Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2022, 21:58

General

  • Target

    80690178a97a99e54eeb310d1f9b7dd97aaabcd2d4bb7e459464c51ecfaf47e8.exe

  • Size

    2.7MB

  • MD5

    ddbfa546fe1b1e1e0f7115fa96f0e3a8

  • SHA1

    3f7561631e53acbe00779fa0542b79c8ce1b3f8b

  • SHA256

    80690178a97a99e54eeb310d1f9b7dd97aaabcd2d4bb7e459464c51ecfaf47e8

  • SHA512

    7f97ff49f647755aa372ca6c43a6514ffc8f20539ef828be3a9f769ab6727cc822a0fd82b89bf6800468671c214d2a729c799431f026b3730436d1be541ea004

  • SSDEEP

    49152:ON26FOnzGn6LJvqkwnpC+mWd6uIcc9fJIluAGzdlz+mdUHZxs8GPX:O06FOznLo0+Dd6uxc9xIwCZxDGPX

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80690178a97a99e54eeb310d1f9b7dd97aaabcd2d4bb7e459464c51ecfaf47e8.exe
    "C:\Users\Admin\AppData\Local\Temp\80690178a97a99e54eeb310d1f9b7dd97aaabcd2d4bb7e459464c51ecfaf47e8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\80690178a97a99e54eeb310d1f9b7dd97aaabcd2d4bb7e459464c51ecfaf47e8.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4063495947-34355257-727531523-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\un.exe
        "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\
        3⤵
        • Executes dropped EXE
        PID:764
      • C:\un.exe
        "C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar php-cgi.exe C:\PHP5433\
        3⤵
        • Executes dropped EXE
        PID:1764
      • C:\PHP5433\php-cgi.exe
        C:\PHP5433\php-cgi.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c md C:\ProgramData\Microsoft\Program
          4⤵
            PID:764
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md C:\ProgramData\Program
            4⤵
              PID:1752
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c md C:\ProgramData\Data
              4⤵
                PID:2008
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo.>c:\ODBC.INST.INI
                4⤵
                  PID:1688
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo.>c:\ODBC.INST.INI
                  4⤵
                    PID:1696
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c C:\ProgramData\Microsoft\EdgeUpdate\Log\ENDProxy.bat
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1268
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_BINARY /d 46000000020000000900 /f
                      5⤵
                        PID:1092
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
                        5⤵
                          PID:1408
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /d "" /f
                          5⤵
                            PID:1964
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
                            5⤵
                              PID:1740
                            • C:\Windows\SysWOW64\reg.exe
                              reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
                              5⤵
                                PID:1936
                              • C:\Windows\SysWOW64\reg.exe
                                reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f
                                5⤵
                                  PID:816
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /t REG_BINARY /d 4600000000 /f
                                  5⤵
                                    PID:1296
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /t REG_BINARY /d 4600000000 /f
                                    5⤵
                                      PID:1512
                                    • C:\Windows\SysWOW64\ipconfig.exe
                                      ipconfig /flushdns
                                      5⤵
                                      • Gathers network information
                                      PID:860

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\PHP5433\php-cgi.exe

                              Filesize

                              972KB

                              MD5

                              5612854da654663c0b066e3aaf5091d4

                              SHA1

                              88e42ab7c8a515a9b84dffcbaea4c0df7e519c29

                              SHA256

                              cc4ca836bf854c99c4cdc6f893ee1187d3178f62dc197c575dbf8058006aab18

                              SHA512

                              f3e855738db5764966822128e0758fff641e106527efc1ebdcb5d95e7b879f2456c357c568f0eed5f5cc69bb5d42fa492cbb4a98923d8c7147bd50a8bee79eed

                            • C:\PHP5433\php-cgi.exe

                              Filesize

                              972KB

                              MD5

                              5612854da654663c0b066e3aaf5091d4

                              SHA1

                              88e42ab7c8a515a9b84dffcbaea4c0df7e519c29

                              SHA256

                              cc4ca836bf854c99c4cdc6f893ee1187d3178f62dc197c575dbf8058006aab18

                              SHA512

                              f3e855738db5764966822128e0758fff641e106527efc1ebdcb5d95e7b879f2456c357c568f0eed5f5cc69bb5d42fa492cbb4a98923d8c7147bd50a8bee79eed

