343cd7f7602c9d41429ac

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  961KB

                                  MD5

                                  9319d92066d7aec70fe1a0351c8b00ca

                                  SHA1

                                  402d86b45cf6e52e118ce02bbe3e510950885edb

                                  SHA256

                                  2147462f3398edbd92644892f568952d7d01a1c9bb49917f315a8040b23682b1

                                  SHA512

                                  7cc533eaf85cc42546f997bb3f96245598b16d56ed7ef1fbb1a9f49d6b8afbb7a3e69f50f92a710befea5daeb9fe905f058429c41f4343cd7f7602c9d41429ac

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  1c19c16e21c97ed42d5beabc93391fc5

                                  SHA1

                                  8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                  SHA256

                                  1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                  SHA512

                                  7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  dd528b8761943dfb22d51fb2174cea1d

                                  SHA1

                                  802bf831b5d9658d14e73549df6849d19be910ab

                                  SHA256

                                  aae511ebb2e722eefc9a5807ed72702fe909ae7e9a4b835b089448b4481c1db8

                                  SHA512

                                  835eaaeebbdddf2791d482a4a48c081447b89acba67005ea769f0382d19c3612d6e4015eed3df4fd42f5d1a9183025a7243291ed71d98639ce44d99c195d2dc1

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  c5e512605e1107a886332f259e75f0fe

                                  SHA1

                                  a718117973b460d505e82806e611e662aa649939

                                  SHA256

                                  ed60ee3a601ca8951c0bfd54d880309745590c07c3ce953471bf377f3345eec5

                                  SHA512

                                  0bd0cdc33b90c250c8c4892c57bc341d62fe16eca018d0837af9c650130da9212cf55a30b03e13572d9a01d70d38a73864f40829f8b3dbbce7bda36b783866b7

                                • memory/1016-947-0x0000000000EB0000-0x0000000000F60000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/4288-222-0x00000000049E0000-0x0000000004A16000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4288-187-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4288-284-0x00000000095E0000-0x0000000009613000-memory.dmp

                                  Filesize

                                  204KB

                                • memory/4288-227-0x0000000007740000-0x0000000007D68000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4288-245-0x0000000007450000-0x0000000007472000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4288-247-0x00000000074F0000-0x0000000007556000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4288-248-0x0000000007E50000-0x00000000081A0000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/4288-251-0x0000000007600000-0x000000000761C000-memory.dmp

                                  Filesize

                                  112KB

                                • memory/4288-256-0x0000000008540000-0x00000000085B6000-memory.dmp

                                  Filesize

                                  472KB

                                • memory/4288-252-0x00000000082A0000-0x00000000082EB000-memory.dmp

                                  Filesize

                                  300KB

                                • memory/4288-506-0x0000000009870000-0x0000000009878000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4288-501-0x0000000009880000-0x000000000989A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4288-298-0x00000000098E0000-0x0000000009974000-memory.dmp

                                  Filesize

                                  592KB

                                • memory/4288-294-0x0000000009630000-0x00000000096D5000-memory.dmp

                                  Filesize

                                  660KB

                                • memory/4288-285-0x00000000095C0000-0x00000000095DE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4388-179-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-181-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-182-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-180-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-183-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-184-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4388-185-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-145-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-148-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-117-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-118-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-119-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-171-0x0000000005460000-0x00000000054C6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4792-168-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-170-0x0000000005200000-0x000000000520A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4792-169-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-167-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-120-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-121-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-166-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-165-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-164-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-163-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-162-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-161-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-157-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-159-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-160-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-158-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-156-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-155-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-154-0x0000000005290000-0x0000000005322000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/4792-153-0x00000000056F0000-0x0000000005BEE000-memory.dmp

                                  Filesize

                                  5.0MB

                                • memory/4792-152-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-149-0x0000000000910000-0x00000000009B8000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/4792-151-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-150-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-147-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-122-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-146-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-116-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-144-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-143-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-142-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-140-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-141-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-139-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-131-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-138-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-137-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-136-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-135-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-134-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-133-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-132-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-123-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-130-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-128-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-129-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-127-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-126-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-125-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4792-124-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4944-173-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4944-177-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4944-176-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4944-175-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4944-174-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB