Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 15:30

General

  • Target

    f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe

  • Size

    193KB

  • MD5

    4b61bfb74b4518d0733aa550c6fc7f0b

  • SHA1

    940e255e7f360235b33282e0b0a4aa600b9cd681

  • SHA256

    f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4

  • SHA512

    d0b87aba7796bc62dd4c3cb84bf66fb7feee1ad49b9f47241d4b216a78c074715121915d3e7113a3d2d3b9e5d0cec5d07d45841acc04b37027d5f8d91fa0346a

  • SSDEEP

    3072:nbLpZuEskJoU4CqQ1LNALc9gWhQh22c4uSiDmXy3PnHbhEdILWoja4jbeRmotu:nbOOxBdNeczhQk4Til/nHF/jFjimH

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe
    "C:\Users\Admin\AppData\Local\Temp\f94591b202032534dc5a945891aac816808291b91975c8a47220c5835bef39d4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp
      "C:\Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp" "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe" e -o+ -pqwaszx 1.rar
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Users\Admin\AppData\Local\Temp\UnRAR.exe
        "C:\Users\Admin\AppData\Local\Temp\UnRAR.exe" e -o+ -pqwaszx 1.rar
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:588
    • C:\Users\Admin\AppData\Local\Temp\01.exe
      01.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 256
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:1324
    • C:\Users\Admin\AppData\Local\Temp\02.exe
      02.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 256
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:1892

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • C:\Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • C:\Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • C:\Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • C:\Users\Admin\AppData\Local\Temp\1.rar

    Filesize

    33KB

    MD5

    41d92ccb2fe2c0f5a646e659ddae6ed2

    SHA1

    bcdb555a87271749c7844ae8e13846abd7e7b039

    SHA256

    0485f52f3a00a1e1a540f108553e4aedf8bbb5c837a3533671774351b270ea3f

    SHA512

    31c8c51e056f8774f52f2d32e2b27a404616603949462476d37f0d35b3b5234f2c472cadabead52bccda9c04b96d2da064ea0cba397e6ed6039536781e4c1e50

  • C:\Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • C:\Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • C:\Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp

    Filesize

    6KB

    MD5

    2b81b005983d2147fd587f6a54e2480e

    SHA1

    cb21d91fa43bec9b6948fdca4f312949e71beb9f

    SHA256

    e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a

    SHA512

    b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb

  • C:\Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp

    Filesize

    6KB

    MD5

    2b81b005983d2147fd587f6a54e2480e

    SHA1

    cb21d91fa43bec9b6948fdca4f312949e71beb9f

    SHA256

    e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a

    SHA512

    b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\01.exe

    Filesize

    61KB

    MD5

    66050a0058410559f98b3d3ac9e2bd6d

    SHA1

    18b4dc220d44b271cbb98f7e352afc273d95b699

    SHA256

    dbfc5b6173827f2361539f76944da0c76f3656ea63d39e0bc96ca18eda532c40

    SHA512

    8e95df63a10b02a5ffc17df2d0729d8b65411d52ee8d11d3375472bdb592454df5bb4ba0b4e882765d41a159ba01df42959d1e10dc9e876cbc977091a2e6f6e5

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\02.exe

    Filesize

    6KB

    MD5

    3c4eef3f3c3610800290619dfd66d551

    SHA1

    c0f8229179366a2d43566d95da66347938c374ae

    SHA256

    483afdadbec58f8a1a85c97c7ba5a60890b515128b08ffe617da4e7769513f00

    SHA512

    c16cc9edb7fe2870fe7a05aeac1cf7ffd6e35c3c259b5ad2ca24d390b8b744469b285f93b93ae82f83200a7a6bca53989c9e850bf89946998de6fb913aaa7dfd

  • \Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • \Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • \Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • \Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • \Users\Admin\AppData\Local\Temp\UnRAR.exe

    Filesize

    90KB

    MD5

    d87ddf597baf91e7d32b20c0b4d855da

    SHA1

    4e855b5c03e0a52d8057bc86b83a07f10d00e455

    SHA256

    264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac

    SHA512

    f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26

  • \Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp

    Filesize

    6KB

    MD5

    2b81b005983d2147fd587f6a54e2480e

    SHA1

    cb21d91fa43bec9b6948fdca4f312949e71beb9f

    SHA256

    e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a

    SHA512

    b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb

  • \Users\Admin\AppData\Local\Temp\nst8F9.tmp\ns909.tmp

    Filesize

    6KB

    MD5

    2b81b005983d2147fd587f6a54e2480e

    SHA1

    cb21d91fa43bec9b6948fdca4f312949e71beb9f

    SHA256

    e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a

    SHA512

    b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb

  • \Users\Admin\AppData\Local\Temp\nst8F9.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    03a1a9be1f1e72f926ec9161825eedd6

    SHA1

    d0574bafc615168c021788d413a3a73d275c492d

    SHA256

    8a8bce943b78093ecd86a42c203931ee625f445acf5cb5b705e3b7eaf29c7110

    SHA512

    8d82e15ee109d2236a995990fdd0c9fb39c9d3c4dea1c063f0806314e7a9d09a112f4f09091c265adba9f86ec7a0977294cce112e20ffb2f8b3ad62ab3dac396

  • memory/588-72-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/900-74-0x00000000002E0000-0x0000000000322000-memory.dmp

    Filesize

    264KB

  • memory/900-73-0x00000000002E0000-0x0000000000322000-memory.dmp

    Filesize

    264KB

  • memory/1396-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

    Filesize

    8KB

  • memory/1396-104-0x0000000000370000-0x0000000000375000-memory.dmp

    Filesize

    20KB

  • memory/1396-99-0x0000000000370000-0x0000000000382000-memory.dmp

    Filesize

    72KB

  • memory/1396-112-0x0000000000370000-0x0000000000375000-memory.dmp

    Filesize

    20KB

  • memory/1396-110-0x0000000000370000-0x0000000000382000-memory.dmp

    Filesize

    72KB

  • memory/1396-111-0x0000000000370000-0x0000000000382000-memory.dmp

    Filesize

    72KB

  • memory/1396-100-0x0000000000370000-0x0000000000382000-memory.dmp

    Filesize

    72KB

  • memory/1832-107-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1832-108-0x0000000000020000-0x0000000000025000-memory.dmp

    Filesize

    20KB

  • memory/1832-109-0x0000000000020000-0x0000000000025000-memory.dmp

    Filesize

    20KB

  • memory/1832-115-0x0000000000020000-0x0000000000025000-memory.dmp

    Filesize

    20KB

  • memory/2008-105-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

  • memory/2008-106-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

  • memory/2008-103-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2008-113-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB

  • memory/2008-114-0x0000000000230000-0x0000000000242000-memory.dmp

    Filesize

    72KB