                            • C:\ProgramData\Data\UPX.rar

                              Filesize

                              866KB

                              MD5

                              3baed4d50bf5826da0c6d7f7a105e68b

                              SHA1

                              11b7850f3b81a5bd1f7f31547a9d7dfcbb2a26bb

                              SHA256

                              8c502c920f85629e9d9a2e190c9adf161dc799de6563821ee1d9c287a49cc9de

                              SHA512

                              964d276f3c2002df6ed09e275bbbb070611044afc4f31675e94469bf8b234e05842d426e598a50f419c294b13a9447515d22d963c278aa9dd98ce72c46c8fe0f

                            • C:\ProgramData\Microsoft\EdgeUpdate\Log\ENDProxy.bat

                              Filesize

                              1KB

                              MD5

                              d6e7f85fb5ccc7e743a912dcc878a828

                              SHA1

                              44ea7719fcca357609e2195e565882aff61f7c23

                              SHA256

                              9183365687d91a6cb6121db92e23ccd2c2eead5faf24b871b748f13b8ecf4aa7

                              SHA512

                              3f1a7b90dd8c3f7ccd54e403bb266bb0ff3a69316ac2902923720680dc6489a031de9b048279bea18111eec43ac886cf33cfbaac27ca3fb33ddd4bd9f2674821

                            • C:\ProgramData\Microsoft\Program\ziliao.jpg

                              Filesize

                              336KB

                              MD5

                              ba4c1ad178f7efd5d5c7a1e988751220

                              SHA1

                              3df46c7ecfe6ed059e82f70fa9bce1a7450f6290

                              SHA256

                              df30623e00770a59af3a070212987936b5b2770104ff85f8d77f63e1f54bd38d

                              SHA512

                              fb85ef2beac6878923049c9f38faef08ae54c4bbfccc1761800c23034ccfebbfed0dc5c0a4558fd9ccfcdf7ca5b354603c88e2b3fa62fd112aa6922cf809643a

                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                              Filesize

                              318KB

                              MD5

                              b5fc476c1bf08d5161346cc7dd4cb0ba

                              SHA1

                              280fac9cf711d93c95f6b80ac97d89cf5853c096

                              SHA256

                              12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

                              SHA512

                              17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

                            • C:\un.exe

                              Filesize

                              322KB

                              MD5

                              5770866edbb1a095d7edc981f37d9d53

                              SHA1

                              e067a008a709459a1732e0ab06de277501be076f

                              SHA256

                              e4e8ac5179f1dff784e64c0299a9c39917352a06806ebba2de15f8d129275367

                              SHA512

                              b88c6817ef6d4301d0a99866c884627fbeaf20aee65cbd3ac519cb1e8880147710cdb19e853b2bd8b712a31efc57040c189d198ef361c4c2e11f377c42deaed4

                            • C:\un.exe

                              Filesize

                              322KB

                              MD5

                              5770866edbb1a095d7edc981f37d9d53

                              SHA1

                              e067a008a709459a1732e0ab06de277501be076f

                              SHA256

                              e4e8ac5179f1dff784e64c0299a9c39917352a06806ebba2de15f8d129275367

                              SHA512

                              b88c6817ef6d4301d0a99866c884627fbeaf20aee65cbd3ac519cb1e8880147710cdb19e853b2bd8b712a31efc57040c189d198ef361c4c2e11f377c42deaed4

                            • C:\un.exe

                              Filesize

                              322KB

                              MD5

                              5770866edbb1a095d7edc981f37d9d53

                              SHA1

                              e067a008a709459a1732e0ab06de277501be076f

                              SHA256

                              e4e8ac5179f1dff784e64c0299a9c39917352a06806ebba2de15f8d129275367

                              SHA512

                              b88c6817ef6d4301d0a99866c884627fbeaf20aee65cbd3ac519cb1e8880147710cdb19e853b2bd8b712a31efc57040c189d198ef361c4c2e11f377c42deaed4

