Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 22:11

General

  • Target

    71850bb60e7759b3a4504fa57d6c8bcb48f621aaee0ac0181d717791490911ab.exe

  • Size

    1.7MB

  • MD5

    81d2002f1b4a8d8790356a6dc954b289

  • SHA1

    c479869120d17ba84b5cf7a947dcb7bf9a7c8190

  • SHA256

    71850bb60e7759b3a4504fa57d6c8bcb48f621aaee0ac0181d717791490911ab

  • SHA512

    1221e5b4a80aed8bb759a9ce59c0795a7bab01774fe65f1061d568ff3b5336382fd09d52d769cf5a09a0175eda64034f706ee77baae72219652730c48cdba835

  • SSDEEP

    24576:KvxfwSxotpRw0LcA8z4YBIAriJHe5vghSFQm3tBsVZayN8n35vj+ocMe4uwXXTt6:ZSx6V98z3HTl76/4qGGXqPw+s

Malware Config

Signatures

  • ASPack v2.12-2.42 26 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 14 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71850bb60e7759b3a4504fa57d6c8bcb48f621aaee0ac0181d717791490911ab.exe
    "C:\Users\Admin\AppData\Local\Temp\71850bb60e7759b3a4504fa57d6c8bcb48f621aaee0ac0181d717791490911ab.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\4c3a3f80.exe
      C:\4c3a3f80.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3160
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Loads dropped DLL
    PID:4800
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
    1⤵
    • Loads dropped DLL
    PID:4860
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
    1⤵
    • Loads dropped DLL
    PID:1600
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
    1⤵
    • Loads dropped DLL
    PID:3472
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
    1⤵
    • Loads dropped DLL
    PID:3852
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
    1⤵
    • Loads dropped DLL
    PID:4328
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
    1⤵
    • Loads dropped DLL
    PID:4116
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
    1⤵
    • Loads dropped DLL
    PID:220
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
    1⤵
    • Loads dropped DLL
    PID:2788
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
    1⤵
    • Loads dropped DLL
    PID:3996
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
    1⤵
    • Loads dropped DLL
    PID:2400
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
    1⤵
    • Loads dropped DLL
    PID:4276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\4c3a3f80.exe

    Filesize

    238KB

    MD5

    683d0370e535bbb21489bd0255c26256

    SHA1

    c49011481ff216759ea0632f04a5cd3fa5cc743c

    SHA256

    e897feca67c0c2e0c539f8040b5b5ac254196a11495c236cd296e678d692e082

    SHA512

    0ebdedbf2534fd6939b132c9f1cf6d64d88a4b9f60c23c459c7c2f0ec7e5d0203bfa7a2bb33fa57a141b8440cce5a044e160717ed30777e833f07936bb4bdd40

  • C:\4c3a3f80.exe

    Filesize

    238KB

    MD5

    683d0370e535bbb21489bd0255c26256

    SHA1

    c49011481ff216759ea0632f04a5cd3fa5cc743c

    SHA256

    e897feca67c0c2e0c539f8040b5b5ac254196a11495c236cd296e678d692e082

    SHA512

    0ebdedbf2534fd6939b132c9f1cf6d64d88a4b9f60c23c459c7c2f0ec7e5d0203bfa7a2bb33fa57a141b8440cce5a044e160717ed30777e833f07936bb4bdd40

  • C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\Irmon.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\LogonHours.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\NWCWorkstation.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\Nla.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\Ntmssvc.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\Nwsapagent.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\PCAudit.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\SRService.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\WmdmPmSp.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\helpsvc.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • C:\Windows\SysWOW64\uploadmgr.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\helpsvc.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\irmon.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\logonhours.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\nla.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\ntmssvc.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\nwcworkstation.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\nwsapagent.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\pcaudit.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\srservice.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\uploadmgr.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • \??\c:\windows\SysWOW64\wmdmpmsp.dll

    Filesize

    238KB

    MD5

    5bde78cbb6156f62b8a8fd3ce0f477df

    SHA1

    8290372f48fe98c65566f6aee6eaa2b313329716

    SHA256

    b4c11b4dc871f5e52fb0666e4e7b3a82da86f2422a00c59c555a04554f7dcbaf

    SHA512

    3f07a68524ec9d6766520118584574f5a5c7c2d7eccd308c8555fb8dc428151ee0e441ff55dca303b06dc14aab2b79d7a375a9b72e565cf3c410d0360baa13d1

  • memory/220-181-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/220-180-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/220-179-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/1600-152-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/1600-154-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/1600-153-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/2400-194-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/2400-195-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/2400-196-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/2788-186-0x0000000074BE0000-0x0000000074C2E000-memory.dmp

    Filesize

    312KB

  • memory/2788-184-0x0000000074BE0000-0x0000000074C2E000-memory.dmp

    Filesize

    312KB

  • memory/2788-185-0x0000000074BE0000-0x0000000074C2E000-memory.dmp

    Filesize

    312KB

  • memory/3160-137-0x0000000000450000-0x000000000049E000-memory.dmp

    Filesize

    312KB

  • memory/3160-136-0x0000000000450000-0x000000000049E000-memory.dmp

    Filesize

    312KB

  • memory/3160-138-0x0000000000450000-0x000000000049E000-memory.dmp

    Filesize

    312KB

  • memory/3160-144-0x00000000024E0000-0x00000000064E0000-memory.dmp

    Filesize

    64.0MB

  • memory/3160-156-0x00000000024E0000-0x00000000064E0000-memory.dmp

    Filesize

    64.0MB

  • memory/3160-203-0x0000000000450000-0x000000000049E000-memory.dmp

    Filesize

    312KB

  • memory/3472-159-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3472-160-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3472-161-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3852-164-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3852-165-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3852-166-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/3996-191-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/3996-189-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/3996-190-0x00000000746D0000-0x000000007471E000-memory.dmp

    Filesize

    312KB

  • memory/4116-176-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4116-175-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4116-174-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4276-202-0x0000000074EF0000-0x0000000074F3E000-memory.dmp

    Filesize

    312KB

  • memory/4276-201-0x0000000074EF0000-0x0000000074F3E000-memory.dmp

    Filesize

    312KB

  • memory/4276-200-0x0000000074EF0000-0x0000000074F3E000-memory.dmp

    Filesize

    312KB

  • memory/4328-170-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4328-169-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4328-172-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4504-197-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

  • memory/4504-155-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

  • memory/4504-132-0x0000000000400000-0x00000000005C2000-memory.dmp

    Filesize

    1.8MB

  • memory/4800-141-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4800-143-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4800-142-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4860-148-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4860-147-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB

  • memory/4860-149-0x0000000074D30000-0x0000000074D7E000-memory.dmp

    Filesize

    312KB