                            • \??\c:\ODBC.INST.INI

                              Filesize

                              2B

                              MD5

                              81051bcc2cf1bedf378224b0a93e2877

                              SHA1

                              ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                              SHA256

                              7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                              SHA512

                              1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                            • \PHP5433\php-cgi.exe

                              Filesize

                              972KB

                              MD5

                              5612854da654663c0b066e3aaf5091d4

                              SHA1

                              88e42ab7c8a515a9b84dffcbaea4c0df7e519c29

                              SHA256

                              cc4ca836bf854c99c4cdc6f893ee1187d3178f62dc197c575dbf8058006aab18

                              SHA512

                              f3e855738db5764966822128e0758fff641e106527efc1ebdcb5d95e7b879f2456c357c568f0eed5f5cc69bb5d42fa492cbb4a98923d8c7147bd50a8bee79eed

                            • \PHP5433\php-cgi.exe

                              Filesize

                              972KB

                              MD5

                              5612854da654663c0b066e3aaf5091d4

                              SHA1

                              88e42ab7c8a515a9b84dffcbaea4c0df7e519c29

                              SHA256

                              cc4ca836bf854c99c4cdc6f893ee1187d3178f62dc197c575dbf8058006aab18

                              SHA512

                              f3e855738db5764966822128e0758fff641e106527efc1ebdcb5d95e7b879f2456c357c568f0eed5f5cc69bb5d42fa492cbb4a98923d8c7147bd50a8bee79eed

                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

                              Filesize

                              1.3MB

                              MD5

                              dec931e86140139380ea0df57cd132b6

                              SHA1

                              b717fd548382064189c16cb94dda28b1967a5712

                              SHA256

                              5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

                              SHA512

                              14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

                            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

                              Filesize

                              318KB

                              MD5

                              b5fc476c1bf08d5161346cc7dd4cb0ba

                              SHA1

                              280fac9cf711d93c95f6b80ac97d89cf5853c096

                              SHA256

                              12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

                              SHA512

                              17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

                            • memory/764-67-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

                              Filesize

                              8KB

                            • memory/900-81-0x0000000000400000-0x00000000007CB000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/900-73-0x0000000000400000-0x00000000007CB000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/1452-518-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-535-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-497-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-496-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-498-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-499-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-500-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-502-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-501-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-503-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-504-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-505-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-507-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-506-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-508-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-509-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-510-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-512-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-511-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-513-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-514-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-515-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-516-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-517-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-519-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-493-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-520-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-521-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-523-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-522-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-525-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-524-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-526-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-527-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-528-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-529-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-530-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-531-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-532-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-533-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-534-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-495-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-537-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-536-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-539-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-538-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-540-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-541-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-542-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-543-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-544-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-545-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-546-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-547-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-1480-0x0000000001D50000-0x0000000001E50000-memory.dmp

                              Filesize

                              1024KB

                            • memory/1452-1482-0x0000000001EF0000-0x0000000002071000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/1452-494-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-4671-0x0000000000400000-0x0000000000524000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-4666-0x0000000001D50000-0x0000000001E50000-memory.dmp

                              Filesize

                              1024KB

                            • memory/1452-4646-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-4647-0x0000000000400000-0x0000000000524000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-4648-0x00000000022C0000-0x00000000023C1000-memory.dmp

                              Filesize

                              1.0MB

                            • memory/1452-4649-0x0000000002080000-0x0000000002121000-memory.dmp

                              Filesize

                              644KB

                            • memory/1452-82-0x0000000000400000-0x0000000000524000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-492-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-491-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-490-0x00000000021A0000-0x00000000022B1000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1452-84-0x0000000077430000-0x0000000077477000-memory.dmp

                              Filesize

                              284KB

                            • memory/2032-70-0x0000000002B50000-0x0000000002F1B000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/2032-69-0x0000000002B50000-0x0000000002F1B000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

                              Filesize

                              8KB